PT-2026-22699 · Pypi · Joserfc

Jaynornj + 1 · Publicado 2026-03-02 · Atualizado 2026-06-03 · CVE-2026-27932

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions joserfc versions 1.6.2 and earlier

Description joserfc is a Python library implementing JSON Object Signing and Encryption (JOSE) standards. A resource exhaustion issue in joserfc can lead to a Denial of Service (DoS) through CPU exhaustion. When decrypting a JSON Web Encryption (JWE) token using Password-Based Encryption (PBES2) algorithms, the library reads the p2c (PBES2 Count) parameter from the token’s protected header without validation. An attacker can specify a large iteration count, forcing the server to expend significant CPU resources during token processing. This occurs at the JWA layer and affects all high-level JWE and JWT decryption interfaces if PBES2 algorithms are permitted by the application’s policy.

Recommendations Versions prior to 1.6.3 should be updated.

Exploit

Correção

DoS

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

CVE-2026-27932

GHSA-W5R5-M38G-F9F9

OPENSUSE-SU-2026:10293-1

OPENSUSE-SU-2026:20322-1

Produtos afetados

Joserfc

Referências · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27932.json · Exploit
• https://github.com/authlib/joserfc/commit/696a9611ab982c45ee2190ed79ca8e1d8e09398f · Correção
• https://github.com/authlib/joserfc/security/advisories/GHSA-w5r5-m38g-f9f9 · Aviso do Fabricante
• https://github.com/authlib/joserfc · Nota
• https://github.com/authlib/joserfc/commit/696a961 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2026:10293-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-27932 · Aviso do Fabricante
• https://t.me/CVEtracker/46259 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2028974430316097868 · Publicação no Twitter
• https://bugzilla.suse.com/1259154 · Nota
• https://reddit.com/r/VulnMatter/comments/1rj3cki/resumen_diario_de_vulnerabilidades_02032026 · Publicação no Reddit
• https://osv.dev/vulnerability/openSUSE-SU-2026:20322-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-27932 · Aviso do Fabricante
• https://twitter.com/infoflowcloud/status/2028975228773171434 · Publicação no Twitter
• https://security-tracker.debian.org/tracker/CVE-2026-27932 · Aviso do Fabricante