CVE-2026-119283 Details
Description
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.5, joserfc.jwe.decrypt_json() accepts a JWE General JSON Serialization recipients array without a count limit and calls decrypt_cek() for every entry. An unauthenticated attacker who can submit a JWE to an endpoint using an RSA key-management algorithm can choose the number of private-key decryption operations performed by one request. The verify_all_recipients option does not reduce this work because the affected loop processes every recipient before consulting that setting, allowing repeated requests to exhaust service CPU without affecting confidentiality or integrity. This issue is fixed in version 1.7.5.
A denial-of-service vulnerability has been identified in the joserfc library, which implements JSON Object Signing and Encryption (JOSE) standards. Prior to version 1.7.5, the function joserfc.jwe.decrypt_json() processed JWE General JSON Serialization recipients arrays without a limit on their length. This allowed an unauthenticated attacker to send a JWE using an RSA key-management algorithm and control the number of private-key decryption operations performed in response, leading to CPU exhaustion on the server. The vulnerability arises because the library's only documented option to verify recipients does not mitigate the increased CPU cost, as it only checks recipient validity after all decryption operations have been performed. This issue affects versions of joserfc through 1.7.4 and has been patched in 1.7.5.
Users can upgrade to joserfc version 1.7.5 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/authlib/joserfc/security/advisories/GHSA-jpxq-7h8p-2q76 | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/authlib/joserfc/commit/d6dc8df6c7609277e741069d3733e43996c1cd17 | [email protected] | Source CodeVendor |
| https://github.com/authlib/joserfc/releases/tag/1.7.5 | [email protected] | Release NotesVendor |
| https://github.com/authlib/joserfc/security/advisories/GHSA-jpxq-7h8p-2q76 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| authlib joserfc | 1.7.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | [email protected] |