In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.
References
| Link | Resource |
|---|---|
| https://github.com/mpdavis/python-jose/issues/344 | Exploit Issue Tracking Patch |
Configurations
History
05 Jan 2026, 15:14
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/mpdavis/python-jose/issues/344 - Exploit, Issue Tracking, Patch | |
| First Time |
Python-jose Project
Python-jose Project python-jose |
|
| CPE | cpe:2.3:a:python-jose_project:python-jose:3.3.0:*:*:*:*:*:*:* |
17 Dec 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
| CWE | CWE-409 |
17 Dec 2025, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-17 16:16
Updated : 2026-01-05 15:14
NVD link : CVE-2024-29370
Mitre link : CVE-2024-29370
CVE.ORG link : CVE-2024-29370
JSON object : View
Products Affected
python-jose_project
- python-jose
CWE
CWE-409
Improper Handling of Highly Compressed Data (Data Amplification)