CVE-2024-28102

Name of the Vulnerable Software and Affected Versions jwcrypto versions prior to 1.5.6

Description The issue is related to an uncontrolled resource consumption in the jwcrypto library. An attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time.

Recommendations For versions prior to 1.5.6, to mitigate this vulnerability, it is recommended to limit the maximum token length to 250K. As a temporary workaround, consider restricting the processing of tokens with high compression ratios until a patch is available. Update to version 1.5.6 or later to fix the vulnerability.