Python Library Vulnerability in joserfc Affects Security Implementations

CVE-2026-119283

What is CVE-2026-119283?

The joserfc library, a Python implementation of JSON Object Signing and Encryption (JOSE) standards, is susceptible to a denial-of-service attack. Before version 1.7.5, an unauthenticated attacker could exploit the jwe.decrypt_json() method, which processes an unbounded number of recipients in a JWE submission. This flaw allowed attackers to initiate multiple private-key decryption operations in a single request, potentially overwhelming the service's CPU resources with repeated operations. The 'verify_all_recipients' option did not mitigate this issue, as it was only checked after the resource-intensive loop had executed. The vulnerability was addressed in version 1.7.5, encouraging users to upgrade promptly.

References