CVE catalog

CVE-2024-33664

python-jose: CVE-2024-33664

Severity: High · CVSS 7.7CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Published: Apr 26, 2024, 12:15:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.78% · Oct 25, 2026

python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryption (JWE) token with a high compression ratio, aka a "JWT bomb." This is similar to CVE-2024-21319.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	python-jose	bookworm	`3.3.0+dfsg-4`	vulnerable
Suse	python-python-jose	package hub 15 sp5	`3.0.1-bp155.3.6.1`	fixed
Opensuse	python-python-jose	leap 15.5	`3.0.1-bp155.3.6.1`	fixed
Ubuntu	python-jose	22.04	`3.3.0+dfsg-1`	vulnerable
Ubuntu	python-jose	24.04	`3.3.0+dfsg-4`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	python-jose	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1070375]
Suse	python-python-jose	rpm	package hub 15 sp5	`3.0.1-bp155.3.6.1`	Not reported	OPENSUSE-SU-2024:0149-1	Not reported
Opensuse	python-python-jose	rpm	leap 15.5	`3.0.1-bp155.3.6.1`	Not reported	OPENSUSE-SU-2024:0149-1	Not reported

[Debian bug #1070375]

Notes

[bookworm] python-jose: Minor issue, similar to CVE-2024-29370

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]