CVE-2026-39373

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39373", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-06T21:29:17.350Z", "datePublished": "2026-04-07T19:35:36.071Z", "dateUpdated": "2026-04-07T20:22:57.790Z"}, "containers": {"cna": {"title": "JWCrypto: JWE ZIP decompression bomb", "problemTypes": [{"descriptions": [{"cweId": "CWE-409", "lang": "en", "description": "CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/latchset/jwcrypto/security/advisories/GHSA-fjrm-76x2-c4q4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/latchset/jwcrypto/security/advisories/GHSA-fjrm-76x2-c4q4"}], "affected": [{"vendor": "latchset", "product": "jwcrypto", "versions": [{"version": "< 1.5.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-07T19:35:36.071Z"}, "descriptions": [{"lang": "en", "value": "JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to 1.5.7, an unauthenticated attacker can exhaust server memory by sending crafted JWE tokens with ZIP compression. The existing patch for CVE-2024-28102 limits input token size to 250KB but does not validate the decompressed output size. An unauthenticated attacker can cause memory exhaustion on memory-constrained systems. A token under the 250KB input limit can decompress to approximately 100MB. This vulnerability is fixed in 1.5.7."}], "source": {"advisory": "GHSA-fjrm-76x2-c4q4", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-07T20:22:50.934916Z", "id": "CVE-2026-39373", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T20:22:57.790Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-39373", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-07T20:22:50.934916Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T20:22:53.956Z"}}], "cna": {"title": "JWCrypto: JWE ZIP decompression bomb", "source": {"advisory": "GHSA-fjrm-76x2-c4q4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "latchset", "product": "jwcrypto", "versions": [{"status": "affected", "version": "< 1.5.7"}]}], "references": [{"url": "https://github.com/latchset/jwcrypto/security/advisories/GHSA-fjrm-76x2-c4q4", "name": "https://github.com/latchset/jwcrypto/security/advisories/GHSA-fjrm-76x2-c4q4", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to 1.5.7, an unauthenticated attacker can exhaust server memory by sending crafted JWE tokens with ZIP compression. The existing patch for CVE-2024-28102 limits input token size to 250KB but does not validate the decompressed output size. An unauthenticated attacker can cause memory exhaustion on memory-constrained systems. A token under the 250KB input limit can decompress to approximately 100MB. This vulnerability is fixed in 1.5.7."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-409", "description": "CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-07T19:35:36.071Z"}}}, "cveMetadata": {"cveId": "CVE-2026-39373", "state": "PUBLISHED", "dateUpdated": "2026-04-07T20:22:57.790Z", "dateReserved": "2026-04-06T21:29:17.350Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-07T19:35:36.071Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "jwcrypto", "vendor": "latchset", "versions": [{"status": "affected", "version": "< 1.5.7"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:latchset:jwcrypto:*:*:*:*:*:*:*:*", "matchCriteriaId": "95859984-CAD0-47DF-AA9E-C0685F460729", "versionEndExcluding": "1.5.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to 1.5.7, an unauthenticated attacker can exhaust server memory by sending crafted JWE tokens with ZIP compression. The existing patch for CVE-2024-28102 limits input token size to 250KB but does not validate the decompressed output size. An unauthenticated attacker can cause memory exhaustion on memory-constrained systems. A token under the 250KB input limit can decompress to approximately 100MB. This vulnerability is fixed in 1.5.7."}, {"lang": "es", "value": "JWCrypto implementa las especificaciones JWK, JWS y JWE utilizando python-cryptography. Antes de la 1.5.7, un atacante no autenticado puede agotar la memoria del servidor enviando tokens JWE manipulados con compresi\u00f3n ZIP. El parche existente para CVE-2024-28102 limita el tama\u00f1o del token de entrada a 250KB, pero no valida el tama\u00f1o de la salida descomprimida. Un atacante no autenticado puede causar el agotamiento de la memoria en sistemas con recursos de memoria limitados. Un token por debajo del l\u00edmite de entrada de 250KB puede descomprimirse a aproximadamente 100MB. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 1.5.7."}], "id": "CVE-2026-39373", "lastModified": "2026-07-24T21:10:00.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39373", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-07T20:22:50.934916Z", "version": "2.0.3"}}]}, "published": "2026-04-07T20:16:32.133", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/latchset/jwcrypto/security/advisories/GHSA-fjrm-76x2-c4q4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-409"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "JWCrypto: python-cryptography: python: JWCrypto: Memory exhaustion via crafted compressed JWE tokens", "id": "2456187", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456187"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["A flaw was found in JWCrypto, a Python library for JSON Web Key (JWK), JSON Web Signature (JWS), and JSON Web Encryption (JWE) specifications. An unauthenticated attacker can exploit this vulnerability by sending specially crafted JWE tokens that use ZIP compression. While the input token size is limited, the decompressed output size is not validated, allowing an attacker to cause excessive memory consumption. This can lead to memory exhaustion on affected systems, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-39373", "package_state": [{"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-24/lightspeed-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-25/lightspeed-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-26/controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-26/gateway-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-26/lightspeed-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "automation-controller", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "python3.11-jwcrypto", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "python3.12-jwcrypto", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "python-jwcrypto", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "python-jwcrypto", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "idm:client/python-jwcrypto", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "idm:DL1/python-jwcrypto", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "python-jwcrypto", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-07T19:35:36Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-39373\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-39373\nhttps://github.com/latchset/jwcrypto/security/advisories/GHSA-fjrm-76x2-c4q4"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.5.7)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "jwcrypto", "source": "cna", "vendor": "latchset"}, "product": "jwcrypto", "vendor": "latchset"}], "analysis": {"en": {"generated_at": "2026-04-08T02:25:35.134565+00:00", "value": {"mitigation_remediation": ["Upgrade latchset:jwcrypto to version\u202f1.5.7 or newer, which enforces a decompressed output size limit."], "summary": {"action": "Immediate Patch", "impact": "Denial of Service via Memory Exhaustion"}, "threat_synthesis": {"affected_systems": "Any installation of latchset:jwcrypto before version\u202f1.5.7 is affected. Systems that incorporate this library to handle JWTs\u2014such as web services or authentication back\u2011ends\u2014may be exposed if the library remains outdated.", "description_and_impact": "JWCrypto is a Python library implementing JSON Web Key, Signature, and Encryption. A flaw allows an unauthenticated attacker to send a crafted JWE token that is limited to 250\u202fKB on input but can decompress to about 100\u202fMB. When processed by the library, the large decompressed payload consumes server memory and can cause the process to crash or become unresponsive. This type of attack is a decompression bomb scenario, and the vulnerability is classified as CWE\u2011409 and CWE\u2011770.", "risk_and_exploitability": "The CVSS score of 5.3 indicates medium severity. An EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only that an attacker transmit a compliant JWE token to the vulnerable system; the attack is unauthenticated and can occur over any channel that delivers the token. On memory\u2011constrained servers, the resulting exhaustion can cause a denial\u2011of\u2011service condition. The likely attack vector is inferred to be any input pathway that allows the attacker to supply a large compressed JWE. "}}}}, "created": "2026-04-08T19:34:39.879903+00:00", "updated": "2026-04-08T19:46:13.974148+00:00", "vendors": ["latchset", "latchset$PRODUCT$jwcrypto"]}