Listen to this Post
How the mentioned CVE works:
The vulnerability resides in the `jwe.decrypt` function of python-jose version 3.3.0. It involves the processing of JSON Web Encryption (JWE) tokens. JWE supports optional compression of its plaintext payload before encryption. An attacker can craft a malicious JWE token with a small, highly compressed payload that, when decrypted and decompressed by the server, expands to an enormous size (e.g., billions of bytes). The `jwe.decrypt` function does not implement proper checks on the compression ratio or the resulting decompressed data size. Consequently, when the server processes this token, it attempts to allocate a massive amount of memory for the decompressed output. This excessive memory allocation and the associated CPU time for decompression lead to a Denial-of-Service condition, exhausting server resources and making it unavailable for legitimate requests.
Platform: Python-jose library
Version: 3.3.0
Vulnerability: DoS via compression
Severity: Medium
Date: December 2025
Prediction: 2025-12-22
What Undercode Say:
Analytics:
`pip show python-jose`
`grep -r “jwe.decrypt” /path/to/code`
`python -c “import jose; print(jose.__version__)”`
How Exploit:
Craft malicious JWE.
Send to decrypt endpoint.
Trigger massive decompression.
Exhaust server memory.
Protection from this CVE:
Update python-jose library.
Implement size limits.
Validate compression ratio.
Monitor resource usage.
Impact:
Service unavailability.
Resource exhaustion.
Application instability.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
