JWCrypto is a Python library implementing JSON Web Key, Signature, and Encryption. A flaw allows an unauthenticated attacker to send a crafted JWE token that is limited to 250 KB on input but can decompress to about 100 MB. When processed by the library, the large decompressed payload consumes server memory and can cause the process to crash or become unresponsive. This type of attack is a decompression bomb scenario, and the vulnerability is classified as CWE‑409 and CWE‑770.

Any installation of latchset:jwcrypto before version 1.5.7 is affected. Systems that incorporate this library to handle JWTs—such as web services or authentication back‑ends—may be exposed if the library remains outdated.

The CVSS score of 5.3 indicates medium severity. An EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only that an attacker transmit a compliant JWE token to the vulnerable system; the attack is unauthenticated and can occur over any channel that delivers the token. On memory‑constrained servers, the resulting exhaustion can cause a denial‑of‑service condition. The likely attack vector is inferred to be any input pathway that allows the attacker to supply a large compressed JWE.