Medium severity5.3NVD Advisory· Published Apr 7, 2026· Updated Apr 15, 2026
CVE-2026-39373
CVE-2026-39373
Description
JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to 1.5.7, an unauthenticated attacker can exhaust server memory by sending crafted JWE tokens with ZIP compression. The existing patch for CVE-2024-28102 limits input token size to 250KB but does not validate the decompressed output size. An unauthenticated attacker can cause memory exhaustion on memory-constrained systems. A token under the 250KB input limit can decompress to approximately 100MB. This vulnerability is fixed in 1.5.7.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
jwcryptoPyPI | <= 1.5.6 | — |
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- github.com/latchset/jwcrypto/security/advisories/GHSA-fjrm-76x2-c4q4nvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-fjrm-76x2-c4q4ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-39373ghsaADVISORY
News mentions
0No linked articles in our index yet.