CVE-2026-27932

Description

A flaw was found in joserfc, a Python library for JSON Object Signing and Encryption (JOSE) standards. An unauthenticated attacker can cause a Denial of Service (DoS) by exploiting a resource exhaustion vulnerability. This occurs when the library decrypts a JSON Web Encryption (JWE) token using Password-Based Encryption (PBES2) algorithms, as it reads the p2c (PBES2 Count) parameter directly from the token's protected header without validation. An attacker can specify an extremely large iteration count for the PBKDF2 key derivation function, forcing the server to expend massive CPU resources processing a single token, leading to CPU exhaustion and a Denial of Service.

Statement

Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Mitigation

To mitigate this issue, applications utilizing the `joserfc` library for JSON Web Encryption (JWE) decryption should implement validation or a maximum bound for the `p2c` (PBES2 Count) parameter when processing JWE tokens with Password-Based Encryption (PBES2) algorithms. Alternatively, if not required, applications can disable or restrict the use of PBES2 algorithms in their policy to prevent exploitation. Consult application-specific documentation for configuring JWE decryption policies and parameter validation.

Understanding the Weakness (CWE)

CWE-770

Availability

Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)

When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.