CVE-2026-119283

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-119283", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-29T18:50:28.064Z", "datePublished": "2026-10-29T21:10:05.490Z", "dateUpdated": "2026-10-30T17:08:26.483Z"}, "containers": {"cna": {"title": "joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/authlib/joserfc/security/advisories/GHSA-jpxq-7h8p-2q76", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/authlib/joserfc/security/advisories/GHSA-jpxq-7h8p-2q76"}, {"name": "https://github.com/authlib/joserfc/commit/d6dc8df6c7609277e741069d3733e43996c1cd17", "tags": ["x_refsource_MISC"], "url": "https://github.com/authlib/joserfc/commit/d6dc8df6c7609277e741069d3733e43996c1cd17"}, {"name": "https://github.com/authlib/joserfc/releases/tag/1.7.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/authlib/joserfc/releases/tag/1.7.5"}], "affected": [{"vendor": "authlib", "product": "joserfc", "versions": [{"version": "< 1.7.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-29T21:10:05.490Z"}, "descriptions": [{"lang": "en", "value": "joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.5, joserfc.jwe.decrypt_json() accepts a JWE General JSON Serialization recipients array without a count limit and calls decrypt_cek() for every entry. An unauthenticated attacker who can submit a JWE to an endpoint using an RSA key-management algorithm can choose the number of private-key decryption operations performed by one request. The verify_all_recipients option does not reduce this work because the affected loop processes every recipient before consulting that setting, allowing repeated requests to exhaust service CPU without affecting confidentiality or integrity. This issue is fixed in version 1.7.5."}], "source": {"advisory": "GHSA-jpxq-7h8p-2q76", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/authlib/joserfc/security/advisories/GHSA-jpxq-7h8p-2q76", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-30T17:08:00.789446Z", "id": "CVE-2026-119283", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T17:08:26.483Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-119283", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-30T17:08:00.789446Z"}}}], "references": [{"url": "https://github.com/authlib/joserfc/security/advisories/GHSA-jpxq-7h8p-2q76", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T17:08:21.039Z"}}], "cna": {"title": "joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption", "source": {"advisory": "GHSA-jpxq-7h8p-2q76", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "authlib", "product": "joserfc", "versions": [{"status": "affected", "version": "< 1.7.5"}]}], "references": [{"url": "https://github.com/authlib/joserfc/security/advisories/GHSA-jpxq-7h8p-2q76", "name": "https://github.com/authlib/joserfc/security/advisories/GHSA-jpxq-7h8p-2q76", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/authlib/joserfc/commit/d6dc8df6c7609277e741069d3733e43996c1cd17", "name": "https://github.com/authlib/joserfc/commit/d6dc8df6c7609277e741069d3733e43996c1cd17", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/authlib/joserfc/releases/tag/1.7.5", "name": "https://github.com/authlib/joserfc/releases/tag/1.7.5", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.5, joserfc.jwe.decrypt_json() accepts a JWE General JSON Serialization recipients array without a count limit and calls decrypt_cek() for every entry. An unauthenticated attacker who can submit a JWE to an endpoint using an RSA key-management algorithm can choose the number of private-key decryption operations performed by one request. The verify_all_recipients option does not reduce this work because the affected loop processes every recipient before consulting that setting, allowing repeated requests to exhaust service CPU without affecting confidentiality or integrity. This issue is fixed in version 1.7.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-29T21:10:05.490Z"}}}, "cveMetadata": {"cveId": "CVE-2026-119283", "state": "PUBLISHED", "dateUpdated": "2026-10-30T17:08:26.483Z", "dateReserved": "2026-10-29T18:50:28.064Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-29T21:10:05.490Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "joserfc", "vendor": "authlib", "versions": [{"status": "affected", "version": "< 1.7.5"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.5, joserfc.jwe.decrypt_json() accepts a JWE General JSON Serialization recipients array without a count limit and calls decrypt_cek() for every entry. An unauthenticated attacker who can submit a JWE to an endpoint using an RSA key-management algorithm can choose the number of private-key decryption operations performed by one request. The verify_all_recipients option does not reduce this work because the affected loop processes every recipient before consulting that setting, allowing repeated requests to exhaust service CPU without affecting confidentiality or integrity. This issue is fixed in version 1.7.5."