CVE-2024-33664: python-jose Denial of Service via High Compression JWE Token
Summary
CVE-2024-33664: python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryption (JWE) token with a high compression ratio, aka a "JWT bomb." This is simila... Affects python-jose versions < 3.4.0. Fixed in 3.4.0. How to fix ↓
Also tracked for
- python-jose · Debian:12
The same CVE-2024-33664 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-jose is a popular library in the Python ecosystem used for handling JSON Web Tokens (JWTs). It provides functionalities for encoding and decoding JWTs, supporting various algorithms for signing and encryption. The library is widely used in applications that require secure token-based authentication. However, a vulnerability has been identified that allows attackers to exploit the library's handling of JSON Web Encryption (JWE) tokens, leading to potential denial of service through resource exhaustion.
Vulnerability Detail
The vulnerability arises from the way python-jose processes JWE tokens with high compression ratios. Attackers can craft a specially designed JWE token that, when decoded, consumes excessive system resources, leading to a denial of service. This type of attack is often referred to as a 'JWT bomb.' The issue is present in versions of python-jose up to 3.3.0 and can severely impact the performance and availability of applications relying on this library.
How To Fix
Latest published version: 3.5.0 as of 22 Oct 2026
pip install --upgrade "python-jose==3.5.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.4.0
This is the first release that contains the fix.
pip install --upgrade "python-jose==3.4.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot immediately upgrade to the patched version, consider implementing input validation to reject overly compressed JWE tokens. This can help mitigate the risk of denial of service until you can apply the update.
Conclusion
The CVE-2024-33664 vulnerability in python-jose poses a significant risk of denial of service through the exploitation of high compression JWE tokens. It is crucial for developers using this library to update to version 3.4.0 or later to mitigate this risk. Additionally, implementing input validation can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for python-jose →
FAQ
CVE-2024-33664 is a vulnerability in the python-jose library that allows attackers to cause denial of service through specially crafted JWE tokens.
Versions of python-jose up to and including 3.3.0 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to denial of service, causing applications to become unresponsive due to resource exhaustion.
If an immediate upgrade is not possible, implement input validation to reject overly compressed JWE tokens as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-jose.
