{"items":[{"id":"NVI-00018270","kind":"vulnerability","title":"JWCrypto: JWE ZIP decompression bomb","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-fjrm-76x2-c4q4","CVE-2026-39373"],"plain_summary":"GitHub lists this reviewed advisory for jwcrypto. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-042c9a696a8c12e71adfa6c05dde242d"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-06T00:25:45.000Z","value":"5.3 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-042c9a696a8c12e71adfa6c05dde242d"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-042c9a696a8c12e71adfa6c05dde242d","url":"https://github.com/advisories/GHSA-fjrm-76x2-c4q4","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-fjrm-76x2-c4q4","publisher":"GitHub Advisory Database","observed_at":"2026-11-07T00:52:58.259Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-042c9a696a8c12e71adfa6c05dde242d"],"technology":"jwcrypto","known_exclusions":[],"conditions_summary":"### Summary\nThe fix for GHSA-j857-7rvv-vj97 in v1.5.6 is weak in that it does not allow to fully control the amount of plaintext the receiver is willing to deal with and provides just a weak upper bound. The patch limits input token size to 250KB but does not validate the decompressed output size. An unauthenticated attacker can craft a JWE token under the 250KB input limit that decompresses to very large data that may exceed small devices memory availability, causing Denial of Service via memory exhaustion.\n\nAlthough this is technically not unbounded I do recognize that it may be too much for devices and is something that could be surprising to developers, and we can do better than that.\n\nNOTE: the original report was sloppy (probably AI slop) and claimed arbitrary memory consumption, but simple testing showed that while 100MB could be decompressed a 1GB output was denied because the token exceeded the 250K compressed serialization.\n\nNOTE WELL: The proposed solution was also sloppy, proposing to first decompress the data completely in memory (therefore causing the memory exhaustion) and then checking how much memory was already used to deny the operation. I _intentionally_ left th","public_affected_ranges":["<= 1.5.6"]}],"null_published_at":"2026-11-07T07:07:39.798Z","source_updated_at":"2026-06-06T00:25:45.000Z","source_disclosed_at":"2026-04-08T00:16:14.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-07T00:52:58.259Z"}],"next_cursor":null,"snapshot_revision":"42594"}