PYSEC-2025-185

At a glance

Published
Updated
CVE
CVE-2024-29370
Aliases
GHSA-h4pw-wxh7-4vjj
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Description

In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.

Affected packages

PackageVersions
PyPI · python-joseintroduced 0, last affected 3.3.0

References

Sources

SourceLicence
OSV.devCC-BY 4.0 — PyPA Advisory Database