Every CVE Search/ Get API key

CVE-2026-92091

Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array

5.9 MediumFix available

A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(n^2) time complexity, and the length of key_ops is not bounded. A remote, unauthenticated attacker can supply a JWK with a large key_ops array to an application that passes attacker-controlled key material to a public key-import API (reachable via ECDH-ES key agreement, OIDC dynamic client registration, DPoP, or ACME account key registration, among others) to consume excessive CPU time, resulting in a denial of service.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.57%Up 0.1 points since Sep 16, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.9

Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array

A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(n^2) time complexity, and the length of key_ops is not bounded. A remote, unauthenticated attacker can supply a JWK with a large key_ops array to an application that passes attacker-controlled key material to a public key-import API (reachable via ECDH-ES key agreement, OIDC dynamic client registration, DPoP, or ACME account key registration, among others) to consume excessive CPU time, resulting in a denial of service.

Record
CVE-2026-92091
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-407
Updated
2026-11-06
EUVDEUVD-2026-80228 5.9

A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(n^2) time complexity, and the length of key_ops is not bounded. A remote, unauthenticated attacker can supply a JWK with a large key_ops array to an application that passes attacker-controlled key material to a public key-import API (reachable via ECDH-ES key agreement, OIDC dynamic client registration, DPoP, or ACME account key registration, among others) to consume excessive CPU time, resulting in a denial of service.

Record
EUVD-2026-80228
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-06
NVD 5.9

A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(n^2) time complexity, and the length of key_ops is not bounded. A remote, unauthenticated attacker can supply a JWK with a large key_ops array to an application that passes attacker-controlled key material to a public key-import API (reachable via ECDH-ES key agreement, OIDC dynamic client registration, DPoP, or ACME account key registration, among others) to consume excessive CPU time, resulting in a denial of service.

Record
CVE-2026-92091
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-407
Updated
2026-11-06
OSVDEBIAN-CVE-2026-92091 5.9

A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(n^2) time complexity, and the length of key_ops is not bounded. A remote, unauthenticated attacker can supply a JWK with a large key_ops array to an application that passes attacker-controlled key material to a public key-import API (reachable via ECDH-ES key agreement, OIDC dynamic client registration, DPoP, or ACME account key registration, among others) to consume excessive CPU time, resulting in a denial of service.

Record
DEBIAN-CVE-2026-92091
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-4066 5.9

python-jwcrypto security update

Implements JWK, JWS, JWE specifications with python-cryptography

Security Fix(es):

A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(n^2) time complexity, and the length of key_ops is not bounded. A remote, unauthenticated attacker can supply a JWK with a large key_ops array to an application that passes attacker-controlled key material to a public key-import API (reachable via ECDH-ES key agreement, OIDC dynamic client registration, DPoP, or ACME account key registration, among others) to consume excessive CPU time, resulting in a denial of service.(CVE-2026-92091)

Record
OESA-2026-4066
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-92091 5.9

A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(n^2) time complexity, and the length of key_ops is not bounded. A remote, unauthenticated attacker can supply a JWK with a large key_ops array to an application that passes attacker-controlled key material to a public key-import API (reachable via ECDH-ES key agreement, OIDC dynamic client registration, DPoP, or ACME account key registration, among others) to consume excessive CPU time, resulting in a denial of service.

Record
UBUNTU-CVE-2026-92091
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVAZL-103095 No score

CVE-2026-92091 affecting package python-jwcrypto 0.6.0-9

A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(n^2) time complexity, and the length of key_ops is not bounded. A remote, unauthenticated attacker can supply a JWK with a large key_ops array to an application that passes attacker-controlled key material to a public key-import API (reachable via ECDH-ES key agreement, OIDC dynamic client registration, DPoP, or ACME account key registration, among others) to consume excessive CPU time, resulting in a denial of service.

Record
AZL-103095
Updated
2026-11-05
OSVopenSUSE-SU-2026:11972-1 No score

python313-jwcrypto-1.6.1-1.1 on GA media

These are all security issues fixed in the python313-jwcrypto-1.6.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11972-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22073-1 No score

Security update for python-jwcrypto

This update for python-jwcrypto fixes the following issue:

  • CVE-2026-92091: JWK.import_key() validates the key_ops JWK member for duplicate values using a quadratic complexity algorithm, which allows attackers to cause a denial of service via excessive resource consumption (bsc#1280816).
Record
openSUSE-SU-2026:22073-1
Updated
2026-11-02
OSVSUSE-SU-2026:24218-1 No score

Security update for python-jwcrypto

This update for python-jwcrypto fixes the following issue:

  • CVE-2026-92091: JWK.import_key() validates the key_ops JWK member for duplicate values using a quadratic complexity algorithm, which allows attackers to cause a denial of service via excessive resource consumption (bsc#1280816).
Record
SUSE-SU-2026:24218-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
python-jwcrypto
Azure Linux:3
 through 0.6.0-9 None known
python-jwcrypto
Debian:12
 All versions, plus listed versions
1.1.0-11.1.0-1+deb12u11.5.4-11.5.6-11.5.6-1.11.5.6-1.1~deb13u11.5.6-1.2
 None known
python-jwcrypto
Debian:13
 All versions, plus listed versions
1.5.6-11.5.6-1.11.5.6-1.1~deb13u11.5.6-1.2
 None known
python-jwcrypto
Debian:14
 All versions, plus listed versions
1.5.6-11.5.6-1.11.5.6-1.1~deb13u11.5.6-1.2
 None known
python-jwcrypto
openEuler:22.03-LTS-SP4
 before 1.4.2-5.oe2203sp4
1.4.2-5.oe2203sp4
python-jwcrypto
openEuler:24.03-LTS-SP1
 before 1.5.0-5.oe2403sp1
1.5.0-5.oe2403sp1
python-jwcrypto
openEuler:24.03-LTS-SP3
 before 1.5.0-5.oe2403sp3
1.5.0-5.oe2403sp3
python-jwcrypto
openEuler:24.03-LTS-SP4
 before 1.5.0-5.oe2403sp4
1.5.0-5.oe2403sp4
python-jwcrypto
openEuler:20.03-LTS-SP4
 before 0.5.0-6.oe2003sp4
0.5.0-6.oe2003sp4
python-jwcrypto
SUSE:Linux Enterprise Server 16.0
 before 1.5.6-160000.5.1
1.5.6-160000.5.1
Show 10 moreShow less
Affected packages
PackageAffectedFixed
python-jwcrypto
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 1.5.6-160000.5.1
1.5.6-160000.5.1
python-jwcrypto
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.2.1-1
 None known
python-jwcrypto
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.3.2-10.4.2-1
 None known
python-jwcrypto
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.6.0-10.6.0-2
 None known
python-jwcrypto
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.8.0-11.0.0-2
 None known
python-jwcrypto
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.1.0-11.5.4-1
 None known
python-jwcrypto
Ubuntu:26.10
 All versions, plus listed versions
1.5.6-11.5.6-1.11.5.6-1.2
 None known
python-jwcrypto
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.5.6-1
 None known
python-jwcrypto
openSUSE:Tumbleweed
 before 1.6.1-1.1
1.6.1-1.1
python-jwcrypto
openSUSE:Leap 16.0
 before 1.5.6-160000.5.1
1.5.6-160000.5.1

History

History
RecordedChangedSources
factsOSV
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-92091 is a medium vulnerability (CVSS 5.9) in Red Hat Ansible Automation Platform 2, published September 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.57%, the 47th percentile. Fixed in python-jwcrypto 1.4.2-5.oe2203sp4.

References

Show 5 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open