CVE-2026-119283

A flaw was found in joserfc. When decrypting a JSON Web Encryption JWE object, the library fails to limit the number of recipient entries processed in a single request. A remote, unauthenticated attacker can exploit this flaw by sending a crafted JWE token with an arbitrarily large recipients...

PT-2026-132841

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.5, joserfc.jwe.decrypt json accepts a JWE General JSON Serialization recipients array without a count limit and calls decrypt cek for every entry. An...