---
id: CVE-2023-6681
title: 'Jwcrypto: denail of service  via specifically crafted jwe'
summary: >-
  A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a
  denial of service (DoS) attack and possible password brute-force and
  dictionary attacks to be more resource-intensive. This issue can result in a
  large amount…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-400
vendor: Red Hat
product: 'idm:client'
affected:
  - 'idm:client (all versions)'
  - 'idm:DL1 (all versions)'
  - python-jwcrypto (all versions)
  - automation-controller
  - python-jwcrypto
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-02-12T21:27:57.752185Z'
published: '2024-02-12'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T11:37:23.620Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-6681'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2024:3267'
    label: 'RHSA-2024:3267'
  - url: 'https://access.redhat.com/errata/RHSA-2024:9281'
    label: 'RHSA-2024:9281'
  - url: 'https://access.redhat.com/security/cve/CVE-2023-6681'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2260843'
    label: RHBZ#2260843
tags:
  - cve.org
epss: 0.00884
epssPercentile: 0.59327
ingestedAt: '2026-11-05T21:36:00.812Z'
---

## Overview

A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a denial of service (DoS) attack and possible password brute-force and dictionary attacks to be more resource-intensive. This issue can result in a large amount of computational consumption, causing a denial of service attack.

## Affected

- `idm:client (all versions)`
- `idm:DL1 (all versions)`
- `python-jwcrypto (all versions)`
- `automation-controller`
- `python-jwcrypto`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.