CVE-2026-92091— Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array

Quick assessment

Copy summary Copy citation

Affected

Red Hat Red Hat Ansible Automation Platform 2

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(n^2) time complexity, and the length of key_ops is not bounded. A remote, unauthenticated attacker can supply a JWK with

CVE-2026-92091 affects Red Hat Red Hat Ansible Automation Platform 2. No confirmed in-the-wild exploitation; assess based on exposure. A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(n^2) time complexity, and the length of CVE-2026-92091 vulnerability details, Shenlong CVE Platform, https://cve.imfht.com/detail/CVE-2026-92091

I. Basic Information for CVE-2026-92091

Affected Products

II. Public POCs for CVE-2026-92091

III. Intelligence Information for CVE-2026-92091

Vendor Advisories for CVE-2026-92091 (1)

• 2533849 – (CVE-2026-92091) CVE-2026-92091 jwcrypto: jwcrypto: denial of service via O(n^2) duplicate check on unbounded JWK key_ops array issue-tracking x_refsource_REDHAT

Other References for CVE-2026-92091 (1)

• Quadratic key_ops duplicate check in JWK.import_key allows CPU-exhaustion DoS · Advisory · latchset/jwcrypto · GitHub

Other References for CVE-2026-92091 (1)

• https://access.redhat.com/security/cve/CVE-2026-92091 vdb-entry x_refsource_REDHAT

• https://www.cve.org/CVERecord?id=CVE-2026-92091

IV. Related Vulnerabilities

V. Comments for CVE-2026-92091