CVE-2024-29370
Unknown Unknown - Not Provided
Denial-of-Service in python-jose jwe.decrypt via Malicious JWE Token

Publication date: 2025-12-17

Last updated on: 2025-12-17

Assigner: MITRE

Description
In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-17
Last Modified
2025-12-17
Generated
2026-06-16
AI Q&A
2025-12-17
EPSS Evaluated
2026-06-15
NVD
CVE-2024-29370
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
mpdavis python-jose 3.3.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-409 The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in python-jose 3.3.0 occurs in the jwe.decrypt function when processing JSON Web Encryption (JWE) tokens. An attacker can craft a malicious JWE token with an extremely high compression ratio using the DEF compression algorithm. When the server decompresses this token, it consumes excessive memory and processing time, causing a Denial-of-Service (DoS) condition. [1]

Impact Analysis

The vulnerability can cause your server to experience a Denial-of-Service (DoS) condition by forcing it to allocate excessive memory and spend a long time decompressing a maliciously crafted JWE token. This can degrade service availability and potentially disrupt normal operations. [1]

Detection Guidance

This vulnerability can be detected by monitoring for unusually high processing times or memory usage during the decryption of JSON Web Encryption (JWE) tokens, especially those using the DEF (DEFLATE) compression algorithm. A practical approach is to create a test script that attempts to decrypt JWE tokens with high compression ratios and measure the time taken. For example, using python-jose 3.3.0, you can craft a large JSON payload with repeated characters, encrypt it with compression enabled (zip='DEF'), and measure the decryption time to observe the vulnerability. Specific commands would involve running such a test script in your environment to detect abnormal resource consumption during token processing. [1]

Mitigation Strategies

To mitigate this vulnerability immediately, it is recommended to impose a maximum token length limit of 250 KB before processing any JWE tokens. This prevents attackers from exploiting the decompression overhead by restricting the size of tokens accepted. This mitigation aligns with practices used in other JWT libraries and helps avoid excessive memory allocation and processing time during decompression. [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2024-29370. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart