CVE-2026-89320

The gose library is vulnerable because the HmacShaCryptor.Hash function fails to hash its input, consistently returning HMAC_K("") (the MAC of an empty message). This flaw causes all AES-CBC-HMAC JWE tokens produced or verified by the library to carry an authentication tag that is constant for a ...

CVE-2026-89320 HmacShaCryptor.Hash never hashes its input — returns constant HMAC_K("") for all inputs, voiding CBC-HMAC JWE integrity

HmacShaCryptor.Hash never hashed its input. For any input it returned HMACK"" — the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verified by gose therefore carried an authentication tag that is constant per key and independent of the message, removing ciphertext...

EUVD-2026-108654

HmacShaCryptor.Hash never hashed its input. For any input it returned HMACK"" — the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verified by gose therefore carried an authentication tag that is constant per key and independent of the message, removing ciphertext...

Critical: Red Hat Security Advisory: cjose security update

An update for cjose is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Rocky Linux 10.2 [CIQ] Security Update: cjose / cjose-debuginfo / cjose-debugsource / cjose-devel (crlsa-2026_80605)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202680605 advisory. cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption CVE-2026-53939 Tenable has extracted the preceding description block...

Critical: Red Hat Security Advisory: cjose security update

An update for cjose is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

ALSA-2026:80605 Critical: cjose security update

CJose is C library implementing the Javascript Object Signing and Encryption JOSE. Security Fixes: cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption CVE-2026-53939 For more details about the security issues, including the impact, a CVSS score,...

cjose security update

0.6.2.2-7.2 - Fix CVE-2026-53939 cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption Resolves: RHEL-276901...

openSUSE 16 Security Update : cjose (openSUSE-SU-2026:21944-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21944-1 advisory. - CVE-2026-53938: missing encryptedkey length validation during AES Key Wrap decryption can cause heap- based buffer overflow bsc1279844. -...

SUSE-SU-2026:23910-1 Security update for cjose

This update for cjose fixes the following issues: - CVE-2026-53938: missing encryptedkey length validation during AES Key Wrap decryption can cause heap-based buffer overflow bsc1279844. - CVE-2026-53939: zero-filled content-encryption key generation in AES-CBC-HMAC JWE encryption within cjose ca...

OPENSUSE-SU-2026:21944-1 Security update for cjose

This update for cjose fixes the following issues: - CVE-2026-53938: missing encryptedkey length validation during AES Key Wrap decryption can cause heap-based buffer overflow bsc1279844. - CVE-2026-53939: zero-filled content-encryption key generation in AES-CBC-HMAC JWE encryption within cjose ca...