REDHAT-BUG-2524147: Medium severity jwcrypto JWE.deserialize() vulnerability
The compact JWE fallback in JWE.deserialize() splits attacker-controlled token text on every period delimiter before checking that the compact serialization has the required five segments. A malformed token containing millions of periods can therefore force a large delimiter-derived list allocation and raise MemoryError before jwcrypto reaches its normal malformed-token rejection, which can degrade availability for services that parse untrusted JWE values.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to availability impact?
Services that pass untrusted JWE values to jwcrypto's JWE.deserialize() are exposed. The issue can degrade availability when such input is processed.
What must an attacker provide to trigger the issue?
An attacker needs to supply a malformed compact JWE token containing millions of period delimiters. The token is split on every period before the required five-segment structure is checked.
How can the issue appear during operation?
Processing the malformed token can cause a large delimiter-derived list allocation and raise MemoryError before the normal malformed-token rejection occurs.