# CVE-2026-80179: jwcrypto denial of service via malformed JWE tokens

Source: https://junglewise.ai/threats/cve-2026-80179-jwcrypto-denial-of-service-via-malformed-jwe-tokens  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-80179 · Severity: medium · CVSS 5.9 · Published 2026-08-28

jwcrypto is a cryptographic library used to validate and process JSON Web Encryption (JWE) tokens, which are commonly used for secure data transmission in enterprise applications and APIs. An attacker can send a specially crafted JWE token that forces the library to consume excessive memory, causing the service to crash or become unresponsive. This denial-of-service attack targets any system that processes untrusted JWE tokens without rate limiting or resource controls.

## Quick answers

**Is CVE-2026-80179 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-80179 being exploited in the wild.

**How severe is CVE-2026-80179?** Medium severity, with a CVSS score of 5.9, published 28 August 2026.

**Which products and versions are affected?** jwcrypto project jwcrypto <UNKNOWN>.

**Is there a fix for CVE-2026-80179?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-80179 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-80179?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the JWE.deserialize() function of jwcrypto, which fails to properly limit resource allocation when parsing malformed JWE tokens containing numerous period delimiters. An attacker can craft a specially crafted token that triggers excessive memory allocation, leading to a MemoryError and denial of service. The attack is network-accessible and requires no authentication or user interaction, but has high attack complexity due to the specific token format required. Services that process untrusted JWE values are vulnerable, and no mitigation is currently available per Red Hat's assessment.

## Affected products

- jwcrypto project jwcrypto <UNKNOWN>

## Timeline

- 2026-08-28: disclosed
- 2026-08-28: advisory: CVE-2026-80179 published

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-80179](https://access.redhat.com/security/cve/CVE-2026-80179)