CVE-2026-80179

Awaiting Analysis Awaiting Analysis - Queue

Memory Error DoS in jwcrypto via JWE Token

Publication date: 2026-08-28

Last updated on: 2026-08-31

Assigner: redhat-SADP

Description

A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This malformed token can force the JWE.deserialize() function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of service (DoS) for services that process untrusted JWE values.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-31

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-80179

Affected Vendors & Products

Vendor	Product	Version / Range
latchset	jwcrypto	to 1.5.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability is in the jwcrypto library where a remote attacker sends a malformed JSON Web Encryption token with excessive period delimiters. The JWE.deserialize() function splits the token on every period before validating it, causing excessive memory allocation and a MemoryError. This leads to a denial-of-service condition for services processing untrusted JWE values.

Detection Guidance

To detect this vulnerability, monitor for excessive memory usage or crashes in services processing JWE tokens. Check logs for malformed tokens with numerous periods. Use network monitoring tools to inspect incoming traffic for unusually large JWE tokens containing many period delimiters.

Impact Analysis

The impact is primarily service disruption. Attackers can degrade or completely halt service availability by causing excessive memory consumption in systems that parse untrusted JWE tokens. There is no evidence of confidentiality or integrity compromise.

Compliance Impact

This vulnerability primarily impacts service availability by causing a denial of service through excessive memory consumption. It does not directly affect confidentiality or integrity of data. Compliance with standards like GDPR or HIPAA may be indirectly impacted if the DoS disrupts systems handling personal or health data, potentially leading to availability failures during critical operations.

Mitigation Strategies

Immediately update jwcrypto to version 1.5.9 or later. If updating is not possible, restrict access to services handling untrusted JWE tokens or implement rate limiting to prevent excessive requests. Monitor for DoS attempts and block malicious IPs.

Hi! I’m here to help you understand CVE-2026-80179. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70