CVE-2026-92091

Summary

A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(n^2) time complexity, and the length of key_ops is not bounded. A remote, unauthenticated attacker can supply a JWK with a large key_ops array to an application that passes attacker-controlled key material to a public key-import API (reachable via ECDH-ES key agreement, OIDC dynamic client registration, DPoP, or ACME account key registration, among others) to consume excessive CPU time, resulting in a denial of service.

Affected Software

Weaknesses

• CWE-407: Inefficient Algorithmic Complexity

Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

Additional References

• https://github.com/latchset/jwcrypto/security/advisories/GHSA-pwgw-f7xr-863h

References

• https://access.redhat.com/security/cve/CVE-2026-92091
• https://bugzilla.redhat.com/show_bug.cgi?id=2533849
• https://github.com/latchset/jwcrypto/security/advisories/GHSA-pwgw-f7xr-863h

• ←Previous
• Next→