CVE-2026-92091— Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array
Quick assessment
Affected
Red Hat Red Hat Ansible Automation Platform 2
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 jwcrypto 中发现了一个缺陷。 函数使用一种时间复杂度为 O(n²) 的算法来验证 JWK 成员中的重复值，且 的长度没有上限。一个远程的、未认证的 attackers 可以向那些将攻击者可控的密钥材料传递给公钥导入 API 的应用程序提供一个具有较大 数组的 JWK（该 API 可通过 ECDH-ES 密钥协商、OIDC 动态客户端注册、DPoP 或 ACME 账户密钥注册等途径访问），从而消耗过多的 CPU 时间，最终导致拒绝服务（DoS）。
Possible ATT&CK Techniques 1 AI
T1499.001 · OS Exhaustion FloodAffected Version Matrix 35
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2 | any |
affected |
any |
affected | ||
any |
affected | ||
any |
affected | ||
any |
affected | ||
any |
affected | ||
any |
affected | ||
any |
affected | ||
| … +5 more rows | |||
| Red Hat | Red Hat Enterprise Linux 10 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 7 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 8 | any |
affected |
any |
affected | ||
| Red Hat | Red Hat Enterprise Linux 9 | any |
affected |
| Red Hat | Red Hat OpenShift AI (RHOAI) | any |
affected |
any |
affected | ||
| Red Hat | Red Hat OpenStack Platform 16.2 | any |
affected |
any |
affected | ||
any |
affected | ||
any |
affected | ||
any |
affected | ||
any |
affected | ||
any |
affected | ||
any |
affected | ||
| Red Hat | Red Hat OpenStack Platform 17.1 | any |
affected |
any |
affected | ||
any |
affected | ||
any |
affected | ||
any |
affected | ||
any |
affected | ||
any |
affected | ||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92091
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(n^2) time complexity, and the length of key_ops is not bounded. A remote, unauthenticated attacker can supply a JWK with a large key_ops array to an application that passes attacker-controlled key material to a public key-import API (reachable via ECDH-ES key agreement, OIDC dynamic client registration, DPoP, or ACME account key registration, among others) to consume excessive CPU time, resulting in a denial of service.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
算法复杂性
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat OpenShift AI (RHOAI) | - |
cpe:/a:redhat:openshift_ai
|
|
| Red Hat | Red Hat OpenShift AI (RHOAI) | - |
cpe:/a:redhat:openshift_ai
|
|
| Red Hat | Red Hat OpenStack Platform 16.2 | - |
cpe:/a:redhat:openstack:16.2
|
|
| Red Hat | Red Hat OpenStack Platform 16.2 | - |
cpe:/a:redhat:openstack:16.2
|
|
| Red Hat | Red Hat OpenStack Platform 16.2 | - |
cpe:/a:redhat:openstack:16.2
|
|
| Red Hat | Red Hat OpenStack Platform 16.2 | - |
cpe:/a:redhat:openstack:16.2
|
|
| Red Hat | Red Hat OpenStack Platform 16.2 | - |
cpe:/a:redhat:openstack:16.2
|
|
| Red Hat | Red Hat OpenStack Platform 16.2 | - |
cpe:/a:redhat:openstack:16.2
|
|
| Red Hat | Red Hat OpenStack Platform 16.2 | - |
cpe:/a:redhat:openstack:16.2
|
|
| Red Hat | Red Hat OpenStack Platform 16.2 | - |
cpe:/a:redhat:openstack:16.2
|
|
| Red Hat | Red Hat OpenStack Platform 17.1 | - |
cpe:/a:redhat:openstack:17.1
|
|
| Red Hat | Red Hat OpenStack Platform 17.1 | - |
cpe:/a:redhat:openstack:17.1
|
|
II. Public POCs for CVE-2026-92091
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92091
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-92091 (2)
Other References for CVE-2026-92091 (1)
Same Patch Batch · Red Hat · 2026-09-16 · 10 CVEs total
| CVE-2026-74909 | 8.1 HIGH | Keycloak-services: keycloak-services: incomplete fix for cve-2026-15573 allows policy enfo |
| CVE-2026-85469 | 8.0 HIGH | Quay-builder-qemu: quay-builder-qemu: release workflow uses third-party action pinned to m |
| CVE-2026-79651 | 7.5 HIGH | Keycloak-services: keycloak-services: unauthenticated dos via unbounded locale caching |
| CVE-2026-18212 | 7.5 HIGH | Keycloak-services: keycloak-services: saml redirect deflate helpers leak native zlib state |
| CVE-2026-42784 | 7.4 HIGH | Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusio |
| CVE-2026-17526 | 7.2 HIGH | Keycloak-services: keycloak-services: privilege escalation via impersonation role allows t |
| CVE-2026-92615 | 6.6 MEDIUM | Flightctl: flightctl: package-global go-git https transport mutated per-repo -- cross-tena |
| CVE-2026-92358 | 6.4 MEDIUM | Keycloak-services: keycloak-services: residual cross-browser account-link proof allows sil |
| CVE-2026-19607 | 5.3 MEDIUM | Keycloak-services: keycloak-services: broker-originated username collision causes account |
IV. Related Vulnerabilities
Same product: Red Hat Ansible Automation Platform 2
-
CVE-2026-109131
Ansible-ui: ansible-ui: stored xss via unsafe javascript url -
CVE-2026-103869
Pulp-ansible: bearer tokens are reused across remotes in a w -
CVE-2026-103868
Pulp-container: registry credentials are reused across remot -
CVE-2026-106033
Ansible: ansible-ui: ansible ui dom xss in /redirect next pa -
CVE-2026-103754
Ansible-runner: ansible-runner: path traversal and symlink e
Same vendor: Red Hat
-
CVE-2026-119842
Gst-plugins-base: gst-plugins-base: null-pointer dereference -
CVE-2026-119727
Gst-plugins-bad: gst-plugins-bad: h.265 sps scc palette pred -
CVE-2026-119729
Gst-plugins-base: gst-plugins-bad: gst-plugins-base/gst-plug -
CVE-2026-119728
Gst-plugins-bad: gst-plugins-bad: null pointer dereference i -
CVE-2026-119777
Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: st
Same weakness: CWE-407
-
CVE-2026-87768
DateTime::Lite versions before 0.8.1 for Perl allow CPU exha -
CVE-2026-119197
pyasn1: Quadratic-complexity denial of service in binary REA -
CVE-2026-119196
pyasn1: Quadratic CPU consumption in constructed BIT STRING -
CVE-2026-119195
pyasn1: Quadratic-time denial of service in constructed stri -
CVE-2026-119194
pyasn1: Quadratic CPU use in schemaless BER/CER/DER containe