CVE-2024-33664
MEDIUMpython-jose < 3.3.0 - Denial of Service via JWE Token Decompression
Title source: llmDescription
python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryption (JWE) token with a high compression ratio, aka a "JWT bomb." This is similar to CVE-2024-21319.
References (3)
Core 3
Core References
Exploit, Issue Tracking, Mitigation, Vendor Advisory
https://github.com/mpdavis/python-jose/issues/344
Issue Tracking, Patch
https://github.com/mpdavis/python-jose/pull/345
Exploit, Mitigation, Third Party Advisory
https://www.vicarius.io/vsociety/posts/jwt-bomb-in-python-jose-cve-2024-33664
Scores
CVSS v3
5.3
EPSS
0.0025
EPSS Percentile
48.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-400
Status
published
Products (2)
pypi/python-jose
0 - 3.4.0PyPI
python-jose_project/python-jose
< 3.3.0
Published
Apr 26, 2024
Tracked Since
Feb 18, 2026