AIKIDO-2026-227032

TL;DR

jwcrypto's compact token deserialization splits the input string on the . delimiter before validating the token length or segment count. A crafted JWE or JWS string containing lots of period delimiters forces the parser to allocate a very large list of segments before the structure check runs. Parsing such input can exhaust process memory and raise a MemoryError, degrading availability for services that deserialize externally supplied tokens. The fix bounds the number of splits performed during compact JWE and JWS parsing so malformed tokens are rejected without excessive allocation.