CVE-2026-80179— Jwcrypto: jwcrypto: denial of service via malformed jwe tokens
Quick assessment
Affected
Red Hat Red Hat Ansible Automation Platform 2
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
latchset jwcrypto是latchset团队开源的一个JSON网络令牌加密库。 latchset jwcrypto存在资源管理错误漏洞，该漏洞源于特制的JSON Web Encryption (JWE)令牌包含大量句点分隔符，可强制JWE.deserialize()函数分配过多内存，导致MemoryError，从而造成服务拒绝服务。
Affected Version Matrix 25
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2 | any |
affected |
any |
affected | ||
any |
affected | ||
any |
affected | ||
any |
affected | ||
any |
affected | ||
any |
affected | ||
any |
affected | ||
| … +5 more rows | |||
| Red Hat | Red Hat Enterprise Linux 10 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 9 | any |
affected |
| Red Hat | Red Hat OpenShift AI (RHOAI) | any |
affected |
any |
affected | ||
| Red Hat | Red Hat OpenStack Platform 16.2 | any |
affected |
any |
affected | ||
any |
affected | ||
any |
affected | ||
any |
affected | ||
any |
affected | ||
any |
affected | ||
any |
affected | ||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-80179
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Jwcrypto: jwcrypto: denial of service via malformed jwe tokens
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This malformed token can force the JWE.deserialize() function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of service (DoS) for services that process untrusted JWE values.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5
Vulnerability Title
latchset jwcrypto 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
latchset jwcrypto是latchset团队开源的一个JSON网络令牌加密库。 latchset jwcrypto存在资源管理错误漏洞，该漏洞源于特制的JSON Web Encryption (JWE)令牌包含大量句点分隔符，可强制JWE.deserialize()函数分配过多内存，导致MemoryError，从而造成服务拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat OpenShift AI (RHOAI) | - |
cpe:/a:redhat:openshift_ai
|
|
| Red Hat | Red Hat OpenShift AI (RHOAI) | - |
cpe:/a:redhat:openshift_ai
|
|
| Red Hat | Red Hat OpenStack Platform 16.2 | - |
cpe:/a:redhat:openstack:16.2
|
|
| Red Hat | Red Hat OpenStack Platform 16.2 | - |
cpe:/a:redhat:openstack:16.2
|
|
| Red Hat | Red Hat OpenStack Platform 16.2 | - |
cpe:/a:redhat:openstack:16.2
|
|
| Red Hat | Red Hat OpenStack Platform 16.2 | - |
cpe:/a:redhat:openstack:16.2
|
|
| Red Hat | Red Hat OpenStack Platform 16.2 | - |
cpe:/a:redhat:openstack:16.2
|
|
| Red Hat | Red Hat OpenStack Platform 16.2 | - |
cpe:/a:redhat:openstack:16.2
|
|
| Red Hat | Red Hat OpenStack Platform 16.2 | - |
cpe:/a:redhat:openstack:16.2
|
|
| Red Hat | Red Hat OpenStack Platform 16.2 | - |
cpe:/a:redhat:openstack:16.2
|
|
II. Public POCs for CVE-2026-80179
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-80179
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-80179 (3)
-
-
-
🔗 2524147 – (CVE-2026-80179) CVE-2026-80179 jwcrypto: jwcrypto: Denial of Service via malformed JWE tokens Read full article issue-tracking x_refsource_REDHAT
Same Patch Batch · Red Hat · 2026-08-27 · 6 CVEs total
| CVE-2026-78002 | 7.5 HIGH | Rsyslog: rsyslog: denial of service via heap buffer overflow in rainerscript replace() fun |
| CVE-2026-5680 | 7.5 HIGH | Undertow-core: undertow: denial of service via websocket permessage-deflate processing |
| CVE-2026-81658 | 6.5 MEDIUM | Foreman: cross-tenant disclosure of template revisions via unauthorized audit lookup |
| CVE-2026-81668 | 5.4 MEDIUM | Rubygem-katello: cross-tenant content view filter rule access and modification via unautho |
| CVE-2026-81893 | 4.7 MEDIUM | Gdk-pixbuf: gdk-pixbuf: invalid write in jpeg icc profile parser on error recovery |
IV. Related Vulnerabilities
Same product: Red Hat Ansible Automation Platform 2
-
CVE-2026-109131
Ansible-ui: ansible-ui: stored xss via unsafe javascript url -
CVE-2026-103869
Pulp-ansible: bearer tokens are reused across remotes in a w -
CVE-2026-103868
Pulp-container: registry credentials are reused across remot -
CVE-2026-106033
Ansible: ansible-ui: ansible ui dom xss in /redirect next pa -
CVE-2026-103754
Ansible-runner: ansible-runner: path traversal and symlink e
Same vendor: Red Hat
-
CVE-2026-89096
Nfs-utils: nfs-utils: denial of service via memory leak in r -
CVE-2026-89088
Parted: parted: denial of service via heap buffer overflow d -
CVE-2026-89085
Parted: parted: heap-based buffer overflow via crafted fat32 -
CVE-2026-111802
Nautilus: nautilus: arbitrary file deletion via trash symlin -
CVE-2026-17591
Libarchive: libarchive: use-after-free via aliased mac metad
Same weakness: CWE-770
-
CVE-2026-110752
Text::CSV_XS versions before 1.65 for Perl allow memory exha -
CVE-2026-85231
Libtirpc: libtirpc: denial of service via unbounded memory a -
CVE-2026-57487
libupnp chunked HTTP bodies can bypass g_maxContentLength an -
CVE-2026-95859
libp2p-rust: Gossipsub GRAFT topics unbounded growth -
CVE-2026-107564
gocsaf/csaf: csaf_provider prone to uncontrolled resource co
V. Comments for CVE-2026-80179
No comments yet