What is CVE-2024-29370?

CVE-2024-29370 is a medium-severity vulnerability in Python-Jose Project, classified under Improper Handling of Highly Compressed Data (Data Amplification). CVSS score: 5.3/10. Published 2025-12-17.

How severe is CVE-2024-29370?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Python-Jose Project

CVE-2024-29370

In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.

EPSS: 0.002 (7.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.

Affected products

Python-jose_project Python-jose — versions 3.3.0
N/a — versions n/a

Weakness classification (CWE)

CWE-409 — Improper Handling of Highly Compressed Data (Data Amplification)

References

cve@mitre.org (Exploit, Patch, Issue Tracking)

Frequently asked questions

What is CVE-2024-29370?: CVE-2024-29370 is a medium-severity vulnerability in Python-Jose Project, classified under Improper Handling of Highly Compressed Data (Data Amplification). CVSS score: 5.3/10. Published 2025-12-17.
How severe is CVE-2024-29370?: Medium severity. CVSS v3 base score is 5.3 out of 10.