Control: tags -1 + fixed-upstream patch Hi,
The fix for CVE-2026-80179 (GHSA-96rv-c4vc-h4f4, fixed in jwcrypto 1.5.9) is this commit: https://www.google.com/url?q=https://github.com/latchset/jwcrypto/commit/1a7737d6eb&source=gmail&ust=1793767682030000&sa=E "Limit dot splits during JWE and JWS parsing" The code change is two lines. It bounds the compact-serialization split in JWE.deserialize() and JWS.deserialize(), and the commit also adds regression tests: jwe.py: data = raw_jwe.split('.') -> data = raw_jwe.split('.', 5) jws.py: data = raw_jws.split('.') -> data = raw_jws.split('.', 3) Verified on the Debian 1.5.6-1.2 source with its debian/patches applied. The commit applies with line offsets only. - Parsing a malformed compact JWE made of 2,000,000 '.' characters (tracemalloc peak): 1.5.6-1.2: 17.2 MB, 22.8 ms (grows linearly with input size) patched: 2.0 MB, 1.6 ms (just the input string itself) Both raise InvalidJWEData; the patched version no longer builds the large intermediate list first. - Upstream tests (jwcrypto/tests.py and tests-cookbook.py): unpatched: 123 passed patched: 125 passed (the 2 new regression tests), 0 failed The patch is small enough to carry until 1.5.9 or later is packaged. Thanks!
