CVE-2026-119283

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.5, joserfc.jwe.decrypt_json() accepts a JWE General JSON Serialization recipients array without a count limit and calls decrypt_cek() for every entry. An unauthenticated attacker who can submit a JWE to an endpoint using an RSA key-management algorithm can choose the number of private-key decryption operations performed by one request. The verify_all_recipients option does not reduce this work because the affected loop processes every recipient before consulting that setting, allowing repeated requests to exhaust service CPU without affecting confidentiality or integrity. This issue is fixed in version 1.7.5.

• CWE-400

• https://github.com/authlib/joserfc/commit/d6dc8df6c7609277e741069d3733e43996c1cd17
• https://github.com/authlib/joserfc/releases/tag/1.7.5
• https://github.com/authlib/joserfc/security/advisories/GHSA-jpxq-7h8p-2q76
• https://github.com/authlib/joserfc/security/advisories/GHSA-jpxq-7h8p-2q76

Published

Oct 29, 2026

Last Modified

Oct 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-119278MariaDB Connector/J is used to connect applications develope…5.9
• CVE-2026-119279MariaDB Connector/J is used to connect applications develope…5.9
• CVE-2026-11928IBM Verify Identity Access is vulnerable to a buffer overflo…9.8
• CVE-2026-119280MariaDB Connector/J is used to connect applications develope…3.7
• CVE-2026-119281MariaDB Connector/J is used to connect applications develope…5.9
• CVE-2026-119282Nx is a monorepo solution for TypeScript and polyglot codeba…7.3
• CVE-2026-119284joserfc is a Python library that provides an implementation …6.9
• CVE-2026-119285Fiber is an Express inspired web framework written in Go. Fr…5.9
• CVE-2026-119286GraphQL-core is a Python port of the GraphQL.js reference im…7.5
• CVE-2026-119287Zuke is a code-first, strongly typed build automation system…8
• CVE-2026-119288Zuke is a code-first, strongly typed build automation system…7
• CVE-2026-119289Zuke is a code-first, strongly typed build automation system…7.1