Threats affecting pkg:deb/redhat/python-jwcrypto

A security update for python-jwcrypto addresses a vulnerability (CVE-2026-39373) involving weak mitigation against a JWT bomb attack in the deserialize function. This flaw can lead to memory exhaustion when processing crafted compressed JWE tokens. The issue affects certain versions of python-jwcrypto distributed with Red Hat Enterprise Linux 10 and related SUSE products. Red Hat has released patches to fix this vulnerability and rated the security impact as low. No known exploits are reported in the wild.