RHLW-2026-d8dae5c979459da3: Lightwell Security Advisory: jwcrypto 1.0+rhlw.1
Red Hat Lightwell has released jwcrypto 1.0+rhlw.1 with backported fixes for CVE-2022-3102, CVE-2024-28102, CVE-2026-39373, and CVE-2023-6681.
CVE-2024-28102: JWCrypto vulnerable to JWT bomb Attack in deserialize function
CVE-2026-39373: JWCrypto: JWE ZIP decompression bomb
CVE-2023-6681: Jwcrypto: denail of service via specifically crafted jwe
This patched artifact is a drop-in replacement for jwcrypto 1.0 from PyPI.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
red-hat-lightwell/jwcryptoto a version that resolves this vulnerability.Fixed in 1.0+rhlw.1 - Upgrade
Upgrade
jwcryptoto a version that resolves this vulnerability.Fixed in 1.0+rhlw.1
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which deployments are most likely to be exposed to these denial-of-service issues?
Deployments using jwcrypto 1.0 that deserialize JWTs or process JWE content are the relevant exposure points, because the listed issues involve a JWT bomb in deserialize, a JWE ZIP decompression bomb, and a crafted JWE denial of service.
What level of access does an attacker need?
The supplied vector indicates network reachability, low attack complexity, no user interaction, and high privileges required. The advisory does not specify what application-level privilege or input path satisfies that requirement.
What should teams do to remediate?
Replace jwcrypto 1.0 with Red Hat Lightwell's jwcrypto 1.0+rhlw.1 artifact. The advisory states that this patched artifact is a drop-in replacement for the PyPI jwcrypto 1.0 package.
How can I determine whether my environment is affected?
Check whether the deployed dependency is jwcrypto 1.0 rather than jwcrypto 1.0+rhlw.1, and determine whether the application handles JWT deserialization or JWE processing. The advisory identifies those operations as the affected functionality.