Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-119283— joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption

Quick assessment

Affected
authlib joserfc
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

joserfc 是一个 Python 库，提供了多种 JSON 对象签名与加密（JOSE）标准的实现。在 1.7.5 版本之前，joserfc.jwe.decrypt_json() 函数接受 JWE 通用 JSON 序列化的 recipients（接收方）数组时，未对数组元素数量进行限制，并会对数组中的每一项调用 decrypt_cek()。未认证的攻击者若能够向使用 RSA 密钥管理算法的端点提交 JWE，便可控制单次请求所执行的私钥解密操作次数。verify_all_recipients 选项无法缓解此问题，因

CVSS 7.5 · High

Possible ATT&CK Techniques 1 AI

T1499.003 · Application Exhaustion Flood
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-119283

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption
Source: CVE Program / CVE List V5
Vulnerability Description
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.5, joserfc.jwe.decrypt_json() accepts a JWE General JSON Serialization recipients array without a count limit and calls decrypt_cek() for every entry. An unauthenticated attacker who can submit a JWE to an endpoint using an RSA key-management algorithm can choose the number of private-key decryption operations performed by one request. The verify_all_recipients option does not reduce this work because the affected loop processes every recipient before consulting that setting, allowing repeated requests to exhaust service CPU without affecting confidentiality or integrity. This issue is fixed in version 1.7.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
authlib joserfc < 1.7.5 -

II. Public POCs for CVE-2026-119283

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-119283

请登录查看更多情报信息。

Other References for CVE-2026-119283 (3)

IV. Related Vulnerabilities

Same product: joserfc
Same vendor: authlib
Same weakness: CWE-400