{"action":"Upgrade jwcrypto to 1.5.6 or later.","affected":[{"fixed":"1.5.6","introduced":"0"}],"component":"jwcrypto","cve_ids":["CVE-2024-28102"],"ecosystem":"PyPI","epss":0.0098,"exploited":false,"fixed_versions":["1.5.6"],"ghsa_id":"GHSA-j857-7rvv-vj97","id":"tcs_01M5KFNDAAM8HTY0V4NPP46R4C","modified_at":"2026-09-10T03:50:10.546310463Z","published_at":"2024-03-06T20:00:56Z","references":["https://osv.dev/vulnerability/GHSA-j857-7rvv-vj97","https://github.com/latchset/jwcrypto/security/advisories/GHSA-j857-7rvv-vj97","https://nvd.nist.gov/vuln/detail/CVE-2024-28102","https://github.com/latchset/jwcrypto/commit/90477a3b6e73da69740e00b8161f53fea19b831f","https://github.com/latchset/jwcrypto","https://lists.debian.org/debian-lts-announce/2024/09/msg00026.html","https://www.vicarius.io/vsociety/posts/denial-of-service-vulnerability-discovered-in-jwcrypto-cve-2024-28102-28103"],"severity":{"label":"medium","score":6.8},"sources":[{"source":"osv","source_id":"GHSA-j857-7rvv-vj97","url":"https://osv.dev/vulnerability/GHSA-j857-7rvv-vj97"}],"summary":"JWCrypto vulnerable to JWT bomb Attack in `deserialize` function"}