{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/joserfc/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["joserfc (\u003c 1.7.5)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","cwe-400","joserfc","python","cryptography"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe joserfc library version 1.7.4 and earlier is vulnerable to a CPU exhaustion Denial of Service (DoS) attack. The library's \u003ccode\u003edecrypt_json()\u003c/code\u003e function parses JWE General JSON Serialization objects without enforcing an upper bound on the number of entries in the \u003ccode\u003erecipients\u003c/code\u003e array. An attacker can craft a JWE payload with a large number of RSA-OAEP recipients, forcing the vulnerable application to perform an RSA private-key decryption operation for every recipient present. This behavior occurs unconditionally, even if \u003ccode\u003everify_all_recipients=False\u003c/code\u003e is set, leading to high CPU usage relative to the size of the submitted request.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker generates a valid JWE General JSON object using the victim's public RSA key.\u003c/li\u003e\n\u003cli\u003eAttacker adds an arbitrary, large number of recipients to the JWE \u003ccode\u003erecipients\u003c/code\u003e array.\u003c/li\u003e\n\u003cli\u003eAttacker sends the crafted JSON object to a target endpoint that uses \u003ccode\u003ejoserfc.jwe.decrypt_json()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003ejoserfc\u003c/code\u003e parser iterates through the full \u003ccode\u003erecipients\u003c/code\u003e array without checking the count.\u003c/li\u003e\n\u003cli\u003eThe library unconditionally invokes \u003ccode\u003edecrypt_recipient()\u003c/code\u003e for each entry in the list.\u003c/li\u003e\n\u003cli\u003eFor each recipient, the library performs a computationally expensive RSA private-key decryption operation.\u003c/li\u003e\n\u003cli\u003eHigh CPU usage is sustained for the duration of these operations, resulting in service degradation or availability loss.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a Denial of Service (DoS) via resource exhaustion. The vulnerability is highly asymmetric, where relatively small malicious HTTP requests induce disproportionately high CPU load on the victim's server. No confidentiality or integrity impact was observed.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpgrade \u003ccode\u003ejoserfc\u003c/code\u003e to version 1.7.5 or later. If upgrading is not immediately possible, implement a request-size limit at the Web Application Firewall (WAF) or application gateway level that corresponds to a reasonable number of recipients to mitigate the attack surface until the library is patched.\u003c/p\u003e\n","date_modified":"2026-11-12T03:54:36Z","date_published":"2026-11-12T03:54:36Z","id":"https://feed.craftedsignal.io/briefs/2026-11-joserfc-cpu-exhaustion-ghsa-jpxq-7h8p-2q76/","summary":"An unauthenticated remote attacker can cause a denial-of-service by submitting a specially crafted JWE General JSON object containing an unbounded number of recipients, forcing the server to perform an excessive number of expensive RSA private-key decryption operations.","title":"joserfc: CPU exhaustion via unbounded JWE recipients array","url":"https://feed.craftedsignal.io/briefs/2026-11-joserfc-cpu-exhaustion-ghsa-jpxq-7h8p-2q76/"}],"language":"en","title":"CraftedSignal Threat Feed - Joserfc","version":"https://jsonfeed.org/version/1.1"}