CVE-2026-53938

HighCVSS 8.2

Published: 09/09/2026(UTC)Translated: 09/09/2026(UTC)NVD NIST

Summary

The cjose C library implementing JOSE has a vulnerability in the JWE decryption path for AES Key Wrap algorithms (A128KW, A192KW, A256KW) due to lack of validation of the attacker-supplied encrypted_key length before unwrapping into a fixed-size heap buffer. A remote unauthenticated attacker can trigger an out-of-bounds heap write, leading at least to a crash (DoS) and potentially to further memory corruption. The entry points cjose_jwe_import() and cjose_jwe_decrypt() are pre-authentication and process fully attacker-controlled input.

Risk Assessment

The risk includes remote denial of service and potential memory corruption, which could lead to arbitrary code execution in the context of applications using cjose for JWE decryption.

Recommendation

Upgrade cjose to version 0.6.2.5 as soon as possible. If immediate upgrade is not possible, reject AES Key Wrap algorithms (A128KW/A192KW/A256KW) for untrusted JWEs at the application layer.

Other vulnerabilities in cjose

CVE-2026-53939Critical
In cjose versions 0.6.1 through 0.6.2.5, when encrypting a JWE using AES-CBC-HMAC content-encryption algorithms (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) with any key-management algorithm that generates a fresh content-encryption key (CEK), the CEK is all zero bytes instead of being randomly generated. The resulting JWE is encrypted and authenticated under a fixed, publicly known key, allowing anyone who obtains the JWE to recover plaintext and forge or modify content. Fixed in 0.6.2.6 by generating CEK from RAND_bytes.

Original NVD description (English source)

OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). Prior to version 0.6.2.5, cjose's JWE decryption path for the AES Key Wrap key-management algorithms (`alg` = `A128KW`, `A192KW`, `A256KW`) does not validate the length of the attacker-supplied `encrypted_key` (JWE Encrypted Key) before unwrapping it into a fixed-size, heap-allocated Content Encryption Key (CEK) buffer. A remote, unauthenticated attacker who can submit a crafted JWE to an application that decrypts it with an AES-KW symmetric key can trigger an out-of-bounds heap write, corrupting the heap. This leads at minimum to a crash (denial of service) and, depending on the heap layout and allocator, may be leverageable for further memory-corruption impact. `cjose_jwe_import()` / `cjose_jwe_decrypt()` are pre-authentication entry points: they parse and process fully attacker-controlled input. Upgrade to cjose 0.6.2.5 to receive a patch. If upgrading is not immediately possible, reject the AES Key Wrap algorithms (`A128KW`/`A192KW`/`A256KW`) for untrusted JWEs at the application layer.