CVE-2026-119283

Deferred Deferred - Pending Action

joserfc JWE General JSON Decryption CPU Exhaustion

Publication date: 2026-10-29

Last updated on: 2026-10-29

Assigner: GitHub, Inc.

Description

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.5, joserfc.jwe.decrypt_json() accepts a JWE General JSON Serialization recipients array without a count limit and calls decrypt_cek() for every entry. An unauthenticated attacker who can submit a JWE to an endpoint using an RSA key-management algorithm can choose the number of private-key decryption operations performed by one request. The verify_all_recipients option does not reduce this work because the affected loop processes every recipient before consulting that setting, allowing repeated requests to exhaust service CPU without affecting confidentiality or integrity. This issue is fixed in version 1.7.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-29

Last Modified

2026-10-29

Generated

2026-10-30

AI Q&A

2026-10-30

EPSS Evaluated

N/A

NVD

CVE-2026-119283

EUVD

EUVD-2026-113392

Affected Vendors & Products

Vendor	Product	Version / Range
authlib	joserfc	< 1.7.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

joserfc is a Python library for JOSE standards. Prior to version 1.7.5, the function joserfc.jwe.decrypt_json() processes a JWE General JSON Serialization recipients array without a limit on the number of entries. It calls decrypt_cek() for each recipient, allowing an attacker to submit a JWE with many recipients to force repeated private-key decryption operations. This can exhaust CPU resources without compromising confidentiality or integrity.

Impact Analysis

An unauthenticated attacker could send crafted JWE tokens to a vulnerable service, causing it to perform excessive CPU-intensive decryption operations. This may lead to denial-of-service conditions, degrading service performance or making it unavailable.

Compliance Impact

This vulnerability could impact compliance by causing service disruptions due to denial-of-service, potentially violating availability requirements in GDPR or HIPAA. However, no direct data exposure is mentioned, so confidentiality and integrity breaches are unlikely.

Mitigation Strategies

Upgrade joserfc to version 1.7.5 or later to address the vulnerability.
If upgrading is not immediately possible, consider disabling RSA key-management algorithms in JWE processing until the upgrade is completed.
Monitor network traffic for unusual JWE requests that may indicate exploitation attempts.

Hi! I’m here to help you understand CVE-2026-119283. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70