CVE-2026-119283

Name of the Vulnerable Software and Affected Versions joserfc versions prior to 1.7.5

Description The decrypt json() function in the joserfc.jwe module processes a JWE General JSON Serialization recipients array without a count limit, calling decrypt cek() for every entry. An unauthenticated attacker can submit a JWE to an endpoint using an RSA key-management algorithm to control the number of private-key decryption operations performed in a single request. Because the loop processes every recipient before checking the verify all recipients option, repeated requests can exhaust the service CPU. This issue affects availability but does not compromise confidentiality or integrity.

Recommendations Update to version 1.7.5.