CVE-2024-28102: JWCrypto vulnerable to JWT bomb Attack in `deserialize` function
Vulnerability summary
CVE-2024-28102 is a medium (CVSS 6.8) vulnerability in debian debian_linux. EPSS estimates a 0.98% chance of exploitation in the next 30 days, higher than 62.2% of scored vulnerabilities. 2 public exploits are recorded.
Not severe (CVSS 6.8, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 3 · Related 3Timeline
- 06-03-2024PublishedVulnerability first disclosed.
- 09-09-2024Last modifiedVulnerability information updated.
Description
JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time. Version 1.5.6 fixes this vulnerability by limiting the maximum token length.
CVSS metrics
8 scores · 8 sources · 1 version- OSV · PypiEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
- OSV · Red hatEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
- NVDNIST6.8MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
EPSS trend
Probability
0.98%
Chance of exploitation in the next 30 days
Percentile
62%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.98% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundJwcrypto
Maturity: poc
Exploit Reference (vicarius.io)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, administrative account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Debian2 products
- python-jwcrypto< 0.8.0-1+deb11u1 | < 1.1.0-1+deb12u1 | < 1.5.6-1
- debian_linuxEOL11.0
Redhat2 products
- python-jwcrypto< 0:0.8-5.el9_4
- python3-jwcrypto< 0:0.8-5.el9_4
Chainguard1 product
- py3-jwcrypto< 1.5.6-r0
Latchset1 product
- jwcrypto< 1.5.6
PyPI1 product
- jwcrypto< 1.5.6
Ubuntu1 product
- python-jwcryptoAll versions (No fix recorded)
Wolfi1 product
- py3-jwcrypto< 1.5.6-r0
7 vendors · 9 products
References
17 links- github.com/latchset/jwcrypto/security/advisories/GHSA-j857-7rvv-vj97X Refsource CONFIRMWEBARTICLEREPORTAdvisoryExploitVendor Advisory
- github.com/latchset/jwcrypto/commit/90477a3b6e73da69740e00b8161f53fea19b831fX Refsource MISCWEBFIXARTICLEREPORTPatch
- github.com/latchset/jwcryptoPACKAGE
- pypi.org/project/jwcryptoPACKAGE