CVE-2026-80179: Jwcrypto: jwcrypto: denial of service via malformed jwe tokens
A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This malformed token can force the JWE.deserialize() function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of service (DoS) for services that process untrusted JWE values.
Other sources
The compact JWE fallback in JWE.deserialize() splits attacker-controlled token text on every period delimiter before checking that the compact serialization has the required five segments. A malformed token containing millions of periods can therefore force a large delimiter-derived list allocation and raise MemoryError before jwcrypto reaches its normal malformed-token rejection, which can degrade availability for services that parse untrusted JWE values.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service condition?
Services using jwcrypto that pass untrusted JWE token values to JWE.deserialize() are exposed. The issue can degrade availability when an attacker can submit malformed token text to a code path that parses it.
What does an attacker need to exploit the issue?
An attacker needs network access to a service that processes attacker-controlled JWE values. No authentication or user interaction is required, but the attacker must send a malformed token containing a very large number of period delimiters.
What is the operational impact of a successful attack?
The crafted token can cause excessive memory allocation during delimiter splitting and raise MemoryError before normal malformed-token validation occurs. This can deny service or degrade availability of the affected parsing service.
How can teams determine whether they are affected?
Identify whether the application uses jwcrypto's JWE.deserialize() on JWE values received from untrusted sources. Review inbound token-processing paths, such as externally supplied requests or messages, for values passed into that function.