CVE-2024-29370

In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/mpdavis/python-jose/issues/344	Exploit Issue Tracking Patch

Configurations

Configuration 1 (hide)

cpe:2.3:a:python-jose_project:python-jose:3.3.0:*:*:*:*:*:*:*

History

27 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) En python-jose 3.3.0 (específicamente jwe.decrypt), una vulnerabilidad permite a un atacante causar una condición de Denegación de Servicio (DoS) al crear un token de Cifrado Web JSON (JWE) malicioso con una relación de compresión excepcionalmente alta. Cuando este token es procesado por el servidor, resulta en una asignación de memoria y un tiempo de procesamiento significativos durante la descompresión.

Information

Published : 2025-12-17 16:16

Updated : 2026-10-27 18:10

NVD link : CVE-2024-29370

Mitre link : CVE-2024-29370

CVE.ORG link : CVE-2024-29370

JSON object : View

Products Affected

python-jose_project

python-jose

CWE

CWE-409

Improper Handling of Highly Compressed Data (Data Amplification)

{"id": "CVE-2024-29370", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-29370", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-17T16:07:11.042805Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-12-17T16:16:04.457", "references": [{"url": "https://github.com/mpdavis/python-jose/issues/344", "tags": ["Exploit", "Issue Tracking", "Patch"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-409"}]}], "descriptions": [{"lang": "en", "value": "In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression."}, {"lang": "es", "value": "En python-jose 3.3.0 (espec\u00edficamente jwe.decrypt), una vulnerabilidad permite a un atacante causar una condici\u00f3n de Denegaci\u00f3n de Servicio (DoS) al crear un token de Cifrado Web JSON (JWE) malicioso con una relaci\u00f3n de compresi\u00f3n excepcionalmente alta. Cuando este token es procesado por el servidor, resulta en una asignaci\u00f3n de memoria y un tiempo de procesamiento significativos durante la descompresi\u00f3n."}], "lastModified": "2026-10-27T18:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:python-jose_project:python-jose:3.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "89A29F0D-0CC6-4177-8E90-B192A39EB233"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}