CVE-2024-33664

Description

python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryption (JWE) token with a high compression ratio, aka a "JWT bomb." This is similar to CVE-2024-21319.

Reserved 2024-04-25 | Published 2024-04-25 | Updated 2024-09-05 | Assigner mitre

References

github.com/mpdavis/python-jose/issues/344

github.com/mpdavis/python-jose/pull/345

www.vicarius.io/...ts/jwt-bomb-in-python-jose-cve-2024-33664

cve.org (CVE-2024-33664)

nvd.nist.gov (CVE-2024-33664)

Download JSON