CVE-2024-33664: python-jose Denial of Service via Compressed JWT Tokens
Summary
CVE-2024-33664: python-jose denial of service via compressed JWE content. Affects python-jose versions < 3.4.0. Fixed in 3.4.0. How to fix ↓
Also tracked for
- python-jose · Debian:12
The same CVE-2024-33664 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-jose is a Python library that provides a simple way to encode and decode JSON Web Tokens (JWTs). It is commonly used for implementing secure authentication and authorization mechanisms in web applications. The library allows users to create, sign, and verify JWTs, which are widely used for transmitting claims between parties. However, python-jose versions up to 3.3.0 are vulnerable to a denial of service (DoS) attack when decoding JSON Web Encryption (JWE) tokens with a high compression ratio. This vulnerability, also known as a 'JWT bomb,' can be exploited by attackers to consume excessive system resources, potentially leading to service disruption.
Vulnerability Detail
The python-jose library is susceptible to a denial of service vulnerability due to insufficient input validation when decoding JWE tokens. By crafting a malicious JWE token with a high compression ratio, an attacker can trigger a DoS condition by causing the library to consume excessive system resources during the decoding process. This vulnerability is similar to CVE-2024-21319. The impact of this vulnerability is moderate, as it can lead to resource exhaustion and service disruption. However, it does not allow for arbitrary code execution or unauthorized access to sensitive information.
How To Fix
Latest published version: 3.5.0 as of 22 Oct 2026
pip install --upgrade "python-jose==3.5.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.4.0
This is the first release that contains the fix.
pip install --upgrade "python-jose==3.4.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement rate limiting or request throttling mechanisms to mitigate the impact of potential DoS attacks. By limiting the number of requests or the processing time for each request, the impact of a malicious JWE token can be minimized. However, this workaround may affect the overall performance and responsiveness of the application, so it should be used cautiously and as a temporary measure until the library is updated.
Conclusion
The python-jose library is vulnerable to a denial of service (DoS) attack when decoding JSON Web Encryption (JWE) tokens with a high compression ratio. This can lead to resource exhaustion and service disruption. To mitigate this vulnerability, it is crucial to upgrade to python-jose version 3.3.1 or later. Developers should also consider implementing rate limiting or request throttling mechanisms as temporary workarounds. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python-jose →
FAQ
python-jose is a Python library used for encoding and decoding JSON Web Tokens (JWTs) and implementing secure authentication and authorization mechanisms in web applications.
A JSON Web Encryption (JWE) token is a type of JSON Web Token (JWT) that provides a standard way to encrypt and securely transmit claims between parties.
A 'JWT bomb' is a type of denial of service (DoS) attack that exploits the use of high compression ratios in JWT tokens to consume excessive system resources during decoding, leading to service disruption.
This vulnerability can lead to resource exhaustion and service disruption, but it does not allow for arbitrary code execution or unauthorized access to sensitive information.
To fix this vulnerability, it is recommended to upgrade to python-jose version 3.3.1 or later, which includes proper input validation to prevent the DoS condition when decoding JWE tokens.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-jose.
