Is CVE-2024-29370 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-29370 being exploited in the wild.

How severe is CVE-2024-29370?

Medium severity, with a CVSS score of 5.3, published 17 December 2025.

Which products and versions are affected?

Mpdavis Jose < 3.4.0; python-jose (PyPI) ECOSYSTEM:introduced=0,fixed=3.4.0, ECOSYSTEM:introduced=0,last_affected=3.3.0.

Is there a fix for CVE-2024-29370?

Yes. python-jose (PyPI): upgrade to 3.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-29370 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-29370?

Check whether you run Mpdavis Jose, python-jose (PyPI) or Python-Jose Project Python-Jose at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-29370: python-jose denial of service via compressed JWE content

Q: Which products and versions are affected?

Mpdavis Jose < 3.4.0; python-jose (PyPI) ECOSYSTEM:introduced=0,fixed=3.4.0, ECOSYSTEM:introduced=0,last_affected=3.3.0.

Q: Is there a fix for CVE-2024-29370?

Yes. python-jose (PyPI): upgrade to 3.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2024-29370 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2024-29370?

Check whether you run Mpdavis Jose, python-jose (PyPI) or Python-Jose Project Python-Jose at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-29370 · Severity: medium · CVSS 5.3 · Published 2025-12-17

A vulnerability in the python-jose library, which is used to handle secure web tokens, could allow an attacker to crash or slow down a server. By sending a specially crafted, highly compressed token, an attacker can force the server to consume excessive memory and processing power during decompression. This can lead to a denial-of-service (DoS) condition, making the application unavailable to legitimate users.

Technologies: Mpdavis Jose, python-jose (PyPI), Python-Jose Project Python-Jose. Vendors: Mpdavis, PyPI, Python-Jose Project.

Quick answers

Is CVE-2024-29370 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-29370 being exploited in the wild.
How severe is CVE-2024-29370?: Medium severity, with a CVSS score of 5.3, published 17 December 2025.
Which products and versions are affected?: Mpdavis Jose < 3.4.0; python-jose (PyPI) ECOSYSTEM:introduced=0,fixed=3.4.0, ECOSYSTEM:introduced=0,last_affected=3.3.0.
Is there a fix for CVE-2024-29370?: Yes. python-jose (PyPI): upgrade to 3.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-29370 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-29370?: Check whether you run Mpdavis Jose, python-jose (PyPI) or Python-Jose Project Python-Jose at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

python-jose (PyPI): upgrade to 3.4.0 or later
```
pip install "python-jose>=3.4.0"
```

Technical details

A denial-of-service (DoS) vulnerability exists in python-jose versions prior to 3.4.0 due to improper handling of highly compressed data (CWE-409). The `jwe.decrypt` function does not sufficiently limit the resources used when decompressing JSON Web Encryption (JWE) tokens. An unauthenticated remote attacker can exploit this by submitting a malicious JWE token with a high compression ratio, leading to significant memory allocation and CPU usage (a 'decompression bomb'). This was addressed in version 3.4.0 by implementing a 250 KB size limit on JWE tokens.

Affected products

mpdavis python-jose < 3.4.0

Identifiers

CVE-2024-29370
GHSA-h4pw-wxh7-4vjj
PYSEC-2025-185

Timeline

2024-03-18: disclosed: Initial issue reported on GitHub
2025-12-17: advisory: GitHub and NVD advisories published
2024-02-14: patched: Version 3.4.0 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.