Resource Exhaustion Vulnerability in joserfc Python Library

CVE-2026-27932

What is CVE-2026-27932?

The joserfc Python library, which implements various JSON Object Signing and Encryption standards, is susceptible to a resource exhaustion vulnerability. In versions 1.6.2 and earlier, an unauthenticated attacker can exploit this issue by sending a specially crafted JSON Web Encryption (JWE) token that specifies a large PBES2 Count parameter. This unbounded value leads to excessive CPU resource usage, resulting in a Denial of Service (DoS) condition. The vulnerability affects all high-level JWE and JWT decryption interfaces within the library if the application's policy permits the use of PBES2 algorithms, making it essential for developers to implement proper validation and limits on input parameters.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References