The vulnerability exists in the jwcrypto library's JWK.import_key() function, which validates the key_ops member for duplicates using an algorithm with quadratic time complexity (O(n^2)). Because the length of key_ops is unbounded, an attacker can craft a JWK with a very large key_ops array. When such a key is processed by applications that use jwcrypto for public key import APIs (such as ECDH-ES key agreement, OIDC dynamic client registration, DPoP, or ACME account key registration), it can cause excessive CPU resource consumption, leading to denial of service. The issue affects Red Hat products that process untrusted JWK material, including Red Hat Ansible Automation Platform 2. Red Hat has assessed this flaw but currently does not offer a mitigation that meets their criteria for ease of use, applicability, or stability.

An unauthenticated remote attacker can cause denial of service by supplying a specially crafted JWK with a large key_ops array, which triggers excessive CPU consumption during duplicate validation. This results in resource exhaustion and service unavailability. There is no impact on confidentiality or integrity, only availability.

Red Hat currently does not provide an official fix or mitigation that meets their product security criteria. Users should monitor Red Hat advisories for updates. Until a fix is available, applications should avoid processing untrusted JWK material or implement their own limits on the size of key_ops arrays if possible.