Threats tagged 'brew-kimi-cli-cve-2026-119283'

The joserfc library's decrypt_json() function for JWE General JSON Serialization accepts an unbounded recipients array, performing an RSA private-key decryption operation for every recipient without limit. This allows an unauthenticated attacker to cause CPU exhaustion (Denial of Service) by sending a single JWE JSON with many recipients, leading to a linear increase in server CPU usage proportional to the recipient count. The library caps sizes of other JWE components but does not limit the number of recipients. The documented mitigation option verify_all_recipients=False does not reduce CPU usage, as all recipients are decrypted regardless. This vulnerability is tracked as CVE-2026-119283 with a CVSS 3.1 score of 7.5 (High). A fix is available in joserfc version 1.50.0.