CVE-2024-33664

python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryption (JWE) token with a high compression ratio, aka a "JWT bomb." This is similar to CVE-2024-21319.

• CWE-400

• https://github.com/mpdavis/python-jose/issues/344Exploit, Issue Tracking, Mitigation, Vendor Advisory
• https://github.com/mpdavis/python-jose/pull/345Issue Tracking, Patch
• https://www.vicarius.io/vsociety/posts/jwt-bomb-in-python-jose-cve-2024-33664Exploit, Mitigation, Third Party Advisory
• https://github.com/mpdavis/python-jose/issues/344Exploit, Issue Tracking, Mitigation, Vendor Advisory
• https://github.com/mpdavis/python-jose/pull/345Issue Tracking, Patch
• https://www.vicarius.io/vsociety/posts/jwt-bomb-in-python-jose-cve-2024-33664Exploit, Mitigation, Third Party Advisory

Published

Apr 26, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-33659AMI APTIOV contains a vulnerability in BIOS where an attacke…8.8
• CVE-2024-3366A vulnerability classified as problematic was found in Xuxue…9.8
• CVE-2024-33660An exploit is possible where an actor with physical access c…5.2
• CVE-2024-33661Portainer before 2.20.0 allows redirects when the target is …9.1
• CVE-2024-33662Portainer before 2.20.2 improperly uses an encryption algori…7.5
• CVE-2024-33663python-jose through 3.3.0 has algorithm confusion with OpenS…6.5
• CVE-2024-33665angular-translate through 2.19.1 allows XSS via a crafted ke…6.1
• CVE-2024-33666An issue was discovered in Zammad before 6.3.0. Users with c…8.6
• CVE-2024-33667An issue was discovered in Zammad before 6.3.0. An authentic…6.5
• CVE-2024-33668An issue was discovered in Zammad before 6.3.0. The Zammad U…9.1
• CVE-2024-33669An issue was discovered in Passbolt Browser Extension before…6.8
• CVE-2024-3367Argument injection in websphere_mq agent plugin in Checkmk 2…5.5