The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time. Version 1.5.6 fixes this vulnerability by limiting the maximum token length.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-jwcrypto | May 8, 2024 | Mar 21, 2024 |
| Amazon Linux Ami 2 | — | Upgrade python-jwcrypto | Feb 26, 2025 | Mar 21, 2024 |
| Debian | — | Upgrade python-jwcrypto | Jul 30, 2024 | Mar 21, 2024 |
| Oracle_linux | — | Upgrade python3-qrcode-coreUpgrade python3-custodiaUpgrade ipa-client-commonUpgrade ipa-server-commonUpgrade softhsmUpgrade bind-dyndb-ldapUpgrade python3-qrcodeUpgrade ipa-server-dnsUpgrade ipa-python-compatUpgrade opendnssecUpgrade python3-kdcproxyUpgrade python3-ipaclientUpgrade python3-pyusbUpgrade ipa-healthcheck-coreUpgrade ipa-client-epnUpgrade ipa-commonUpgrade python3-jwcryptoUpgrade python3-ipatestsUpgrade ipa-healthcheckUpgrade slapi-nisUpgrade ipa-selinuxUpgrade ipa-client-sambaUpgrade softhsm-develUpgrade python3-ipaserverUpgrade custodiaUpgrade python3-yubicoUpgrade python3-ipalibUpgrade ipa-serverUpgrade ipa-server-trust-adUpgrade ipa-client | May 7, 2024 | Mar 8, 2024 |
| Redhat_linux | — | No solution existsUpgrade python3-jwcrypto | May 1, 2024 | Mar 21, 2024 |
| Rocky_linux | — | Upgrade ipa-debugsourceUpgrade softhsmUpgrade opendnssecUpgrade ipa-debuginfoUpgrade ipa-server-debuginfoUpgrade ipa-server-trust-ad-debuginfoUpgrade opendnssec-debuginfoUpgrade ipa-client-debuginfoUpgrade softhsm-debugsourceUpgrade ipa-server-trust-adUpgrade softhsm-develUpgrade opendnssec-debugsourceUpgrade slapi-nisUpgrade ipa-serverUpgrade slapi-nis-debuginfoUpgrade ipa-clientUpgrade slapi-nis-debugsourceUpgrade ipa-client-epnUpgrade bind-dyndb-ldap-debuginfoUpgrade ipa-client-sambaUpgrade bind-dyndb-ldapUpgrade softhsm-debuginfoUpgrade bind-dyndb-ldap-debugsource | May 13, 2024 | Mar 21, 2024 |
| Suse | — | Upgrade python313-jwcrypto | Dec 5, 2025 | Dec 5, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub