joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In 1.6.2 and earlier, a resource exhaustion vulnerability in joserfc allows an unauthenticated attacker to cause a Denial of Service (DoS) via CPU exhaustion. When the library decrypts a JSON Web Encryption (JWE) token using Password-Based Encryption (PBES2) algorithms, it reads the p2c (PBES2 Count) parameter directly from the token's protected header. This parameter defines the number of iterations for the PBKDF2 key derivation function. Because joserfc does not validate or bound this value, an attacker can specify an extremely large iteration count (e.g., 2^31 - 1), forcing the server to expend massive CPU resources processing a single token. This vulnerability exists at the JWA layer and impacts all high-level JWE and JWT decryption interfaces if PBES2 algorithms are allowed by the application's policy.

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:20322-1 advisory.

    Changes in python-joserfc:

    - CVE-2026-27932: unbounded PBKDF2 iteration count can lead to a denial of service (bsc#1259154)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption     (JOSE) standards. In 1.6.2 and earlier, a resource exhaustion vulnerability in joserfc allows an     unauthenticated attacker to cause a Denial of Service (DoS) via CPU exhaustion. When the library decrypts     a JSON Web Encryption (JWE) token using Password-Based Encryption (PBES2) algorithms, it reads the p2c     (PBES2 Count) parameter directly from the token's protected header. This parameter defines the number of     iterations for the PBKDF2 key derivation function. Because joserfc does not validate or bound this value,     an attacker can specify an extremely large iteration count (e.g., 2^31 - 1), forcing the server to expend     massive CPU resources processing a single token. This vulnerability exists at the JWA layer and impacts     all high-level JWE and JWT decryption interfaces if PBES2 algorithms are allowed by the application's     policy. (CVE-2026-27932)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption
    (JOSE) standards. In 1.6.2 and earlier, a resource exhaustion vulnerability in joserfc allows an
    unauthenticated attacker to cause a Denial of Service (DoS) via CPU exhaustion. When the library decrypts
    a JSON Web Encryption (JWE) token using Password-Based Encryption (PBES2) algorithms, it reads the p2c
    (PBES2 Count) parameter directly from the token's protected header. This parameter defines the number of
    iterations for the PBKDF2 key derivation function. Because joserfc does not validate or bound this value,
    an attacker can specify an extremely large iteration count (e.g., 2^31 - 1), forcing the server to expend
    massive CPU resources processing a single token. This vulnerability exists at the JWA layer and impacts
    all high-level JWE and JWT decryption interfaces if PBES2 algorithms are allowed by the application's
    policy. (CVE-2026-27932)

ID	Name	Product	Family	Type	Severity
301412	openSUSE 16 Security Update : python-joserfc (openSUSE-SU-2026:20322-1)	Nessus	SuSE Local Security Checks	Local	high
300928	Linux Distros Unpatched Vulnerability : CVE-2026-27932	Nessus	Misc.	Local	high
438191	SCA: security update for joserfc (GHSA-w5r5-m38g-f9f9)	Tenable Cloud Security	SCA Checks	Local	high
438191	SCA: security update for joserfc (GHSA-w5r5-m38g-f9f9)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-27932

high

Tenable Plugins

high

high

high

high