CVE-2026-53938

A flaw was found in cjose, a C library for Javascript Object Signing and Encryption (JOSE). A remote, unauthenticated attacker can exploit a heap buffer overflow vulnerability in the AES Key Wrap decryption process. By submitting a crafted Javascript Web Encryption (JWE) to an application, the attacker can trigger an out-of-bounds heap write. This can corrupt the heap, leading to a denial of service and potentially further memory corruption.

This vulnerability is rated as an Important severity flaw because an unauthenticated remote attacker can exploit it to induce an application crash or corrupt heap memory without requiring user interaction. In Red Hat Enterprise Linux, cjose is shipped primarily as an underlying dependency for OpenID Connect authentication modules, including mod_auth_openidc. Exposure is limited to environments where applications process untrusted encrypted tokens and utilize symmetric AES Key Wrap algorithms for decryption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Applications using cjose should be configured to reject JWEs that specify the AES Key Wrap key-management algorithms (A128KW, A192KW, A256KW) when processing untrusted input. This application-layer rejection prevents the vulnerable decryption path from being exercised.