---
id: CVE-2026-92091
title: A flaw was found in jwcrypto
summary: >-
  A flaw was found in jwcrypto. The JWK.import_key() function validates the
  key_ops JWK member for duplicate values using an algorithm with O(n^2) time
  complexity, and the length of key_ops is not bounded. A remote,
  unauthenticated attacke…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-407
vendor: Red Hat
product: ansible-automation-platform-24/controller-rhel8
affected:
  - ansible-automation-platform-24/controller-rhel8 (all versions)
  - ansible-automation-platform-24/lightspeed-rhel8 (all versions)
  - ansible-automation-platform-25/controller-rhel8 (all versions)
  - ansible-automation-platform-25/gateway-rhel8 (all versions)
  - ansible-automation-platform-25/lightspeed-rhel8 (all versions)
  - ansible-automation-platform-26/controller-rhel9 (all versions)
  - ansible-automation-platform-26/gateway-rhel9 (all versions)
  - ansible-automation-platform-26/lightspeed-rhel9 (all versions)
  - ansible-automation-platform-27/gateway-rhel9 (all versions)
  - ansible-automation-platform-27/lightspeed-rhel9 (all versions)
  - automation-controller (all versions)
  - python3.11-jwcrypto (all versions)
  - python3.12-jwcrypto (all versions)
  - python-jwcrypto (all versions)
  - python-jwcrypto (all versions)
  - 'idm:client/python-jwcrypto (all versions)'
  - 'idm:DL1/python-jwcrypto (all versions)'
  - python-jwcrypto (all versions)
  - rhoai/odh-feature-server-rhel9 (all versions)
  - rhoai/odh-kserve-storage-initializer-rhel9 (all versions)
  - rhosp-rhel8/openstack-mistral-executor (all versions)
  - rhosp-rhel8/openstack-nova-api (all versions)
  - rhosp-rhel8/openstack-nova-compute-ironic (all versions)
  - rhosp-rhel8/openstack-novajoin-base (all versions)
  - rhosp-rhel8/openstack-novajoin-notifier (all versions)
  - rhosp-rhel8/openstack-novajoin-server (all versions)
  - rhosp-rhel8/openstack-tempest (all versions)
  - rhosp-rhel8/openstack-tripleoclient (all versions)
  - rhosp-rhel9/openstack-nova-api (all versions)
  - rhosp-rhel9/openstack-nova-compute-ironic (all versions)
  - rhosp-rhel9/openstack-novajoin-base (all versions)
  - rhosp-rhel9/openstack-novajoin-notifier (all versions)
  - rhosp-rhel9/openstack-novajoin-server (all versions)
  - rhosp-rhel9/openstack-tempest (all versions)
  - rhosp-rhel9/openstack-tripleoclient (all versions)
published: '2026-09-16'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T19:42:43.623'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92091'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-92091'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2533849'
    label: secalert@redhat.com
  - url: >-
      https://github.com/latchset/jwcrypto/security/advisories/GHSA-pwgw-f7xr-863h
    label: secalert@redhat.com
  - url: >-
      https://github.com/latchset/jwcrypto/security/advisories/GHSA-pwgw-f7xr-863h
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92091.json
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-92091'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92091'
tags:
  - nvd
  - cve.org
  - exploit-available
  - csaf
  - vex
  - red-hat
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-16T14:54:32.638607Z'
ingestedAt: '2026-09-16T07:51:48.493Z'
epss: 0.00496
epssPercentile: 0.4164
---

## Overview

A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(n^2) time complexity, and the length of key_ops is not bounded. A remote, unauthenticated attacker can supply a JWK with a large key_ops array to an application that passes attacker-controlled key material to a public key-import API (reachable via ECDH-ES key agreement, OIDC dynamic client registration, DPoP, or ACME account key registration, among others) to consume excessive CPU time, resulting in a denial of service.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift AI (RHOAI), … · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-09-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92091.json)