CVE-2026-27932

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In 1.6.2 and earlier, a resource exhaustion vulnerability in joserfc allows an unauthenticated attacker to cause a Denial of Service (DoS) via CPU exhaustion. When the library decrypts a JSON Web Encryption (JWE) token using Password-Based Encryption (PBES2) algorithms, it reads the p2c (PBES2 Count) parameter directly from the token's protected header. This parameter defines the number of iterations for the PBKDF2 key derivation function. Because joserfc does not validate or bound this value, an attacker can specify an extremely large iteration count (e.g., 2^31 - 1), forcing the server to expend massive CPU resources processing a single token. This vulnerability exists at the JWA layer and impacts all high-level JWE and JWT decryption interfaces if PBES2 algorithms are allowed by the application's policy.

• CWE-770

• https://github.com/authlib/joserfc/commit/696a9611ab982c45ee2190ed79ca8e1d8e09398fPatch
• https://github.com/authlib/joserfc/security/advisories/GHSA-w5r5-m38g-f9f9Exploit, Mitigation, Vendor Advisory

Published

Mar 3, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27927Concurrent execution using shared resource with improper syn…7
• CVE-2026-27928Improper input validation in Windows Hello allows an unautho…8.7
• CVE-2026-27929Time-of-check time-of-use (toctou) race condition in Windows…7
• CVE-2026-2793Memory safety bugs present in Firefox ESR 115.32, Firefox ES…9.8
• CVE-2026-27930Out-of-bounds read in Windows GDI allows an unauthorized att…5.5
• CVE-2026-27931Out-of-bounds read in Windows GDI allows an unauthorized att…5.5
• CVE-2026-27933Manyfold is an open source, self-hosted web application for …6.8
• CVE-2026-27934Discourse is an open-source discussion platform. Versions pr…7.5
• CVE-2026-27935Discourse is an open-source discussion platform. Versions pr…6.5
• CVE-2026-27936Discourse is an open-source discussion platform. Prior to ve…5.3
• CVE-2026-27937October is a Content Management System (CMS) and web platfor…3.1
• CVE-2026-27938WPGraphQL provides a GraphQL API for WordPress sites. Prior …7.7