CVE-2024-29370
published 2025-12-17CVE-2024-29370: In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON…
PriorityP427medium5.3CVSS 3.1
AVNACLPRNUINSUCNINAL
EPSS
0.17%
6.5th percentile
In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | python-jose | — | — |
| python-jose_project | python-jose | — | — |
| python-jose_project | python-jose | >= 0 < 3.4.0 | 3.4.0 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
osv5.3MEDIUM
vendor_debian5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Duplicate Advisory: python-jose denial of service via compressed JWE content
ghsa·2025-12-17
CVE-2024-29370 [MEDIUM] CWE-409 Duplicate Advisory: python-jose denial of service via compressed JWE content
Duplicate Advisory: python-jose denial of service via compressed JWE content
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-cjwg-qfpm-7377. This link is maintained to preserve external references.
### Original Description
In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.
OSV
CVE-2024-29370: In python-jose 3
osv·2025-12-17·CVSS 5.3
CVE-2024-29370 [MEDIUM] CVE-2024-29370: In python-jose 3
In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.
Red Hat
python-jose: python-jose: Denial-of-Service via malicious JSON Web Encryption (JWE) token decompression
vendor_redhat·2025-12-17·CVSS 5.3
CVE-2024-29370 [MEDIUM] CWE-409 python-jose: python-jose: Denial-of-Service via malicious JSON Web Encryption (JWE) token decompression
python-jose: python-jose: Denial-of-Service via malicious JSON Web Encryption (JWE) token decompression
In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.
A flaw was found in python-jose. This vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio, leading to significant memory allocation and processing time during decompression.
Statement: This vulnerability i
Debian
CVE-2024-29370: python-jose - In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attac...
vendor_debian·2024·CVSS 5.3
CVE-2024-29370 [MEDIUM] CVE-2024-29370: python-jose - In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attac...
In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.
Scope: local
bookworm: open
No detection rules found.
No public exploits indexed.
2025-12-17
Published