CVE-2026-27932 - Vulnerability Analysis

Overview

joserfc <= 1.6.2 contains a resource exhaustion vulnerability caused by unbounded p2c parameter in PBES2 during JWE decryption, letting unauthenticated attackers cause denial of service via CPU exhaustion, exploit requires crafted JWE token with large iteration count.

Severity & Score

Impact

Unauthenticated attackers can cause denial of service by exhausting CPU resources during token decryption.

Mitigation

Update to the latest version of joserfc that validates and bounds the p2c parameter.

References

• https://github.com/authlib/joserfc/commit/696a9611ab982c45ee2190ed79ca8e1d8e09398f
• https://github.com/authlib/joserfc/security/advisories/GHSA-w5r5-m38g-f9f9

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 4, 2026

🟠 CVE-2026-27932 - High (7.5) joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In 1.6.2 and earlier, a resource exhaustion vulnerability in joserfc allows an unauthenticated attacker to cause a Denial o... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27932/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner