Joserfc (< 1.7.5) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/joserfc--1.7.5/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 03:54:36 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgjoserfc: CPU exhaustion via unbounded JWE recipients arrayhttps://feed.craftedsignal.io/briefs/2026-11-joserfc-cpu-exhaustion-ghsa-jpxq-7h8p-2q76/Thu, 12 Nov 2026 03:54:36 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-joserfc-cpu-exhaustion-ghsa-jpxq-7h8p-2q76/An unauthenticated remote attacker can cause a denial-of-service by submitting a specially crafted JWE General JSON object containing an unbounded number of recipients, forcing the server to perform an excessive number of expensive RSA private-key decryption operations.The joserfc library version 1.7.4 and earlier is vulnerable to a CPU exhaustion Denial of Service (DoS) attack. The library's decrypt_json() function parses JWE General JSON Serialization objects without enforcing an upper bound on the number of entries in the recipients array. An attacker can craft a JWE payload with a large number of RSA-OAEP recipients, forcing the vulnerable application to perform an RSA private-key decryption operation for every recipient present. This behavior occurs unconditionally, even if verify_all_recipients=False is set, leading to high CPU usage relative to the size of the submitted request.

Attack Chain

  1. Attacker generates a valid JWE General JSON object using the victim's public RSA key.
  2. Attacker adds an arbitrary, large number of recipients to the JWE recipients array.
  3. Attacker sends the crafted JSON object to a target endpoint that uses joserfc.jwe.decrypt_json().
  4. joserfc parser iterates through the full recipients array without checking the count.
  5. The library unconditionally invokes decrypt_recipient() for each entry in the list.
  6. For each recipient, the library performs a computationally expensive RSA private-key decryption operation.
  7. High CPU usage is sustained for the duration of these operations, resulting in service degradation or availability loss.

Impact

Successful exploitation results in a Denial of Service (DoS) via resource exhaustion. The vulnerability is highly asymmetric, where relatively small malicious HTTP requests induce disproportionately high CPU load on the victim's server. No confidentiality or integrity impact was observed.

Recommendation

Upgrade joserfc to version 1.7.5 or later. If upgrading is not immediately possible, implement a request-size limit at the Web Application Firewall (WAF) or application gateway level that corresponds to a reasonable number of recipients to mitigate the attack surface until the library is patched.

]]>mediumadvisorydenial-of-servicecwe-400joserfcpythoncryptography