Log in Start free

Vulnerability · Published Sep 16, 2026 · Assigned by redhat

CVE-2026-92091Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array

Medium 5.9

In plain English

A medium-severity security flaw in Red Hat Ansible Automation Platform 2 from Red Hat. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.6%top 52.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(n^2) time complexity, and the length of key_ops is not bounded. A remote, unauthenticated attacker can supply a JWK with a large key_ops array to an application that passes attacker-controlled key material to a public key-import API (reachable via ECDH-ES key agreement, OIDC dynamic client registration, DPoP, or ACME account key registration, among others) to consume excessive CPU time, resulting in a denial of service.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12python-jwcryptono fix listedDEBIAN-CVE-2026-92091
Debian:13python-jwcryptono fix listedDEBIAN-CVE-2026-92091
Debian:14python-jwcryptono fix listedDEBIAN-CVE-2026-92091
Ubuntu:22.04:LTSpython-jwcryptono fix listedUBUNTU-CVE-2026-92091
Ubuntu:24.04:LTSpython-jwcryptono fix listedUBUNTU-CVE-2026-92091
Ubuntu:26.04:LTSpython-jwcryptono fix listedUBUNTU-CVE-2026-92091
Ubuntu:26.10python-jwcryptono fix listedUBUNTU-CVE-2026-92091

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat OpenShift AI (RHOAI) see references
Red Hat Red Hat OpenShift AI (RHOAI) see references
Red Hat Red Hat OpenStack Platform 16.2 see references
Red Hat Red Hat OpenStack Platform 16.2 see references
Red Hat Red Hat OpenStack Platform 16.2 see references
Red Hat Red Hat OpenStack Platform 16.2 see references
Red Hat Red Hat OpenStack Platform 16.2 see references
Red Hat Red Hat OpenStack Platform 16.2 see references
Red Hat Red Hat OpenStack Platform 16.2 see references
Red Hat Red Hat OpenStack Platform 16.2 see references
Red Hat Red Hat OpenStack Platform 17.1 see references
Red Hat Red Hat OpenStack Platform 17.1 see references

Weakness: CWE-407 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References