{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"3.3.0"}],"component":"python-jose","cve_ids":["CVE-2024-29370"],"ecosystem":"PyPI","epss":0.00187,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-h4pw-wxh7-4vjj","id":"tcs_01M5KGP2GS8C286DSBJDE4V48S","modified_at":"2026-06-10T17:11:01.761440050Z","published_at":"2025-12-17T16:16:04.457Z","references":["https://osv.dev/vulnerability/PYSEC-2025-185","https://github.com/mpdavis/python-jose/issues/344","https://github.com/advisories/GHSA-h4pw-wxh7-4vjj"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"PYSEC-2025-185","url":"https://osv.dev/vulnerability/PYSEC-2025-185"}],"summary":"In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an excepti"}