How severe is CVE-2026-39373?

CVE-2026-39373 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.

Is CVE-2026-39373 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (22nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-39373?

CVE-2026-39373 affects Latchset Jwcrypto. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-39373?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-39373 have an EU (EUVD) identifier?

Yes. CVE-2026-39373 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-19911.

When was CVE-2026-39373 published?

CVE-2026-39373 was published on 2026-04-07 and last updated on 2026-07-24.

CVE-2026-39373

CVE-2026-39373 is a medium-severity vulnerability in Latchset Jwcrypto with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-409.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
EPSS exploit prediction: 0% (22nd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-19911
Weakness: CWE-409
Affected product: Latchset Jwcrypto
Published: 2026-04-07
Last modified: 2026-07-24

Description

JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to 1.5.7, an unauthenticated attacker can exhaust server memory by sending crafted JWE tokens with ZIP compression. The existing patch for CVE-2024-28102 limits input token size to 250KB but does not validate the decompressed output size. An unauthenticated attacker can cause memory exhaustion on memory-constrained systems. A token under the 250KB input limit can decompress to approximately 100MB. This vulnerability is fixed in 1.5.7.

Frequently asked questions

What is CVE-2026-39373?: JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to 1.5.7, an unauthenticated attacker can exhaust server memory by sending crafted JWE tokens with ZIP compression. The existing patch for CVE-2024-28102 limits input token size to 250KB but does not validate the decompressed output size. An unauthenticated attacker can cause memory exhaustion on memory-constrained systems. A token under the 250KB input limit can decompress to approximately 100MB. This vulnerability is fixed in 1.5.7.
How severe is CVE-2026-39373?: CVE-2026-39373 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
Is CVE-2026-39373 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (22nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-39373?: CVE-2026-39373 affects Latchset Jwcrypto. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-39373?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-39373 have an EU (EUVD) identifier?: Yes. CVE-2026-39373 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-19911.
When was CVE-2026-39373 published?: CVE-2026-39373 was published on 2026-04-07 and last updated on 2026-07-24.

References

https://github.com/latchset/jwcrypto/security/advisories/GHSA-fjrm-76x2-c4q4

Affected products (1)

cpe:2.3:a:latchset:jwcrypto:*:*:*:*:*:*:*:*

More vulnerabilities in Latchset Jwcrypto

CVE-2024-28102 — Medium (CVSS 6.8): JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can…
CVE-2023-6681 — Medium (CVSS 5.3): A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a denial of service (DoS) attack and…
CVE-2016-6298 — Medium (CVSS 5.3): The _Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before 0.3.2 lacks the Random Filling…

All CVEs affecting Latchset Jwcrypto →

Other CWE-409 vulnerabilities

CVE-2026-62963 — High (CVSS 8.7): Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.4, Centrifugo unidirectional WebSocket…
CVE-2026-55195 — High (CVSS 8.7): py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and…
CVE-2026-53430 — High (CVSS 8.7): Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc…
CVE-2026-44697 — High (CVSS 8.6): Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, a remote, unauthenticated…
CVE-2026-44981 — High (CVSS 8.2): CrowdSec offers crowdsourced protection against malicious IPs. From 1.7.0 until 1.7.8, the LAPI router used…
CVE-2026-43970 — High (CVSS 8.2): Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines cowlib allows…

Browse all CWE-409 vulnerabilities →