Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

jwcrypto

4 known vulnerabilities (3 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 3 medium
Registry
PyPI

Advisories 4

  • CVE-2026-39373Medium 5.3

    JWCrypto: JWE ZIP decompression bomb

    Affected: fixed in 1.5.7.

  • CVE-2024-28102Medium 6.8

    JWCrypto vulnerable to JWT bomb Attack in `deserialize` function

    Affected: fixed in 1.5.6.

  • CVE-2023-6681Medium 5.3

    Jwcrypto: denail of service via specifically crafted jwe

    Affected: fixed in 1.5.1.

  • The _Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before 0.3.2 lacks the Random Filling protection mechanism…

    Affected: fixed in 0.3.2; fixed in 0.4.0.