Read the docs
TI-2026-28360 Aliases CVE-2026-39373GHSA-fjrm-76x2-c4q4

JWCrypto: JWE ZIP decompression bomb

Priority MEDIUM 63CWE-409Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 6 fixed, 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to 1.5.7, an unauthenticated attacker can exhaust server memory by sending crafted JWE tokens with ZIP compression. The existing patch for CVE-2024-28102 limits input token size to 250KB but does not validate the decompressed output size. An unauthenticated attacker can cause memory exhaustion on memory-constrained systems. A token under the 250KB input limit can decompress to approximately 100MB. This vulnerability is fixed in 1.5.7.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00306 23rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial jwcrypto (latchset): 1.5.7jwcrypto (PyPI): 1.5.7Red Hat: 7 advisoriesRed Hat: 6 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
latchsetjwcryptobefore 1.5.71.5.7Patch availableCNA
—jwcrypto (PyPI)before 1.5.71.5.7Patch availableGHSA-fjrm-76x2-c4q4
  • jwcrypto Vendorlatchset Affected before 1.5.7 Fixed in 1.5.7 Patch available CNA
  • jwcrypto (PyPI) Vendor— Affected before 1.5.7 Fixed in 1.5.7 Patch available GHSA-fjrm-76x2-c4q4

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:latchset:jwcrypto:*:*:*:*:*:*:*:*before 1.5.7Vulnerablelatchset
  • cpe:2.3:a:latchset:jwcrypto:*:*:*:*:*:*:*:* Versions before 1.5.7 Vulnerable ·latchset

Remediation

  • Fix · CNA jwcrypto (latchset) Fixed in 1.5.7
  • Fix · GHSA-fjrm-76x2-c4q4 jwcrypto (PyPI) Fixed in 1.5.7 Advisory →

Red Hat 7 advisories

  • RHSA-2026:59136 Released 2026-08-24 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.6 for RHEL 10 python-django-5.2.17-1.el10ap, python3-django-5.2.17-1.el10ap
    • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-cli-4.7.16-1.el9ap, automation-controller-venv-tower-4.7.16-1.el9ap, automation-platform-ui-2.6.13-1.el9ap +3
  • RHSA-2026:59135 Released 2026-08-24 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-cli-4.6.32-1.el8ap, automation-controller-venv-tower-4.6.32-1.el8ap, automation-gateway-server-2.5.20260824-1.el8ap +3
    • Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-cli-4.6.32-1.el9ap, automation-controller-venv-tower-4.6.32-1.el9ap, automation-gateway-server-2.5.20260824-1.el9ap +3
  • RHSA-2026:42132 Released 2026-07-20 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9 +7
Show 4 more Red Hat advisories
  • RHSA-2026:19197 Released 2026-05-19 · Red Hat rating Low
    python-jwcrypto security update
    • Red Hat Enterprise Linux AppStream (v. 9) python-jwcrypto-1.5.6-3.el9_8, python3-jwcrypto-1.5.6-3.el9_8
  • RHSA-2026:19042 Released 2026-05-19 · Red Hat rating Low
    python-jwcrypto security update
    • Red Hat Enterprise Linux AppStream (v. 10) python-jwcrypto-1.5.6-5.el10_2, python3-jwcrypto-1.5.6-5.el10_2
  • RHSA-2026:13512 Released 2026-05-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower-4.6.28-3.el8ap, automation-gateway-proxy-2.5.10-5.el8ap, automation-gateway-proxy-server-2.5.10-5.el8ap +19
    • Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower-4.6.28-3.el9ap, automation-gateway-proxy-2.6.14-2.el9, automation-gateway-proxy-server-2.6.14-2.el9 +19
  • RHSA-2026:13508 Released 2026-05-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor-1.6.4-3.el10ap, receptorctl-1.6.4-3.el10ap
    • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-4.7.11-2.el9ap, automation-controller-cli-4.7.11-2.el9ap, automation-controller-server-4.7.11-2.el9ap +25

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Ansible Automation Platform 2.5 for RHEL 8Fixed RHSA-2026:13512, RHSA-2026:59135
Red Hat Ansible Automation Platform 2.5 for RHEL 9Fixed RHSA-2026:13512, RHSA-2026:59135
Red Hat Ansible Automation Platform 2.6Fixed RHSA-2026:42132
Red Hat Ansible Automation Platform 2.6 for RHEL 9Fixed RHSA-2026:13508, RHSA-2026:59136
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:19042
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:19197
Not affected: 7 products
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Ansible Automation Platform 2.6
  • Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Hardened Images

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-39373
  2. 2026-10-03 Alias added: GHSA-fjrm-76x2-c4q4

References

Exploit 1

Advisory 1

Other 4

  • TI-2024-18683 JWCrypto vulnerable to JWT bomb Attack in `deserialize` function CVSS 3.1MEDIUM 6.8
  • TI-2016-05392 The _Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before… CVSS 3.1MEDIUM 5.3
  • TI-2023-06111 Jwcrypto: denail of service via specifically crafted jwe CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences