ZDF
Sign inSign up

Vulnerabilities

Security incident · CVE-2026-119283

joserfc: Unbounded JWE General JSON Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption

Published Oct 30, 2026 · catalog updated Oct 30, 2026 · joserfc: Unbounded JWE General

Last checked Nov 5, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-119283. EPSS is 0.23%. Act only if a listed version of joserfc: Unbounded JWE General is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (joserfc: Unbounded JWE General).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High7.5
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.23%
Remediation
Advisory link
Affected products
PyPI joserfc · pypi joserfc

### Summary , the library's public parser for JWE General JSON Serialization, accepts an attacker-controlled array of unbounded length and performs one full private-key decryption operation ( ) for **every** recipient present in the input, with no cap on recipient count. An unauthenticated network attacker who can send a JWE General JSON document to any endpoint that decrypts it with an RSA key (e.g. RSA-OAEP) can force the victim to perform an arbitrary, attacker-chosen number of RSA private-key decryption operations from a single, relatively small HTTP request. This gives the attacker a highly asymmetric CPU-exhaustion (Denial of Service) primitive: local reproduction shows request size growing linearly with recipient count (~396 bytes/recipient) while server-side CPU time grows in lock-step (near 1:1 ratio between recipient-count growth and decrypt-time growth), and the library's only documented mitigation knob, , does **not** reduce the CPU cost, since the decrypt loop attempts every recipient's unconditionally before that flag is ever consulted. This is CWE-400 (Uncontrolled Resource Consumption) with CVSS v3.1 Base Score 7.5 (High). ### Details validates and caps several structural elements of a JWE (protected header size, encrypted key size, IV size, ciphertext size, and auth-tag size) inside , but performs **no validation whatsoever on the number of entries in the array** of a JWE General JSON Serialization object. Data flow (source → sink), verified directly against the repository source at commit (joserfc 1.7.4): 1. — public parser entry point . This is a documented, unauthenticated (at the library boundary) API for parsing externally supplied JWE JSON. 2. — if is present in the input dict, is invoked. 3. — iterates and appends a object for every entry, with **no upper bound check** on : 4. — the private key is attached to every extracted recipient. 5. — loops over **every** recipient in and calls for each one, regardless of how many there are: 6. — for RS

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • PyPI joserfc0 → 1.7.5
  • pypi joserfcversion unspecified

How to fix CVE-2026-119283

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-119283. EPSS is 0.23%. Act only if a listed version of joserfc: Unbounded JWE General is installed.

Which versions are affected?

Compare what you have installed with 0 → 1.7.5. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-400: Uncontrolled Resource Consumption. EPSS 0.23%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 30, 2026 · PyPA Advisory Database

    Detected

    ### Summary , the library's public parser for JWE General JSON Serialization, accepts an attacker-controlled array of unbounded length and performs one full private-key decryption operation ( ) for **every** recipient present in the input, with no cap on recipient count. An unauthenticated network attacker who can send a JWE General JSON document to any endpoint that decrypts it with an RSA key (e

  2. Oct 30, 2026 · PyPA Advisory Database

    Fix available

    joserfc fixed in 1.7.5

  3. Oct 30, 2026 · PyPA Advisory Database

    Fix available

    joserfc fixed in 1.7.5

  4. Oct 30, 2026 · PyPA Advisory Database

    Updated

    ### Summary , the library's public parser for JWE General JSON Serialization, accepts an attacker-controlled array of unbounded length and performs one full private-key decryption operation ( ) for **every** recipient present in the input, with no cap on recipient count. An unauthenticated network attacker who can send a JWE General JSON document to any endpoint that decrypts it with an RSA key (e

Sources

  • CVE.orgVulnerability recordCVE-2026-119283

    Official CVE identifier

    cve.org
  • GitLab Advisory DatabasePackage advisoryCVE-2026-119283

    joserfc.jwe.decrypt_json(), the library's public parser for JWE General JSON Serialization, accepts an attacker-controlled recipients array of unbounded length and performs one full private-key decryption operation (decrypt_cek) for every recipient present in the input, with no cap on recipient count. An unauthenticated network attacker who can send a JWE General JSON document to any endpoint that

    advisories.gitlab.com
  • PyPA Advisory DatabasePackage advisoryGHSA-jpxq-7h8p-2q76

    joserfc: Unbounded JWE General JSON Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption

    osv.dev

References

Freshness

Last verified in this catalog Nov 5, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • GitLab Advisory DatabaseNov 3, 2026
  • PyPA Advisory DatabaseNov 2, 2026
  • CVE.orgOct 30, 2026