Threats tagged 'brew-moto-cve-2026-119283'

The joserfc library's decrypt_json() function for JWE General JSON Serialization does not limit the number of recipients in the 'recipients' array. This allows an attacker to craft a JWE with an unbounded number of recipients, causing the library to perform a costly RSA private-key decryption operation for each recipient. This results in a CPU exhaustion denial-of-service (DoS) vulnerability with a high severity score (CVSS 7.5). The library's existing mitigation option verify_all_recipients=False does not reduce CPU usage, as all recipients are decrypted before this flag is checked. A fix is available in version 5.2.3_1.