CVE-2024-28102: jwcrypto Package Vulnerable to JWT Bomb Attack Leading to Denial of Service
Summary
CVE-2024-28102: JWCrypto vulnerable to JWT bomb Attack in deserialize function. Affects jwcrypto versions < 1.5.6. Fixed in 1.5.6. How to fix ↓
Also tracked for
- python-jwcrypto · Debian:11
The same CVE-2024-28102 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jwcrypto package is a Python library that provides tools for creating and managing JSON Web Tokens (JWTs) and JSON Web Encryption (JWE). It allows developers to securely transmit information between parties as a JSON object. However, the package is vulnerable to a specific attack known as a JWT bomb, which can lead to Denial of Service (DoS) by consuming excessive memory and processing time.
Vulnerability Detail
The vulnerability arises from the deserialize function in the jwcrypto library, where an attacker can exploit the handling of malicious JWE tokens with high compression ratios. By sending a specially crafted token, the server can be forced to use an inordinate amount of resources, leading to potential service outages. This issue is particularly concerning as it can be executed with minimal effort, making it a significant threat to applications relying on this library.
How To Fix
Latest published version: 1.6.1 as of 22 Oct 2026
pip install --upgrade "jwcrypto==1.6.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.6
This is the first release that contains the fix.
pip install --upgrade "jwcrypto==1.5.6"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the maximum token length to 250K characters. This approach has been successfully implemented in other libraries to mitigate similar vulnerabilities. Implementing this limit can help prevent attackers from exploiting the high compression ratio of tokens.
Conclusion
The jwcrypto package is vulnerable to a JWT bomb attack, which can lead to Denial of Service by consuming excessive resources. It is crucial to update to the patched version 1.5.6 or later to mitigate this risk. Implementing a maximum token length limit can also serve as a temporary workaround. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for jwcrypto →
FAQ
A JWT bomb attack is a type of Denial of Service (DoS) attack where an attacker sends a malicious JSON Web Encryption (JWE) token that consumes excessive memory and processing time when processed by the server.
You can check if your application is affected by using the Vulert playground at Vulert Scanner. It allows you to monitor and alert for open-source vulnerabilities without requiring any signup.
If exploited, this vulnerability can lead to service outages, as the server may become unresponsive due to high resource consumption caused by processing malicious tokens.
Yes, the vulnerability has been patched in version 1.5.6 of the jwcrypto package. It is recommended to update to this version or later.
The CVSS score of this vulnerability is 6.8, indicating a medium severity level that requires attention.
References
Related vulnerabilities
Recent vulnerabilities recorded for jwcrypto.
