CVE-2026-80179 Jwcrypto: jwcrypto: denial of service via malformed jwe tokens
A remote attacker can cause a denial of service in applications using jwcrypto by sending malformed JWE tokens that trigger excessive memory allocation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80179?
CVE-2026-80179 is a medium-severity denial of service vulnerability in Red Hat Ansible Automation Platform 2, published on 27 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This malformed token can force the JWE.deserialize() function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of service (DoS) for services that process untrusted JWE values.
Weakness: CWE-770
Which versions are affected by CVE-2026-80179?
How do I fix CVE-2026-80179?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-80179 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-80179 exists.
Sources
Also known as AZL-98337, DEBIAN-CVE-2026-80179, UBUNTU-CVE-2026-80179.