CVE-2026-80179
Fixed in a distro release EPSS <1%CVSS 5.9
A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This malformed token can force the JWE.deserialize() function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of service (DoS) for services that process untrusted JWE values.
Products: Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift AI (RHOAI), Red Hat OpenStack Platform 16.2
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | python-jwcrypto | no fix |
| Debian 13 | python-jwcrypto | no fix |
| Debian 14 | python-jwcrypto | no fix |
| SUSE Linux Enterprise Server 16.0 | python-jwcrypto | 1.5.6-160000.4.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | python-jwcrypto | 1.5.6-160000.4.1 |
| Ubuntu 16.04 LTS | python-jwcrypto | no fix |
| Ubuntu 18.04 LTS | python-jwcrypto | no fix |
| Ubuntu 20.04 LTS | python-jwcrypto | no fix |
| Ubuntu 22.04 LTS | python-jwcrypto | no fix |
| Ubuntu 24.04 LTS | python-jwcrypto | no fix |
| Ubuntu 26.04 LTS | python-jwcrypto | no fix |
| Ubuntu 26.10 | python-jwcrypto | no fix |
| openSUSE Leap 16.0 | python-jwcrypto | 1.5.6-160000.4.1 |
| openSUSE Tumbleweed | python-jwcrypto | 1.6.0-1.1 |