PT-2025-55355 · Pypi · Python-Jose

Published 2025-12-17 · Updated 2025-12-17

OSV

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-cjwg-qfpm-7377. This link is maintained to preserve external references.

Original Description

In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.

Fix

Weakness Enumeration

CWE-409

Related Identifiers

GHSA-H4PW-WXH7-4VJJ

Affected Products

Python-Jose

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-29370 · Security Note
• https://osv.dev/vulnerability/GHSA-h4pw-wxh7-4vjj · Vendor Advisory
• https://github.com/mpdavis/python-jose/commit/483529ee93a3ab510ab579d4d4cc644dba926ade · Note
• https://github.com/mpdavis/python-jose/issues/344 · Note
• https://github.com/mpdavis/python-jose/releases/tag/3.4.0 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/python-jose/PYSEC-2025-185.yaml · Note