Quick answers
- Is CVE-2026-39373 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-39373 being exploited in the wild.
- How severe is CVE-2026-39373?
- Medium severity, with a CVSS score of 5.3, published 7 April 2026.
- Which products and versions are affected?
- jwcrypto (PyPI) <= 1.5.6, ECOSYSTEM:introduced=0,fixed=1.5.7.
- Is there a fix for CVE-2026-39373?
- Yes. jwcrypto (PyPI): upgrade to 1.5.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-39373 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-39373?
- Check whether you run jwcrypto (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- jwcrypto (PyPI): upgrade to 1.5.7 or later
pip install "jwcrypto>=1.5.7"
Technical details
JWCrypto prior to version 1.5.7 is vulnerable to a data amplification (ZIP bomb) attack in its JWE decryption/decompression logic. While a previous fix (CVE-2024-28102) limited the input token size to 250KB, the library still fails to validate the size of the output after decompression. An unauthenticated remote attacker can provide a crafted JWE token with the 'zip' header set to 'DEF' that remains under the input limit but expands to approximately 100MB in memory. This can lead to denial-of-service via memory exhaustion, particularly on memory-constrained systems. The issue is rooted in the use of zlib.decompress without an explicit limit on the resulting plaintext size. This is fixed in version 1.5.7.
Affected products
- latchset jwcrypto < 1.5.7
Identifiers
- CVE-2026-39373
- GHSA-fjrm-76x2-c4q4
- PYSEC-2026-70
Timeline
- 2026-04-07: disclosed
- 2026-04-07: advisory
- 1.5.7: patched