Latchset CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM Latchset CVE published 2026-04-07

CVE-2026-39373

CVE-2026-39373 is a vulnerability in JWCrypto, a Python library for implementing JWK, JWS, and JWE specifications. The vulnerability allows an unauthenticated attacker to exhaust server memory by sending crafted JWE tokens with ZIP compression. The existing patch for CVE-2024-28102 limits input token size to 250KB but does not validate the decompressed output size, leading to potential memory exhaustion o [truncated]

MEDIUM Latchset CVE published 2025-10-15

CVE-2025-11568

A data corruption vulnerability exists in the luksmeta utility when used with LUKS1 disk encryption format. The utility fails to validate available space before writing metadata, allowing an attacker with sufficient permissions to overwrite and permanently corrupt encrypted user data by writing excessive metadata. LUKS2 and other formats are unaffected.