Executive brief
JWCrypto vulnerable to JWT bomb Attack in `deserialize` function
Affected products
- PyPI jwcrypto
Junglewise Threat Intelligence
CVE-2024-28102: PYSEC-2026-1484 - JWCrypto vulnerable to JWT bomb Attack in `deserialize` function
CVE-2024-28102 · Severity: low · CVSS 3.1 · Published 2026-07-07
Technologies: jwcrypto (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-827 - jwcrypto token substitution can lead to authentication bypass
- Latchset JWCrypto denial of service via memory exhaustion in JWE decompression
- PYSEC-2024-104 - A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a denial of service (DoS) attack and possible password brute-fo
- PYSEC-2016-4 - The _Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before 0.3.2 lacks the Random Filling protection mechanism, w