The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time. Version 1.5.6 fixes this vulnerability by limiting the maximum token length.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-jwcrypto | May 8, 2024 | Mar 21, 2024 |
| Amazon Linux Ami 2 | — | Upgrade python-jwcrypto | Feb 26, 2025 | Mar 21, 2024 |
| Debian | — | Upgrade python-jwcrypto | Jul 30, 2024 | Mar 21, 2024 |
| Oracle_linux | — | Upgrade softhsmUpgrade python3-kdcproxyUpgrade opendnssecUpgrade python3-qrcodeUpgrade ipa-healthcheck-coreUpgrade ipa-server-dnsUpgrade python3-ipaclientUpgrade python3-custodiaUpgrade ipa-client-commonUpgrade python3-qrcode-coreUpgrade ipa-client-epnUpgrade python3-pyusbUpgrade ipa-server-commonUpgrade ipa-python-compatUpgrade bind-dyndb-ldapUpgrade python3-ipalibUpgrade ipa-commonUpgrade ipa-server-trust-adUpgrade python3-jwcryptoUpgrade ipa-healthcheckUpgrade slapi-nisUpgrade python3-ipatestsUpgrade ipa-clientUpgrade ipa-serverUpgrade custodiaUpgrade python3-yubicoUpgrade softhsm-develUpgrade python3-ipaserverUpgrade ipa-client-sambaUpgrade ipa-selinux | May 7, 2024 | Mar 8, 2024 |
| Redhat_linux | — | Upgrade python3-jwcryptoNo solution exists | May 1, 2024 | Mar 21, 2024 |
| Rocky_linux | — | Upgrade softhsmUpgrade ipa-debugsourceUpgrade ipa-client-debuginfoUpgrade opendnssec-debuginfoUpgrade softhsm-develUpgrade slapi-nisUpgrade opendnssec-debugsourceUpgrade ipa-server-trust-adUpgrade softhsm-debugsourceUpgrade ipa-serverUpgrade ipa-server-debuginfoUpgrade ipa-debuginfoUpgrade ipa-server-trust-ad-debuginfoUpgrade opendnssecUpgrade ipa-client-sambaUpgrade ipa-client-epnUpgrade slapi-nis-debuginfoUpgrade ipa-clientUpgrade slapi-nis-debugsourceUpgrade bind-dyndb-ldap-debuginfoUpgrade bind-dyndb-ldap-debugsourceUpgrade softhsm-debuginfoUpgrade bind-dyndb-ldap | May 13, 2024 | Mar 21, 2024 |
| Suse | — | Upgrade python313-jwcrypto | Dec 5, 2025 | Dec 5, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub