joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.5, joserfc.jwe.decrypt_json() accepts a JWE General JSON Serialization recipients array without a count limit and calls decrypt_cek() for every entry. An unauthenticated attacker who can submit a JWE to an endpoint using an RSA key-management algorithm can choose the number of private-key decryption operations performed by one request. The verify_all_recipients option does not reduce this work because the affected loop processes every recipient before consulting that setting, allowing repeated requests to exhaust service CPU without affecting confidentiality or integrity. This issue is fixed in version 1.7.5.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption
    (JOSE) standards. Prior to 1.7.5, joserfc.jwe.decrypt_json() accepts a JWE General JSON Serialization
    recipients array without a count limit and calls decrypt_cek() for every entry. An unauthenticated
    attacker who can submit a JWE to an endpoint using an RSA key-management algorithm can choose the number
    of private-key decryption operations performed by one request. The verify_all_recipients option does not
    reduce this work because the affected loop processes every recipient before consulting that setting,
    allowing repeated requests to exhaust service CPU without affecting confidentiality or integrity. This
    issue is fixed in version 1.7.5. (CVE-2026-119283)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption     (JOSE) standards. Prior to 1.7.5, joserfc.jwe.decrypt_json() accepts a JWE General JSON Serialization     recipients array without a count limit and calls decrypt_cek() for every entry. An unauthenticated     attacker who can submit a JWE to an endpoint using an RSA key-management algorithm can choose the number     of private-key decryption operations performed by one request. The verify_all_recipients option does not     reduce this work because the affected loop processes every recipient before consulting that setting,     allowing repeated requests to exhaust service CPU without affecting confidentiality or integrity. This     issue is fixed in version 1.7.5. (CVE-2026-119283)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
478031	SCA: security update for joserfc (GHSA-jpxq-7h8p-2q76)	Tenable Cloud Security	SCA Checks	Local	high
478031	SCA: security update for joserfc (GHSA-jpxq-7h8p-2q76)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
374251	Linux Distros Unpatched Vulnerability : CVE-2026-119283	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-119283

high

Tenable Plugins

high

high

high