{"id":"CVE-2026-92091","title":"A flaw was found in jwcrypto","summary":"A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(n^2) time complexity, and the length of key_ops is not bounded. A remote, unauthenticated attacke…","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-407"],"vendor":"Red Hat","product":"ansible-automation-platform-24/controller-rhel8","affected":["ansible-automation-platform-24/controller-rhel8 (all versions)","ansible-automation-platform-24/lightspeed-rhel8 (all versions)","ansible-automation-platform-25/controller-rhel8 (all versions)","ansible-automation-platform-25/gateway-rhel8 (all versions)","ansible-automation-platform-25/lightspeed-rhel8 (all versions)","ansible-automation-platform-26/controller-rhel9 (all versions)","ansible-automation-platform-26/gateway-rhel9 (all versions)","ansible-automation-platform-26/lightspeed-rhel9 (all versions)","ansible-automation-platform-27/gateway-rhel9 (all versions)","ansible-automation-platform-27/lightspeed-rhel9 (all versions)","automation-controller (all versions)","python3.11-jwcrypto (all versions)","python3.12-jwcrypto (all versions)","python-jwcrypto (all versions)","python-jwcrypto (all versions)","idm:client/python-jwcrypto (all versions)","idm:DL1/python-jwcrypto (all versions)","python-jwcrypto (all versions)","rhoai/odh-feature-server-rhel9 (all versions)","rhoai/odh-kserve-storage-initializer-rhel9 (all versions)","rhosp-rhel8/openstack-mistral-executor (all versions)","rhosp-rhel8/openstack-nova-api (all versions)","rhosp-rhel8/openstack-nova-compute-ironic (all versions)","rhosp-rhel8/openstack-novajoin-base (all versions)","rhosp-rhel8/openstack-novajoin-notifier (all versions)","rhosp-rhel8/openstack-novajoin-server (all versions)","rhosp-rhel8/openstack-tempest (all versions)","rhosp-rhel8/openstack-tripleoclient (all versions)","rhosp-rhel9/openstack-nova-api (all versions)","rhosp-rhel9/openstack-nova-compute-ironic (all versions)","rhosp-rhel9/openstack-novajoin-base (all versions)","rhosp-rhel9/openstack-novajoin-notifier (all versions)","rhosp-rhel9/openstack-novajoin-server (all versions)","rhosp-rhel9/openstack-tempest (all versions)","rhosp-rhel9/openstack-tripleoclient (all versions)"],"published":"2026-09-16","updated":"2026-09-16","sourceUpdated":"2026-09-16T19:42:43.623","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92091","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-92091","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2533849","label":"secalert@redhat.com"},{"url":"https://github.com/latchset/jwcrypto/security/advisories/GHSA-pwgw-f7xr-863h","label":"secalert@redhat.com"},{"url":"https://github.com/latchset/jwcrypto/security/advisories/GHSA-pwgw-f7xr-863h","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92091.json"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-92091"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92091"}],"tags":["nvd","cve.org","exploit-available","csaf","vex","red-hat"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-16T14:54:32.638607Z"},"ingestedAt":"2026-09-16T07:51:48.493Z","epss":0.00496,"epssPercentile":0.41489,"slug":"CVE-2026-92091","body":"## Overview\n\nA flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(n^2) time complexity, and the length of key_ops is not bounded. A remote, unauthenticated attacker can supply a JWK with a large key_ops array to an application that passes attacker-controlled key material to a public key-import API (reachable via ECDH-ES key agreement, OIDC dynamic client registration, DPoP, or ACME account key registration, among others) to consume excessive CPU time, resulting in a denial of service.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift AI (RHOAI), … · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-09-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92091.json)","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":32.5,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":204959,"id":"CVE-2026-92091","ts":1789570693732,"field":"exploit_available","old":"false","new":"true"}]}