CVE-2026-80179CWE-770denial-of-service

CVE-2026-80179

Medium · published August 28, 2026

CVSS v3.1

5.9

EPSS

Percentile

33.8

In the wild

Unconfirmed

What it is

A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This malformed token can force the JWE.deserialize() function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of service (DoS) for services that process untrusted JWE values.

The record

Technical detail

CVSS v3.1: 5.9 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0: Not supplied
EPSS: 0.00407 · 33.8th percentile
Weakness: CWE-770 · Allocation of Resources Without Limits or Throttling
Published: 2026-08-28T04:18Z

References (4)

https://access.redhat.com/security/cve/CVE-2026-80179 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2524147 · [email protected]https://github.com/latchset/jwcrypto/security/advisories/GHSA-96rv-c4vc-h4f4 · [email protected]https://github.com/latchset/jwcrypto/security/advisories/GHSA-96rv-c4vc-h4f4 · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

27 AUG 21:14Z
Jwcrypto: jwcrypto: denial of service via malformed jwe tokens
cvelistv5