Read the docs
TI-2024-18683 Aliases CVE-2024-28102GHSA-j857-7rvv-vj97

JWCrypto vulnerable to JWT bomb Attack in `deserialize` function

Priority MEDIUM 63CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 4 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.

Summary

JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time. Version 1.5.6 fixes this vulnerability by limiting the maximum token length.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0098 62nd percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Partial jwcrypto (latchset): 1.5.6jwcrypto (PyPI): 1.5.6Red Hat: 3 advisoriesRed Hat: 4 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
latchsetjwcryptobefore 1.5.61.5.6Patch availableCNA
—jwcrypto (PyPI)before 1.5.61.5.6Patch availableGHSA-j857-7rvv-vj97
  • jwcrypto Vendorlatchset Affected before 1.5.6 Fixed in 1.5.6 Patch available CNA
  • jwcrypto (PyPI) Vendor— Affected before 1.5.6 Fixed in 1.5.6 Patch available GHSA-j857-7rvv-vj97

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:latchset:jwcrypto:*:*:*:*:*:*:*:*before 1.5.6Vulnerablelatchset
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
  • cpe:2.3:a:latchset:jwcrypto:*:*:*:*:*:*:*:* Versions before 1.5.6 Vulnerable ·latchset
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

  • Fix · CNA jwcrypto (latchset) Fixed in 1.5.6
  • Fix · GHSA-j857-7rvv-vj97 jwcrypto (PyPI) Fixed in 1.5.6 Advisory →

Red Hat 3 advisories

  • RHSA-2024:4522 Released 2024-07-12 · Red Hat rating Moderate
    Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.4 for RHEL 8 automation-controller-venv-tower-4.5.8-1.el8ap
    • Red Hat Ansible Automation Platform 2.4 for RHEL 9 automation-controller-venv-tower-4.5.8-1.el9ap
  • RHSA-2024:3267 Released 2024-05-22 · Red Hat rating Moderate
    idm:DL1 and idm:client security update
    • Red Hat Enterprise Linux AppStream (v. 8) bind-dyndb-ldap-11.6-5.module+el8.10.0+21691+df63127d.aarch64::idm:DL1, bind-dyndb-ldap-11.6-5.module+el8.10.0+21691+df63127d.ppc64le::idm:DL1, bind-dyndb-ldap-11.6-5.module+el8.10.0+21691+df63127d.s390x::idm:DL1 +47
  • RHSA-2024:2559 Released 2024-04-30 · Red Hat rating Moderate
    python-jwcrypto security update
    • Red Hat Enterprise Linux AppStream (v. 9) python-jwcrypto-0.8-5.el9_4, python3-jwcrypto-0.8-5.el9_4

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Ansible Automation Platform 2.4 for RHEL 8Fixed RHSA-2024:4522
Red Hat Ansible Automation Platform 2.4 for RHEL 9Fixed RHSA-2024:4522
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:3267
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:2559
Not affected: 2 products
  • Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • Red Hat Ansible Automation Platform 2.4 for RHEL 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-28102
  2. 2026-10-03 Alias added: GHSA-j857-7rvv-vj97

References

Exploit 2

Patch 1

Advisory 2

Other 1

  • TI-2026-28360 JWCrypto: JWE ZIP decompression bomb CVSS 3.1MEDIUM 5.3
  • TI-2016-05392 The _Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before… CVSS 3.1MEDIUM 5.3
  • TI-2023-06111 Jwcrypto: denail of service via specifically crafted jwe CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences