Latchset

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Latchset product.

RSS Feeds for Latchset security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Latchset products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Latchset Sorted by Most Security Vulnerabilities since 2018

Latchset Jwcrypto2 vulnerabilities

Latchset Jose1 vulnerability

Latchset Pkcs11 Provider1 vulnerability

By the Year

In 2026 there have been 1 vulnerability in Latchset with an average score of 5.3 out of ten. Latchset did not have any published security vulnerabilities last year. That is, 1 more vulnerability have already been reported in 2026 as compared to last year.

Year	Vulnerabilities	Average Score
2026	1	5.30
2025	0	0.00
2024	3	6.97

It may take a day or so for new Latchset vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Latchset Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-39373	Apr 07, 2026	JWCrypto <1.5.7 memory exhaustion via ZIP JWE tokens (CVE-2026-39373) JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to 1.5.7, an unauthenticated attacker can exhaust server memory by sending crafted JWE tokens with ZIP compression. The existing patch for CVE-2024-28102 limits input token size to 250KB but does not validate the decompressed output size. An unauthenticated attacker can cause memory exhaustion on memory-constrained systems. A token under the 250KB input limit can decompress to approximately 100MB. This vulnerability is fixed in 1.5.7.
CVE-2023-50967	Mar 20, 2024	latchset JOSE library DOS via large PBES2 Count (CVE-2023-50967) latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.	Jose
CVE-2023-6681	Feb 12, 2024	JWCrypto Library DoS via Computationally Intensive Brute-Force Capability A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a denial of service (DoS) attack and possible password brute-force and dictionary attacks to be more resource-intensive. This issue can result in a large amount of computational consumption, causing a denial of service attack.	Jwcrypto
CVE-2023-6258	Jan 30, 2024	CVE-2023-6258: pkcs11-provider Bleichenbacher-like side-channel flaw (PKCS#1 1.5) A security vulnerability has been identified in the pkcs11-provider, which is associated with Public-Key Cryptography Standards (PKCS#11). If exploited successfully, this vulnerability could result in a Bleichenbacher-like security flaw, potentially enabling a side-channel attack on PKCS#1 1.5 decryption.	Pkcs11 Provider
CVE-2016-6298	Sep 01, 2016	The _Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before 0.3.2 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data The _Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before 0.3.2 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million Message Attack (MMA).	Jwcrypto