SZB-df71a1a1bd
CVE-2026-119283 disclosed in joserfc JWE decryption (CVSS 7.5)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- joserfc
- Product
- joserfc
- First seen
Summary
A Mastodon post citing TheHackerWire reports that joserfc versions before 1.7.5 have a flaw in decrypt_json(). The post says the function accepts a JWE JSON serialization recipients array with no count limit, and it rates the issue High at 7.5.
If you use joserfc
Upgrade joserfc to version 1.7.5 or later.
Find services that call joserfc.jwe.decrypt_json() and confirm they are patched.
Check the NVD or vendor advisory for full details before relying on this summary.
What the sources say 1
· Mastodon: “Prior to 1.7.5, joserfc.jwe.decrypt_json() accepts a JWE General JSON Serialization recipients array without a count limit” Source