Bug 2456187 (CVE-2026-39373) - CVE-2026-39373 JWCrypto: python-cryptography: python: JWCrypto: Memory exhaustion via crafted compressed JWE tokens
Summary: CVE-2026-39373 JWCrypto: python-cryptography: python: JWCrypto: Memory exhaus...
Keywords:
Status: NEW
Alias: CVE-2026-39373
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2456512
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-04-07 20:03 UTC by OSIDB Bzimport
Modified: 2026-05-19 18:00 UTC (History)
16 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:13508 0 None None None 2026-05-04 13:59:03 UTC
Red Hat Product Errata RHSA-2026:13512 0 None None None 2026-05-04 14:16:02 UTC
Red Hat Product Errata RHSA-2026:19042 0 None None None 2026-05-19 13:05:58 UTC
Red Hat Product Errata RHSA-2026:19197 0 None None None 2026-05-19 18:00:52 UTC

Description OSIDB Bzimport 2026-04-07 20:03:04 UTC
JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to 1.5.7, an unauthenticated attacker can exhaust server memory by sending crafted JWE tokens with ZIP compression. The existing patch for CVE-2024-28102  limits input token size to 250KB but does not validate the decompressed output size. An unauthenticated attacker can cause memory exhaustion on memory-constrained systems. A token under the 250KB input limit can decompress to approximately 100MB. This vulnerability is fixed in 1.5.7.

Comment 2 Simo Sorce 2026-04-08 15:27:44 UTC
The severity of this bug is wrong, it should be low.

No attacker can cause unlimited memory exhaustion, the bug only highlighted that the amount of memory used culd not be finely controlled, but the previous fix did absolutely allow to limit memory use. This is a very low priority issue.

Comment 3 errata-xmlrpc 2026-05-04 13:59:01 UTC
This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.6 for RHEL 10
  Red Hat Ansible Automation Platform 2.6 for RHEL 9

Via RHSA-2026:13508 https://access.redhat.com/errata/RHSA-2026:13508

Comment 4 errata-xmlrpc 2026-05-04 14:15:59 UTC
This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.5 for RHEL 9
  Red Hat Ansible Automation Platform 2.5 for RHEL 8

Via RHSA-2026:13512 https://access.redhat.com/errata/RHSA-2026:13512

Comment 5 errata-xmlrpc 2026-05-19 13:05:56 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:19042 https://access.redhat.com/errata/RHSA-2026:19042

Comment 6 errata-xmlrpc 2026-05-19 18:00:50 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:19197 https://access.redhat.com/errata/RHSA-2026:19197


Note You need to log in before you can comment on or make changes to this bug.