DEBIAN-CVE-2026-119283

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-119283

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-119283.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-119283

Upstream

CVE-2026-119283

Published

2026-10-29T22:17:01Z

Modified

2026-10-30T09:00:07Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

[none]

Details

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.5, joserfc.jwe.decrypt_json() accepts a JWE General JSON Serialization recipients array without a count limit and calls decrypt_cek() for every entry. An unauthenticated attacker who can submit a JWE to an endpoint using an RSA key-management algorithm can choose the number of private-key decryption operations performed by one request. The verify_all_recipients option does not reduce this work because the affected loop processes every recipient before consulting that setting, allowing repeated requests to exhaust service CPU without affecting confidentiality or integrity. This issue is fixed in version 1.7.5.

References

https://security-tracker.debian.org/tracker/CVE-2026-119283

Affected packages

Debian:13 / joserfc

Package

Name: joserfc
Purl: pkg:deb/debian/joserfc?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.1.0-1

1.2.0-1

1.2.2-1

1.3.1-1

1.3.2-1

1.3.4-1

1.4.0-1

1.4.1-1

1.4.3-1

1.5.0-1

1.6.0-1

1.6.1-1

1.6.2-1

1.6.3-1

1.6.4-1

1.6.5-1

1.6.8-1

1.7.0-1

1.7.1-1

1.7.2-1

1.7.3-1

1.7.4-1

1.7.5-1

1.7.7-1

Ecosystem specific

{
    "urgency":  "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-119283.json"

Debian:14 / joserfc