Source: python-jwcrypto X-Debbugs-CC: [email protected] Severity: important Tags: security
Hi, The following vulnerability was published for python-jwcrypto. CVE-2026-92091[0]: | A flaw was found in jwcrypto. The JWK.import_key() function | validates the key_ops JWK member for duplicate values using an | algorithm with O(n^2) time complexity, and the length of key_ops is | not bounded. A remote, unauthenticated attacker can supply a JWK | with a large key_ops array to an application that passes attacker- | controlled key material to a public key-import API (reachable via | ECDH-ES key agreement, OIDC dynamic client registration, DPoP, or | ACME account key registration, among others) to consume excessive | CPU time, resulting in a denial of service. https://github.com/latchset/jwcrypto/security/advisories/GHSA-pwgw-f7xr-863h https://github.com/latchset/jwcrypto/pull/398 https://github.com/latchset/jwcrypto/commit/21d2a2c20dbc1201ebe0b9b2621417629f37bfcd (v1.6.1) If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-92091 https://www.cve.org/CVERecord?id=CVE-2026-92091 Please adjust the affected versions in the BTS as needed.