}], "id": "CVE-2026-119283", "lastModified": "2026-10-30T17:17:17.740", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-119283", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-30T17:08:00.789446Z", "version": "2.0.3"}}]}, "published": "2026-10-29T22:17:01.047", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/authlib/joserfc/commit/d6dc8df6c7609277e741069d3733e43996c1cd17"}, {"source": "security-advisories@github.com", "url": "https://github.com/authlib/joserfc/releases/tag/1.7.5"}, {"source": "security-advisories@github.com", "url": "https://github.com/authlib/joserfc/security/advisories/GHSA-jpxq-7h8p-2q76"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/authlib/joserfc/security/advisories/GHSA-jpxq-7h8p-2q76"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "joserfc: joserfc: Denial of Service via unbounded recipient processing during JWE decryption", "id": "2563713", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563713"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-606", "details": ["A flaw was found in joserfc. When decrypting a JSON Web Encryption (JWE) object, the library fails to limit the number of recipient entries processed in a single request. A remote, unauthenticated attacker can exploit this flaw by sending a crafted JWE token with an arbitrarily large recipients array, forcing the server to perform numerous intensive cryptographic operations. This can exhaust system CPU resources, leading to a Denial of Service (DoS)."], "name": "CVE-2026-119283", "package_state": [{"cpe": "cpe:/a:redhat:exploit_intelligence:0", "fix_state": "Affected", "package_name": "exploit-intelligence/vulnerability-analysis-rhel9", "product_name": "Exploit Intelligence"}, {"cpe": "cpe:/a:redhat:lightspeed_core", "fix_state": "Affected", "package_name": "lightspeed-core/lightspeed-stack-rhel9", "product_name": "Lightspeed Core"}, {"cpe": "cpe:/a:redhat:migration_toolkit_applications:8", "fix_state": "Affected", "package_name": "mta/mta-solution-server-rhel9", "product_name": "Migration Toolkit for Applications 8"}, {"cpe": "cpe:/a:redhat:openshift_lightspeed:1", "fix_state": "Affected", "package_name": "openshift-lightspeed/lightspeed-agentic-sandbox-rhel9", "product_name": "OpenShift Lightspeed"}, {"cpe": "cpe:/a:redhat:openshift_lightspeed:2", "fix_state": "Affected", "package_name": "openshift-lightspeed/lightspeed-agentic-sandbox-rhel9", "product_name": "OpenShift Lightspeed"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-26/lightspeed-chatbot-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-27/lightspeed-chatbot-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:rhel_cla:1", "fix_state": "Affected", "package_name": "rhel-cla/rhel-knowledge-bridge-rhel10", "product_name": "Red Hat Enterprise Linux command line assistant"}, {"cpe": "cpe:/a:redhat:container_native_virtualization:4", "fix_state": "Affected", "package_name": "container-native-virtualization/ocp-virt-validation-checkup-rhel9", "product_name": "Red Hat OpenShift Virtualization 4"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Affected", "package_name": "satellite/foreman-mcp-server-rhel9", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-10-29T21:10:05Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-119283\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-119283\nhttps://github.com/authlib/joserfc/commit/d6dc8df6c7609277e741069d3733e43996c1cd17\nhttps://github.com/authlib/joserfc/releases/tag/1.7.5\nhttps://github.com/authlib/joserfc/security/advisories/GHSA-jpxq-7h8p-2q76"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.7.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "joserfc", "source": "cna", "vendor": "authlib"}, "product": "joserfc", "vendor": "authlib"}], "created": "2026-10-29T22:15:03.617918+00:00", "updated": "2026-10-30T14:00:17.113375+00:00", "vendors": ["authlib", "authlib$PRODUCT$joserfc"]}