CVE-2024-29370

In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.

CVSS 3.1

5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS

0.2% chance of exploitation in the next 30 days; higher than 8% of CVEs (scores of 2026-10-27)

CWE

CWE-409

Published

2025-12-17

Modified

2026-10-27

Record from

the NVD, synced 2026-10-27

Affected

• python-jose_project:python-jose

Packages (OSV)

References

• https://github.com/mpdavis/python-jose/issues/344

Check your stackJSON