A flaw in the jwcrypto library allows an attacker to craft a JSON Web Encryption token that contains an unusually large number of period delimiters. When the token is processed by JWE.deserialize(), the library attempts to allocate a memory block proportional to the number of delimiters, resulting in an out‑of‑memory condition that generates a MemoryError. This causes the process to terminate or become unresponsive, effectively denying service to legitimate users.

The vulnerability affects several Red Hat–provisioned products. Ansible Automation Platform 2, OpenShift AI, and OpenStack Platform 16.2 are all built on the jwcrypto library and are therefore susceptible. The underlying operating systems, Red Hat Enterprise Linux 9 and 10, host these products and inherit the same risk when their packages include the vulnerable library. Any deployment of these platforms that accepts external JWE tokens without validation is at risk.

The CVSS score of 5.9 indicates a medium impact, and the lack of an EPSS rating or KEV listing suggests current exploit evidence is limited; however, the attack vector is likely remote via network requests to any service that processes JWE tokens. There is no known privilege escalation or data compromise; the main consequence is service disruption due to memory exhaustion. Until a vendor patch is applied, the risk remains that a malicious actor could trigger repeated crashes, impacting availability and potentially forcing costly service restarts.