The compact JWE fallback in JWE.deserialize() splits attacker-controlled token text on every period delimiter before checking that the compact serialization has the required five segments. A malformed token containing millions of periods can therefore force a large delimiter-derived list allocation and raise MemoryError before jwcrypto reaches its normal malformed-token rejection, which can degrade availability for services that parse untrusted JWE values.