jwcrypto CVE-2026-80179
MEDIUMSeverity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitation requires the application to specifically deserialize untrusted JWE input (AC:H); no credentials needed (PR:N); impact is DoS only with no confidentiality or integrity effect.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This malformed token can force the JWE.deserialize() function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of service (DoS) for services that process untrusted JWE values.
AnalysisAI
Denial of service in jwcrypto's JWE.deserialize() function allows a remote unauthenticated attacker to crash any service that processes untrusted JWE tokens by submitting a malformed compact serialization containing an excessive number of period delimiters, triggering uncontrolled memory allocation and a MemoryError. Affected deployments include Red Hat Ansible Automation Platform 2, RHEL 9 and 10, OpenShift AI (RHOAI), and OpenStack Platform 16.2 as disclosed via Red Hat Bugzilla 2524147 and upstream advisory GHSA-96rv-c4vc-h4f4. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target service must explicitly call JWE.deserialize() on attacker-supplied, untrusted JWE token data without prior structural or length validation - this is a code-path-dependent condition, not a default behavior of all jwcrypto deployments. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 5.9 Medium with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H accurately reflects the constrained real-world risk: while the attack is network-reachable and requires no credentials, the AC:H rating is consistent with the requirement that the target application must specifically deserialize untrusted JWE input - a conditional deployment posture rather than a universal default. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the upstream GitHub Security Advisory GHSA-96rv-c4vc-h4f4 (https://github.com/latchset/jwcrypto/security/advisories/GHSA-96rv-c4vc-h4f4) and Red Hat's advisory at https://access.redhat.com/security/cve/CVE-2026-80179 for patched jwcrypto package versions; no exact fixed version number is confirmed from the provided input data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Credential disclosure in Red Hat Ansible Automation Platform 2.5 and 2.6 allows any authenticated user to retrieve plain
Server-side request forgery in the Red Hat Ansible Automation Platform 2 Controller's HashiCorp Vault credential plugin
Arbitrary file write in pulpcore's FilesystemExport feature allows an authenticated administrator to escape the intended
mTLS authentication bypass in the Red Hat Ansible Automation Platform (AAP) Gateway Envoy proxy allows unauthenticated r
Arbitrary command execution in ansible-core allows an attacker who controls a collection source URI to run commands on a
Local code execution in the Visual Studio Code Ansible (Lightspeed) extension lets a malicious project run arbitrary she
Credential exfiltration via SSRF in AWX's GitHub webhook status callback affects Red Hat Ansible Automation Platform 2:
SSRF vulnerabilities in AWX notification backends (webhook, Mattermost, Rocket.Chat, and Grafana) allow an authenticated
Remote code execution in galaxy_ng's legacy role import API (v1) allows an authenticated user controlling a git reposito
Path traversal in AWX's project_archive action plugin allows arbitrary file writes to execution node filesystems outside
Incomplete RBAC authorization in AWX's websocket event consumer exposes real-time job stdout to any authenticated user,
Server-side request forgery in galaxy_ng, the Ansible Galaxy server plugin for Pulp, allows authenticated users holding
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today