Python Jose

python-jose

CVEs (4)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2024-29370 1Python Jose Project 1Python Jose Jun 17, 2026 Dec 17, 2025 N/A· v4 5.3 MEDIUM· v3 N/A· v2 In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compress...Show more In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.Show less
CVE-2024-33664 1Python Jose Project 1Python Jose Jun 17, 2026 Apr 26, 2024 N/A· v4 5.3 MEDIUM· v3 N/A· v2 python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryption (JWE) token with a high compression ratio, aka a "JWT bomb." This is simila...Show more python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryption (JWE) token with a high compression ratio, aka a "JWT bomb." This is similar to CVE-2024-21319.Show less
CVE-2024-33663 1Python Jose Project 1Python Jose Jun 17, 2026 Apr 26, 2024 N/A· v4 6.5 MEDIUM· v3 N/A· v2 python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.
CVE-2016-7036 1Python Jose Project 1Python Jose May 13, 2026 Jan 23, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 python-jose before 1.3.2 allows attackers to have unspecified impact by leveraging failure to use a constant time comparison for HMAC keys.