PT-2026-31004 · Jwcrypto+1 · Jwcrypto+1

Hkmj19 · Published 2026-04-07 · Updated 2026-05-19 · CVE-2026-39373

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions JWCrypto versions prior to 1.5.7

Description A crafted JWE token with ZIP compression can exhaust server memory. The existing patch limits input token size to 250KB but does not validate the decompressed output size. A token under the 250KB input limit can decompress to approximately 100MB, potentially causing memory exhaustion on memory-constrained systems.

Recommendations Update to version 1.5.7 or later.

Fix

DoS

Weakness Enumeration

CWE-409

Related Identifiers

ALSA-2026:19042

ALSA-2026:19197

BDU:2026-07340

CVE-2026-39373

GHSA-FJRM-76X2-C4Q4

OESA-2026-1923

OESA-2026-1924

OESA-2026-1925

OESA-2026-1926

OPENSUSE-SU-2026:10576-1

PYSEC-2026-70

RHSA-2026:13508

RHSA-2026:13512

RHSA-2026:19042

RHSA-2026:19197

Affected Products

Jwcrypto

Red Os

References · 35

• https://github.com/latchset/jwcrypto/security/advisories/GHSA-fjrm-76x2-c4q4 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-39373 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39373 · Security Note
• https://osv.dev/vulnerability/OESA-2026-1925 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-39373 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07340 · Security Note
• https://errata.almalinux.org/10/ALSA-2026-19042.html · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1924 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1926 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:19042 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-39373 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-39373 · Security Note
• https://osv.dev/vulnerability/OESA-2026-1923 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-70 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:19197 · Vendor Advisory