Detections
Analytics
SCA: security update for joserfc (GHSA-w5r5-m38g-f9f9)
high Tenable Self-Hosted Container Security Plugin ID 438191
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption
(JOSE) standards. In 1.6.2 and earlier, a resource exhaustion vulnerability in joserfc allows an
unauthenticated attacker to cause a Denial of Service (DoS) via CPU exhaustion. When the library decrypts
a JSON Web Encryption (JWE) token using Password-Based Encryption (PBES2) algorithms, it reads the p2c
(PBES2 Count) parameter directly from the token's protected header. This parameter defines the number of
iterations for the PBKDF2 key derivation function. Because joserfc does not validate or bound this value,
an attacker can specify an extremely large iteration count (e.g., 2^31 - 1), forcing the server to expend
massive CPU resources processing a single token. This vulnerability exists at the JWA layer and impacts
all high-level JWE and JWT decryption interfaces if PBES2 algorithms are allowed by the application's
policy. (CVE-2026-27932)
See Also
Plugin Details
Severity: High
ID: 438191
Version: Revision 1.6
Type: Local
Family: SCA Checks
Published: 3/4/2026
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.73
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 6.1
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2026-27932
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 3/2/2026
Vulnerability Publication Date: 3/2/2026
Reference Information
CVE: CVE-2026-27932
cwe: CWE-770