CVE-2026-53938

cjose, a C library for Javascript Object Signing and Encryption (JOSE), fails to validate the length of the attacker-supplied JWE Encrypted Key before unwrapping it with the AES Key Wrap algorithms (A128KW/A192KW/A256KW), writing into a fixed-size heap buffer for the Content Encryption Key. A remote, unauthenticated attacker can trigger this by submitting a crafted JWE to any application that processes it via cjose_jwe_import() and cjose_jwe_decrypt() using an AES Key Wrap symmetric key. The resulting out-of-bounds heap write corrupts the heap and, at minimum, crashes the process (denial of service, reflected in the high availability component of the 8.2 CVSS score); further memory-corruption impact may be possible depending on heap layout and allocator, with limited integrity and no confidentiality impact per the vector. Any application that embeds cjose and decrypts attacker-controlled JWEs with an AES-KW key is affected. No public proof-of-concept is known, the flaw is not in CISA's KEV, and its EPSS of 0.2% (15th percentile) indicates exploitation has not yet been observed.

What to do: Upgrade cjose to 0.6.2.5, which patches the missing length validation. If upgrading is not immediately possible, reject the AES Key Wrap algorithms (A128KW/A192KW/A256KW) for untrusted JWEs at the application layer. Audit which applications and services in your estate link against cjose and decrypt attacker-controlled JWEs, prioritizing any that expose decryption pre-authentication.