CVE-2026-92091

Name of the Vulnerable Software and Affected Versions jwcrypto (affected versions not specified)

Description A flaw exists in the JWK.import key() function regarding how it validates the key ops member of a JSON Web Key (JWK). The validation process uses an algorithm with O(n^2) time complexity, and there is no limit on the length of the key ops array. A remote, unauthenticated attacker can provide a JWK containing an excessively large key ops array to a public key-import API. This can be achieved through mechanisms such as ECDH-ES key agreement, OIDC dynamic client registration, DPoP, or ACME account key registration. This leads to excessive CPU consumption, resulting in a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.