PyPI/python-jose CVE-2024-33664: medium 5.3, EPSS 0.78%

python-jose denial of service via compressed JWE content

Action: Upgrade python-jose to 3.4.0 or later.

pip install python-jose==3.4.0

Affected

Fixed versions

Sources

• osv: GHSA-cjwg-qfpm-7377
• https://nvd.nist.gov/vuln/detail/CVE-2024-33664
• https://github.com/mpdavis/python-jose/issues/344
• https://github.com/mpdavis/python-jose/pull/345
• https://github.com/mpdavis/python-jose
• https://github.com/mpdavis/python-jose/releases/tag/3.4.0
• https://github.com/pypa/advisory-database/tree/main/vulns/python-jose/PYSEC-2024-233.yaml
• https://www.vicarius.io/vsociety/posts/jwt-bomb-in-python-jose-cve-2024-33664

CVE-2024-33664 · published 2024-04-26T00:30:35Z · modified 2026-05-11T00:41:14.854282197Z · JSON