CVE catalog

CVE-2026-92091

A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(n^2) time complexity, and the length of key_ops is not bound

[CVE catalog]

Severity
Medium · CVSS 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.57% · Oct 25, 2026

A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(n^2) time complexity, and the length of key_ops is not bounded. A remote, unauthenticated attacker can supply a JWK with a large key_ops array to an application that passes attacker-controlled key material to a public key-import API (reachable via ECDH-ES key agreement, OIDC dynamic client registration, DPoP, or ACME account key registration, among others) to consume excessive CPU time, resulting in a denial of service.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpython-jwcryptosid1.5.6-1.2vulnerable
Debianpython-jwcryptoforky1.5.6-1.2vulnerable
Debianpython-jwcryptotrixie1.5.6-1.1~deb13u1vulnerable
Debianpython-jwcryptobookworm1.1.0-1+deb12u1vulnerable
Opensusepython-jwcryptotumbleweed1.6.1-1.1fixed
Susepython-jwcryptolinux enterprise server 16.01.5.6-160000.5.1fixed
Susepython-jwcryptolinux enterprise server for sap applications 16.01.5.6-160000.5.1fixed
Opensusepython-jwcryptoleap 16.01.5.6-160000.5.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpython-jwcryptosourcesid(unfixed)not yet assignedNot reported[1148270]
Debianpython-jwcryptosourceforky(unfixed)not yet assignedNot reported[1148270]
Debianpython-jwcryptosourcetrixie(unfixed)not yet assignedNot reported[1148270]
Debianpython-jwcryptosourcebookworm(unfixed)not yet assignedNot reported[1148270]
Opensusepython-jwcryptorpmtumbleweed1.6.1-1.1Not reportedOPENSUSE-SU-2026:11972-1Not reported
Susepython-jwcryptorpmlinux enterprise server 16.01.5.6-160000.5.1Not reportedSUSE-SU-2026:24218-1Not reported
Susepython-jwcryptorpmlinux enterprise server for sap applications 16.01.5.6-160000.5.1Not reportedSUSE-SU-2026:24218-1Not reported
Opensusepython-jwcryptorpmleap 16.01.5.6-160000.5.1Not reportedOPENSUSE-SU-2026:22073-1Not reported

[Debian bug #1148270]

Notes

[bookworm] python-jwcrypto: Minor issue, DoS

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [python3-jwcrypto]Affected

    Source package: [python-jwcrypto]

    Details (2)

    • 1.1.0-1+deb12u1 · all · bookworm

      Affected

      nvd · python-jwcrypto · debian · bookworm; nvd · python-jwcrypto · debian · 12

    • 1.1.0-1+deb12u1 · all · bookworm

      Affected

      nvd · python-jwcrypto · debian · bookworm; nvd · python-jwcrypto · debian · 12

[Debian 13 (Trixie)]

  • [python3-jwcrypto]Affected

    Source package: [python-jwcrypto]

    Details (2)

    • 1.5.6-1.1~deb13u1 · all · trixie

      Affected

      nvd · python-jwcrypto · debian · 13

    • 1.5.6-1.1~deb13u1 · all · trixie

      Affected

      nvd · python-jwcrypto · debian · 13

[openSUSE Tumbleweed]

  • [python313-jwcrypto]Unknown

    Source package: [python-jwcrypto]

    Details (1)

    • 1.5.8-1.3 · noarch · tumbleweed

      Unknown · Fixed: 1.6.1-1.1

      Version impact unknown

      nvd · python-jwcrypto · opensuse · tumbleweed

  • [python314-jwcrypto]Unknown

    Source package: [python-jwcrypto]

    Details (1)

    • 1.5.8-1.3 · noarch · tumbleweed

      Unknown · Fixed: 1.6.1-1.1

      Version impact unknown

      nvd · python-jwcrypto · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]