jwcrypto CVE-2026-80179

The target service must explicitly call JWE.deserialize() on attacker-supplied, untrusted JWE token data without prior structural or length validation - this is a code-path-dependent condition, not a default behavior of all jwcrypto deployments. Services that only generate JWE tokens, or that validate JWE tokens from internally trusted sources, are not affected. The CVSS AC:H rating reflects this application-specific prerequisite: the vulnerable code path is only reachable if the service design exposes a JWE deserialization endpoint to external input. No authentication is required from the attacker (PR:N per CVSS), meaning any unauthenticated caller who can reach the endpoint can trigger the flaw. Exploitation does not produce code execution or data leakage - only a service crash. Limiting factors include the AC:H requirement (targeted service must process untrusted JWE), the purely DoS nature of impact, and the likelihood that many jwcrypto deployments do not expose raw JWE deserialization to unauthenticated users.

The CVSS 3.1 score of 5.9 Medium with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H accurately reflects the constrained real-world risk: while the attack is network-reachable and requires no credentials, the AC:H rating is consistent with the requirement that the target application must specifically deserialize untrusted JWE input - a conditional deployment posture rather than a universal default. No EPSS data was provided in the input, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA KEV, and no POC is referenced, placing it in the no public exploit confirmed category. Impact is strictly a DoS; there is no confidentiality or integrity risk, which limits blast radius even in worst-case exploitation. The primary real-world risk concentration is in API gateways, identity services, or automation endpoints built on jwcrypto that accept JWE tokens from external, unauthenticated clients - where repeated crafted requests could sustain a service outage. Services that only issue or internally validate JWE tokens are not exposed.

An unauthenticated attacker sends an HTTP request to a public-facing API endpoint that passes the Authorization header or request body value directly to jwcrypto's JWE.deserialize() - for example, a token introspection or decryption endpoint in an Ansible Automation Platform deployment. The crafted JWE string contains thousands of period characters, causing deserialize() to loop over segments and allocate memory beyond available limits. The Python process terminates with a MemoryError, taking the service offline until restarted, with no code execution or data exfiltration possible. No public exploit code has been identified at time of analysis.