chore(deps): update dependency jwcrypto to v1.5.7 [security]

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
jwcrypto	==1.5.6 → ==1.5.7

---

JWCrypto: JWE ZIP decompression bomb

CVE-2026-39373 / GHSA-fjrm-76x2-c4q4

More information

Details

Summary

The fix for GHSA-j857-7rvv-vj97 in v1.5.6 is weak in that it does not allow to fully control the amount of plaintext the receiver is willing to deal with and provides just a weak upper bound. The patch limits input token size to 250KB but does not validate the decompressed output size. An unauthenticated attacker can craft a JWE token under the 250KB input limit that decompresses to very large data that may exceed small devices memory availability, causing Denial of Service via memory exhaustion.

Although this is technically not unbounded I do recognize that it may be too much for devices and is something that could be surprising to developers, and we can do better than that.

NOTE: the original report was sloppy (probably AI slop) and claimed arbitrary memory consumption, but simple testing showed that while 100MB could be decompressed a 1GB output was denied because the token exceeded the 250K compressed serialization.

NOTE WELL: The proposed solution was also sloppy, proposing to first decompress the data completely in memory (therefore causing the memory exhaustion) and then checking how much memory was already used to deny the operation. I intentionally left the "details" section untouched to show how bad AI slop is and how uncritical the submitter was, even as it was obvious the "suggested fix" is actually no solution at all, as it was using the very call that he claimed was causing "arbitrary" memory exhaustion and wrapping it around an "if" ... the actual solution is in the resolving commit in version 1.5.7

Details

The vulnerable code in jwcrypto/jwe.py:

if len(data) > default_max_compressed_size:
    raise InvalidJWEData('Compressed data exceeds maximum allowed size')
self.plaintext = zlib.decompress(data, -zlib.MAX_WBITS)

The check validates data which is the compressed bytes, not the decompressed output. A 132KB token (under the 250KB limit) can decompress to approximately 100MB with no error raised.

PoC

Tested on jwcrypto 1.5.6 (patched version):

import zlib
from jwcrypto import jwe
from jwcrypto.jwk import JWK
import time

key = JWK.generate(kty='oct', size=128)
bomb_data = b"A" * 1024 * 1024 * 100  # 100MB uncompressed

token = jwe.JWE(
    plaintext=bomb_data,
    protected={"alg": "A128KW", "enc": "A128GCM", "zip": "DEF"}
)
token.add_recipient(key)
serialized = token.serialize(compact=True)
print(f"Token size: {len(serialized)/1024:.1f} KB")  # 132.8 KB — under 250KB limit

tok2 = jwe.JWE()
tok2.deserialize(serialized, key)
print(f"Decompressed: {len(tok2.plaintext)/1024/1024:.0f} MB")  # 100 MB

Output:

Token size: 132.8 KB
Decompressed: 100 MB

Impact

An unauthenticated attacker can exhaust server memory by sending crafted JWE tokens with ZIP compression. The existing patch (v1.5.6) does not prevent this attack. An unauthenticated attacker can cause memory exhaustion on memory-constrained systems. A token under the 250KB input limit can decompress to approximately 100MB.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/latchset/jwcrypto/security/advisories/GHSA-fjrm-76x2-c4q4
• https://nvd.nist.gov/vuln/detail/CVE-2026-39373
• https://github.com/latchset/jwcrypto/commit/25db861d8b29434838669a94a843af03d29ea6ed
• https://github.com/latchset/jwcrypto/releases/tag/v1.5.7
• https://github.com/pypa/advisory-database/tree/main/vulns/jwcrypto/PYSEC-2026-70.yaml
• https://github.com/advisories/GHSA-fjrm-76x2-c4q4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

latchset/jwcrypto (jwcrypto)

v1.5.7: Version 1.5.7

Compare Source

What's Changed

• JWE: allow general (non flattened) serialization syntax by @​Thomas-Mollard in #​351
• Update CI actions by @​simo5 in #​352
• Allow to pass through pem loading unsafe option by @​simo5 in #​354
• Add support for 'scope' claim with multiple scopes by @​tony2001 in #​359
• Set default kid when importing keys from pyca. by @​bartvm in #​367
• Hardening: Enforce length of keys for HMAC operations by @​simo5 in #​369
• Add Ed25519 and Ed448 signature algorithms by @​simo5 in #​370
• Migrate jwcrypto packaging to Hatch by @​iamdhakrey in #​373
• Version 1.5.7 by @​simo5 in #​374

New Contributors

• @​Thomas-Mollard made their first contribution in #​351
• @​tony2001 made their first contribution in #​359
• @​bartvm made their first contribution in #​367
• @​iamdhakrey made their first contribution in #​373

Full Changelog: latchset/jwcrypto@v1.5.6...v1.5.7

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[gemini-code-assist]

Code Review

This pull request updates the dependency version of jwcrypto from 1.5.6 to 1.5.7 in kms/snippets/requirements.txt. There are no review comments, and I have no feedback to provide.