Executive brief
jwcrypto is a cryptographic library used to validate and process JSON Web Encryption (JWE) tokens, which are commonly used for secure data transmission in enterprise applications and APIs. An attacker can send a specially crafted JWE token that forces the library to consume excessive memory, causing the service to crash or become unresponsive. This denial-of-service attack targets any system that processes untrusted JWE tokens without rate limiting or resource controls.
Technical details
The vulnerability exists in the JWE.deserialize() function of jwcrypto, which fails to properly limit resource allocation when parsing malformed JWE tokens containing numerous period delimiters. An attacker can craft a specially crafted token that triggers excessive memory allocation, leading to a MemoryError and denial of service. The attack is network-accessible and requires no authentication or user interaction, but has high attack complexity due to the specific token format required. Services that process untrusted JWE values are vulnerable, and no mitigation is currently available per Red Hat's assessment.
Affected products
- jwcrypto project jwcrypto <UNKNOWN>
Timeline
- 2026-08-28: disclosed
- 2026-08-28: advisory: CVE-2026-80179 published