Threats tagged 'brew-safety-cve-2026-119283'

The joserfc library's decrypt_json() function for JWE General JSON Serialization accepts an unbounded recipients array, causing it to perform a costly RSA private-key decryption operation for each recipient without limit. This allows an unauthenticated attacker to craft a single JWE JSON input with many recipients, forcing the server to perform excessive CPU-intensive RSA decryptions, resulting in a denial of service via CPU exhaustion. The library caps other JWE structural elements but does not limit the number of recipients. The documented mitigation option verify_all_recipients=false does not reduce CPU usage because all recipients are decrypted before this flag is checked. This vulnerability is tracked as CVE-2026-119283 with a CVSS 3.1 score of 7.5 (High).