JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to 1.5.7, an unauthenticated attacker can exhaust server memory by sending crafted JWE tokens with ZIP compression. The existing patch for CVE-2024-28102 limits input token size to 250KB but does not validate the decompressed output size. An unauthenticated attacker can cause memory exhaustion on memory-constrained systems. A token under the 250KB input limit can decompress to approximately 100MB. This vulnerability is fixed in 1.5.7.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:19197 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * JWCrypto: python-cryptography: python: JWCrypto: Memory exhaustion via crafted compressed JWE tokens     (CVE-2026-39373)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:19042 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * JWCrypto: python-cryptography: python: JWCrypto: Memory exhaustion via crafted compressed JWE tokens     (CVE-2026-39373)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:21425-1 advisory.

    - CVE-2026-39373: weak mitigation for JWT bomb attack in the `deserialize` function can lead to memory     exhaustion via       crafted compressed JWE tokens (bsc#1261802).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:13512 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):
    * automation-controller: Account hijacking and unauthorized access via unverified email linking     (CVE-2026-6266)
    * automation-controller: PyJWT accepts unknown `crit` header extensions (RFC 7515 4.1.11 MUST violation)     (CVE-2026-32597)
    * automation-controller: denial of service via malformed HTML-like sequences (CVE-2025-69534)
    * automation-controller: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves     (CVE-2026-26007)
    * automation-gateway: Account hijacking and unauthorized access via unverified email linking     (CVE-2026-6266)
    * automation-gateway: Rollup: Remote Code Execution via Path Traversal Vulnerability (CVE-2026-27606)
    * automation-gateway: SVGO: Denial of Service via XML entity expansion (CVE-2026-29074)
    * automation-gateway: ReDoS via $data reference (CVE-2025-69873)
    * automation-gateway-proxy: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
    * python3.12-django-ansible-base: Account hijacking and unauthorized access via unverified email linking     (CVE-2026-6266)
    * python3.12-markdown: denial of service via malformed HTML-like sequences (CVE-2025-69534)
    * python3.12-jwcrypto: JWCrypto: Memory exhaustion via crafted compressed JWE tokens (CVE-2026-39373)
    * python3.12-pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922)
    * python3.12-pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID     (CVE-2026-23490)
    * python3.12-pyOpenSSL: DTLS cookie callback buffer overflow (CVE-2026-27459)
    * receptor: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    For details about this release, refer to the release notes listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:13508 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):
    * automation-controller: Account hijacking and unauthorized access via unverified email linking     (CVE-2026-6266)
    * automation-controller: DTLS cookie callback buffer overflow (CVE-2026-27459)
    * automation-controller: PyJWT accepts unknown `crit` header extensions (RFC 7515 4.1.11 MUST violation)     (CVE-2026-32597)
    * automation-controller: denial of service via malformed HTML-like sequences (CVE-2025-69534)
    * automation-gateway: Account hijacking and unauthorized access via unverified email linking     (CVE-2026-6266)
    * automation-gateway-proxy: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
    * automation-platform-ui: Rollup: Remote Code Execution via Path Traversal Vulnerability (CVE-2026-27606)
    * automation-platform-ui: minimatch: Denial of Service via specially crafted glob patterns     (CVE-2026-26996)
    * python3.12-django-ansible-base: Account hijacking and unauthorized access via unverified email linking     (CVE-2026-6266)
    * python3.12-markdown: denial of service via malformed HTML-like sequences (CVE-2025-69534)
    * python3.12-jwcrypto: JWCrypto: Memory exhaustion via crafted compressed JWE tokens (CVE-2026-39373)
    * python3.12-pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922)
    * python3.12-pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID     (CVE-2026-23490)
    * python3.12-pyOpenSSL: DTLS cookie callback buffer overflow (CVE-2026-27459)
    * receptor: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    For details about this release, refer to the release notes listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:20644-1 advisory.

    - CVE-2026-39373: weak mitigation for JWT bomb attack in the `deserialize` function can lead to memory     exhaustion via       crafted compressed JWE tokens (bsc#1261802).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1590 advisory.

    JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to 1.5.7, an     unauthenticated attacker can exhaust server memory by sending crafted JWE tokens with ZIP compression. The     existing patch for CVE-2024-28102 limits input token size to 250KB but does not validate the decompressed     output size. An unauthenticated attacker can cause memory exhaustion on memory-constrained systems. A     token under the 250KB input limit can decompress to approximately 100MB. This vulnerability is fixed in     1.5.7. (CVE-2026-39373)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of python-jwcrypto installed on the remote host is prior to 0.4.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3254 advisory.

    JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to 1.5.7, an     unauthenticated attacker can exhaust server memory by sending crafted JWE tokens with ZIP compression. The     existing patch for CVE-2024-28102 limits input token size to 250KB but does not validate the decompressed     output size. An unauthenticated attacker can cause memory exhaustion on memory-constrained systems. A     token under the 250KB input limit can decompress to approximately 100MB. This vulnerability is fixed in     1.5.7. (CVE-2026-39373)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to 1.5.7, an     unauthenticated attacker can exhaust server memory by sending crafted JWE tokens with ZIP compression. The     existing patch for CVE-2024-28102 limits input token size to 250KB but does not validate the decompressed     output size. An unauthenticated attacker can cause memory exhaustion on memory-constrained systems. A     token under the 250KB input limit can decompress to approximately 100MB. This vulnerability is fixed in     1.5.7. (CVE-2026-39373)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
315486	RHEL 9 : python-jwcrypto (RHSA-2026:19197)	Nessus	Red Hat Local Security Checks	medium
315443	RHEL 10 : python-jwcrypto (RHSA-2026:19042)	Nessus	Red Hat Local Security Checks	medium
312129	SUSE SLES16 Security Update : python-jwcrypto (SUSE-SU-2026:21425-1)	Nessus	SuSE Local Security Checks	medium
312098	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update (Important) (RHSA-2026:13512)	Nessus	Red Hat Local Security Checks	critical
312090	RHEL 10 / 9 : Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update (Important) (RHSA-2026:13508)	Nessus	Red Hat Local Security Checks	critical
311762	openSUSE 16 Security Update : python-jwcrypto (openSUSE-SU-2026:20644-1)	Nessus	SuSE Local Security Checks	medium
311304	Amazon Linux 2023 : python3-jwcrypto (ALAS2023-2026-1590)	Nessus	Amazon Linux Local Security Checks	medium
311204	Amazon Linux 2 : python-jwcrypto, --advisory ALAS2-2026-3254 (ALAS-2026-3254)	Nessus	Amazon Linux Local Security Checks	medium
305260	Linux Distros Unpatched Vulnerability : CVE-2026-39373	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-39373

medium

Tenable Plugins

medium

medium

medium

critical

critical

medium

medium

medium

medium