Red Hat Openstack Platform 16 2
Monthly
Denial of service in jwcrypto's JWE.deserialize() function allows a remote unauthenticated attacker to crash any service that processes untrusted JWE tokens by submitting a malformed compact serialization containing an excessive number of period delimiters, triggering uncontrolled memory allocation and a MemoryError. Affected deployments include Red Hat Ansible Automation Platform 2, RHEL 9 and 10, OpenShift AI (RHOAI), and OpenStack Platform 16.2 as disclosed via Red Hat Bugzilla 2524147 and upstream advisory GHSA-96rv-c4vc-h4f4. No public exploit code or CISA KEV listing exists at time of analysis, and impact is confined to availability with no confidentiality or integrity exposure.
Denial of service in jwcrypto's JWE.deserialize() function allows a remote unauthenticated attacker to crash any service that processes untrusted JWE tokens by submitting a malformed compact serialization containing an excessive number of period delimiters, triggering uncontrolled memory allocation and a MemoryError. Affected deployments include Red Hat Ansible Automation Platform 2, RHEL 9 and 10, OpenShift AI (RHOAI), and OpenStack Platform 16.2 as disclosed via Red Hat Bugzilla 2524147 and upstream advisory GHSA-96rv-c4vc-h4f4. No public exploit code or CISA KEV listing exists at time of analysis, and impact is confined to availability with no confidentiality or integrity exposure.