PT-2026-22699 · Pypi · Joserfc

Jaynornj + 1 · Published 2026-03-02 · Updated 2026-06-03 · CVE-2026-27932

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions joserfc versions 1.6.2 and earlier

Description joserfc is a Python library implementing JSON Object Signing and Encryption (JOSE) standards. A resource exhaustion issue in joserfc can lead to a Denial of Service (DoS) through CPU exhaustion. When decrypting a JSON Web Encryption (JWE) token using Password-Based Encryption (PBES2) algorithms, the library reads the p2c (PBES2 Count) parameter from the token’s protected header without validation. An attacker can specify a large iteration count, forcing the server to expend significant CPU resources during token processing. This occurs at the JWA layer and affects all high-level JWE and JWT decryption interfaces if PBES2 algorithms are permitted by the application’s policy.

Recommendations Versions prior to 1.6.3 should be updated.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-27932

GHSA-W5R5-M38G-F9F9

OPENSUSE-SU-2026:10293-1

OPENSUSE-SU-2026:20322-1

Affected Products

Joserfc

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27932.json · Exploit
• https://github.com/authlib/joserfc/commit/696a9611ab982c45ee2190ed79ca8e1d8e09398f · Patch
• https://github.com/authlib/joserfc/security/advisories/GHSA-w5r5-m38g-f9f9 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10293-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27932 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20322-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-27932 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-27932 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2026-27932 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-27932 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-27932 · Security Note
• https://ubuntu.com/security/CVE-2026-27932 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27932 · Security Note
• https://osv.dev/vulnerability/GHSA-w5r5-m38g-f9f9 · Vendor Advisory
• https://github.com/authlib/joserfc · Note