CVE-2026-53938: CWE-122: Heap-based Buffer Overflow in OpenIDC cjose

OpenIDC/cjose is a C library implementing JOSE. Prior to version 0.6.2.5, the JWE decryption path for AES Key Wrap algorithms (`A128KW`, `A192KW`, `A256KW`) does not validate the length of the attacker-supplied `encrypted_key` before unwrapping it into a fixed-size heap buffer, leading to a heap-based buffer overflow (CWE-122). This can cause heap corruption and denial of service, with potential for further memory corruption depending on heap layout. The vulnerable functions are `cjose_jwe_import()` and `cjose_jwe_decrypt()`, which process attacker-controlled input without authentication. Separately, versions 0.6.1 through 0.6.2.5 have a vulnerability in JWE encryption using AES-CBC-HMAC content encryption algorithms (`A128CBC-HS256`, `A192CBC-HS384`, `A256CBC-HS512`) combined with key-management algorithms that generate fresh CEKs: the CEK is set to all zero bytes instead of being randomly generated. This results in ciphertexts encrypted under a fixed, publicly known key, allowing plaintext recovery and forgery. This second issue is fixed in version 0.6.2.6 by generating the CEK from a cryptographically secure random source. Mitigations include upgrading to 0.6.2.5 for the first issue and 0.6.2.6 for the second, rejecting AES Key Wrap algorithms for untrusted JWEs if upgrade is not possible, or using alternative encryption algorithms such as AES-GCM or `alg=dir` with caller-supplied CEK.

The heap-based buffer overflow can be triggered remotely by unauthenticated attackers submitting crafted JWEs, leading to heap corruption and denial of service. Depending on heap allocator and layout, it may be exploitable for further memory corruption. The encryption flaw causes JWEs encrypted with AES-CBC-HMAC algorithms to use a fixed all-zero CEK, allowing attackers to decrypt and forge ciphertexts, compromising confidentiality and integrity of encrypted data. Data encrypted with the affected versions and algorithms is compromised and should be re-encrypted with secure keys.

Upgrade to cjose version 0.6.2.5 or later to fix the heap-based buffer overflow vulnerability. For the encryption key issue, upgrade to version 0.6.2.6 or later. If immediate upgrade is not possible, reject AES Key Wrap algorithms (`A128KW`, `A192KW`, `A256KW`) for untrusted JWEs at the application layer to mitigate the buffer overflow risk. For new ciphertexts, avoid AES-CBC-HMAC content encryption algorithms or use AES-GCM variants (`A128GCM`, `A192GCM`, `A256GCM`), or use `alg=dir` with a caller-supplied CEK. Data already encrypted with the zero-key CEK should be re-encrypted and any secrets rotated. No other mitigations are indicated by the vendor advisory.