CVE-2026-80179 in Jwcrypto
Summary
by MITRE • 08/28/2026
A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This malformed token can force the JWE.deserialize() function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of service (DoS) for services that process untrusted JWE values.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified within the jwcrypto library represents a significant security risk related to resource exhaustion and availability disruption. Specifically, this flaw allows a remote attacker to trigger a Denial of Service condition by submitting maliciously crafted JSON Web Encryption tokens. The core technical issue lies in how the JWE.deserialize() function processes incoming encrypted data structures that contain an excessive number of period delimiters. In standard JWT/JWE formats, periods are used as separators between different parts of the token header, payload, and signature. However, when a malformed token with numerous such delimiters is submitted, it can cause the deserialization logic to behave unpredictably or inefficiently during parsing operations.
From a technical perspective, this vulnerability stems from insufficient input validation regarding the structure and size of incoming JWE tokens. The library fails to adequately limit or check the complexity of the delimiter sequence before attempting full deserialization. As the parser attempts to process these numerous segments, it may allocate excessive amounts of memory in an attempt to handle what appears to be a highly fragmented data stream. This unbounded resource consumption leads directly to a MemoryError exception within the application environment running jwcrypto. Such exceptions typically crash the processing thread or service instance if not properly caught and handled at a higher level, thereby disrupting normal operations for all users relying on that specific service endpoint.
The operational impact of this vulnerability is primarily focused on availability rather than confidentiality or integrity in its immediate execution phase. Services that rely on jwcrypto to decrypt incoming JWE tokens are susceptible to being taken offline if an attacker repeatedly sends these crafted payloads. This constitutes a classic Denial of Service scenario where the system's resources, specifically memory, are exhausted by malicious input. For applications handling high volumes of encrypted communications or authentication requests, this could lead to significant downtime and service degradation. It is important to note that while the immediate effect is resource exhaustion, such vulnerabilities can sometimes serve as precursors to more complex attacks if they expose underlying implementation details or cause state corruption in memory-managed environments.
In terms of industry classification standards, this vulnerability aligns with CWE-400: Uncontrolled Resource Consumption and potentially CWE-20: Improper Input Validation. The attack vector is classified under MITRE ATT&CK technique T1496: Resource Hijacking, specifically focusing on resource exhaustion to disrupt service availability. Security teams should prioritize patching this vulnerability in any production environment where jwcrypto is utilized for processing untrusted external inputs. Mitigation strategies include updating the library to a version that includes proper bounds checking and input sanitization mechanisms. Additionally, implementing rate limiting at the network or application gateway level can help mitigate the impact by restricting the frequency of token submissions from single sources. Application-level error handling should also be reviewed to ensure that MemoryError exceptions are gracefully managed without crashing the entire service process.