Vulnerabilities for python-jose

No release of python-jose is currently known to be free of vulnerabilities.

Details

• GHSA-3qf3-8w2g-rqmx2026-09-03

  python-jose algorithm confusion guard bypassed by DER-encoded public keys

  Fixed in: 3.4.0

• PYSEC-2025-1852025-12-17

  In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.

• GHSA-cjwg-qfpm-73772024-04-26

  python-jose denial of service via compressed JWE content

  Fixed in: 3.4.0

• GHSA-w799-prg3-cx772022-05-17

  python-jose failure to use a constant time comparison for HMAC keys

  Fixed in: 1.3.2