joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption

Summary joserfc.jwe.decryptjson, the library's public parser for JWE General JSON Serialization, accepts an attacker-controlled recipients array of unbounded length and performs one full private-key decryption operation decryptcek for every recipient present in the input, with no cap on recipient...

GHSA-JPXQ-7H8P-2Q76 joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption

Summary joserfc.jwe.decryptjson, the library's public parser for JWE General JSON Serialization, accepts an attacker-controlled recipients array of unbounded length and performs one full private-key decryption operation decryptcek for every recipient present in the input, with no cap on recipient...

CVE-2026-119283 joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.5, joserfc.jwe.decryptjson accepts a JWE General JSON Serialization recipients array without a count limit and calls decryptcek for every entry. An unauthenticate...