CVE-2026-39373— JWCrypto: JWE ZIP decompression bomb
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-39373
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
JWCrypto: JWE ZIP decompression bomb
Source: NVD (National Vulnerability Database)
Vulnerability Description
JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to 1.5.7, an unauthenticated attacker can exhaust server memory by sending crafted JWE tokens with ZIP compression. The existing patch for CVE-2024-28102 limits input token size to 250KB but does not validate the decompressed output size. An unauthenticated attacker can cause memory exhaustion on memory-constrained systems. A token under the 250KB input limit can decompress to approximately 100MB. This vulnerability is fixed in 1.5.7.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
对高度压缩数据的处理不恰当(数据放大攻击)
Source: NVD (National Vulnerability Database)
Vulnerability Title
JWCrypto 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
JWCrypto是JWCrypto开源的一个 Javascript 对象签名和加密 (JOSE) Web 标准的实现。 JWCrypto 1.5.7之前版本存在安全漏洞，该漏洞源于对解压缩输出大小验证不足，可能导致未经身份验证的攻击者耗尽服务器内存。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-39373
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-39373
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same vendor: latchset
Same weakness: CWE-409
- CVE-2026-27460
Tandoor Recipes Affected by Denial of Service via Recipe Imp - CVE-2026-40148
PraisonAI Affected by Decompression Bomb DoS via Recipe Bund - CVE-2026-3114
Zip Bomb Denial of Service via Unrestricted Archive Decompre - CVE-2026-32044
OpenClaw < 2026.3.2 - Tar Archive Safety Bypass in Skills In - CVE-2026-2575
Keycloak: keycloak: denial of service due to excessive samlr
V. Comments for CVE-2026-39373
No comments yet