Critical Memory Exhaustion Vulnerability in python3-jwcrypto Package
Summary
ALSA-2026:19042: Low: python-jwcrypto security update. Affects python3-jwcrypto versions < 1.5.6-5.el10_2. Fixed in 1.5.6-5.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python3-jwcrypto package is a library for handling JSON Web Encryption (JWE) and JSON Web Signature (JWS) in Python. It provides a simple interface for creating and verifying cryptographic tokens, making it essential for secure data transmission in web applications. However, this package is vulnerable to a memory exhaustion issue, which can be exploited through specially crafted compressed JWE tokens.
Vulnerability Detail
The vulnerability, identified as CVE-2026-39373, arises from a flaw in the JWCrypto implementation of the python-cryptography library. Attackers can exploit this vulnerability by sending crafted compressed JWE tokens that cause excessive memory consumption on the server. This can lead to denial of service (DoS) conditions, where legitimate users are unable to access the service due to resource exhaustion. The issue is particularly concerning for applications that process untrusted input, as it can be triggered by malicious actors without requiring authentication.
How To Fix
Minimum fixed version
1.5.6-5.el10_2
This is the first release that contains the fix.
sudo dnf update python3-jwcryptoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to update the package immediately, consider implementing input validation to restrict the size and format of incoming JWE tokens. This can help mitigate the risk of memory exhaustion until a proper update can be applied.
Conclusion
The python3-jwcrypto package has a critical vulnerability that can lead to memory exhaustion and denial of service. It is crucial to update to the latest patched version to protect your applications. Additionally, consider using input validation as a temporary workaround.
See every vulnerability recorded for python3-jwcrypto →
FAQ
CVE-2026-39373 is a vulnerability in the python3-jwcrypto package that allows attackers to exploit memory exhaustion via crafted compressed JWE tokens.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your manifest file for vulnerabilities.
The main consequence is denial of service (DoS), where the application may become unresponsive due to excessive memory usage caused by malicious input.
Yes, a patch is available in version 1.5.6-5.el10_2 of the python3-jwcrypto package.
Implement input validation to restrict the size and format of incoming JWE tokens as a temporary measure until you can update.
Related vulnerabilities
Recent vulnerabilities recorded for python3-jwcrypto.
