Critical Memory Exhaustion Vulnerability in python3-jwcrypto Package
Summary
ALSA-2026:19197: Low: python-jwcrypto security update. Affects python3-jwcrypto versions < 1.5.6-3.el9_8. Fixed in 1.5.6-3.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python3-jwcrypto package is a library for creating and verifying JSON Web Tokens (JWTs) using JWE (JSON Web Encryption). It is built on top of Python's cryptography library and provides developers with a straightforward interface for handling secure token operations. However, like any software, it is susceptible to vulnerabilities that can compromise its functionality and security.
Vulnerability Detail
The vulnerability identified as CVE-2026-39373 in the python3-jwcrypto package allows for memory exhaustion through crafted compressed JWE tokens. This means that an attacker could potentially send specially designed tokens that consume excessive memory resources, leading to denial of service conditions. The issue arises from improper handling of compressed tokens, which can overwhelm the system's memory allocation, causing applications to crash or become unresponsive.
How To Fix
Minimum fixed version
1.5.6-3.el9_8
This is the first release that contains the fix.
sudo dnf update python3-jwcryptoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation to reject any JWE tokens that do not conform to expected formats or sizes. This can help mitigate the risk of memory exhaustion until the package is updated. Additionally, monitoring system memory usage can help identify potential exploitation attempts.
Conclusion
The python3-jwcrypto package has a critical vulnerability that can lead to memory exhaustion through crafted JWE tokens. It is crucial to update to the latest patched version to secure applications against potential denial of service attacks. Implementing workarounds can provide temporary relief while awaiting updates.
See every vulnerability recorded for python3-jwcrypto →
FAQ
The vulnerability allows for memory exhaustion via crafted compressed JWE tokens, which can lead to denial of service.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
Update the python3-jwcrypto package to version 1.5.6-3.el9_8 to patch the vulnerability.
Yes, implement input validation for JWE tokens and monitor memory usage to detect potential attacks.
For detailed information, refer to the CVE page for CVE-2026-39373.
Related vulnerabilities
Recent vulnerabilities recorded for python3-jwcrypto.
