CVE-2024-28102: JWCrypto Vulnerable to JWT Bomb Attack
Summary
CVE-2024-28102: JWCrypto vulnerable to JWT bomb Attack in deserialize function. Affects jwcrypto versions < 1.5.6. Fixed in 1.5.6. How to fix ↓
Also tracked for
- python-jwcrypto · Debian:11
The same CVE-2024-28102 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
JWCrypto is an open-source Python library that provides cryptographic functionality for JSON Web Tokens (JWT). It allows users to generate, sign, and verify JWTs using various encryption algorithms. The library is widely used in applications that require secure token-based authentication and authorization. However, a vulnerability has been discovered in the library's deserialize function, which can be exploited by an attacker to launch a JWT bomb attack.
Vulnerability Detail
The vulnerability in JWCrypto arises from the library's inability to handle malicious JWE Tokens with a high compression ratio. When a server processes such a token, it consumes excessive memory and processing time, leading to a denial-of-service (DoS) attack. An attacker can craft a JWE Token with a payload containing a large amount of repetitive data, causing the server to exhaust its resources while attempting to decompress and process the token. This vulnerability can result in service disruption and impact the availability of the affected application.
How To Fix
Latest published version: 1.6.1 as of 22 Oct 2026
pip install --upgrade "jwcrypto==1.6.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.6
This is the first release that contains the fix.
pip install --upgrade "jwcrypto==1.5.6"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the library is not immediately feasible, a temporary workaround is to limit the maximum token length to 250K. By imposing this restriction, the impact of a potential JWT bomb attack can be mitigated. However, it is crucial to note that this workaround may affect the functionality or usability of the application, as it restricts the size of valid tokens.
Conclusion
The vulnerability in JWCrypto's deserialize function exposes applications to the risk of a denial-of-service (DoS) attack through JWT bomb attacks. It is crucial to update the library to the latest non-vulnerable version (1.5.6 or later) to mitigate this risk. Alternatively, implementing the temporary workaround of limiting the maximum token length can provide some level of protection. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for jwcrypto →
FAQ
JWCrypto is a Python library used for cryptographic operations related to JSON Web Tokens (JWT). It provides functionality for generating, signing, and verifying JWTs using various encryption algorithms.
A JWT bomb attack is a type of denial-of-service (DoS) attack that exploits the vulnerability in the JWCrypto library. By crafting a malicious JWE Token with a high compression ratio, an attacker can overwhelm the server's resources, causing it to consume excessive memory and processing time.
The vulnerability in JWCrypto can lead to a denial-of-service (DoS) attack, resulting in service disruption and impacting the availability of the affected application. It can cause the server to consume excessive resources, leading to degraded performance or even complete unresponsiveness.
To fix this vulnerability, it is recommended to update the JWCrypto library to version 1.5.6 or later. The updated version includes a fix for the vulnerability. Users should update their dependencies to ensure they are using a non-vulnerable version of the library.
Yes, if updating the library is not immediately feasible, a temporary workaround is to limit the maximum token length to 250K. By imposing this restriction, the impact of a potential JWT bomb attack can be mitigated. However, it is important to note that this workaround may affect the functionality or usability of the application.
References
Related vulnerabilities
Recent vulnerabilities recorded for jwcrypto.
