What is the CVSS score of CVE-2026-27932?

CVE-2026-27932 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Python are affected by CVE-2026-27932?

A resource exhaustion vulnerability in the joserfc Python library (CVE-2026-27932) allows unauthenticated attackers to trigger CPU exhaustion and deny service to affected applications.. A patch is available.

Is there a public PoC exploit available for CVE-2026-27932?

Yes, a public proof-of-concept exploit is available for CVE-2026-27932. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-27932?

Within 24 hours: Identify all systems and applications using joserfc library and document their criticality and internet exposure. Within 7 days: Apply available vendor patch to all affected systems, prioritizing internet-facing and production environments. Within 30 days: Complete patching of all remaining systems including development and test environments, and implement monitoring for suspicious CPU consumption patterns.

Python CVE-2026-27932

HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-03-03 security-advisories@github.com

GHSA-w5r5-m38g-f9f9

Denial Of Service Python Joserfc Suse

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SUSE

HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:05 vuln.today

PoC Detected

Mar 05, 2026 - 18:00 vuln.today

Public exploit code

Patch released

Mar 05, 2026 - 18:00 nvd

Patch available

CVE Published

Mar 03, 2026 - 23:15 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 pypi packages depend on joserfc (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 1.6.3.

DescriptionGitHub Advisory

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In 1.6.2 and earlier, a resource exhaustion vulnerability in joserfc allows an unauthenticated attacker to cause a Denial of Service (DoS) via CPU exhaustion. When the library decrypts a JSON Web Encryption (JWE) token using Password-Based Encryption (PBES2) algorithms, it reads the p2c (PBES2 Count) parameter directly from the token's protected header. This parameter defines the number of iterations for the PBKDF2 key derivation function. Because joserfc does not validate or bound this value, an attacker can specify an extremely large iteration count (e.g., 2^31 - 1), forcing the server to expend massive CPU resources processing a single token. This vulnerability exists at the JWA layer and impacts all high-level JWE and JWT decryption interfaces if PBES2 algorithms are allowed by the application's policy.

AnalysisAI

Joserfc versions 1.6.2 and earlier fail to validate the PBES2 iteration count parameter in JWE tokens, allowing unauthenticated attackers to trigger CPU exhaustion by specifying arbitrarily large values in the p2c header field. An attacker can exploit this resource exhaustion vulnerability to cause denial of service against any system using the library to decrypt JWE tokens. Public exploit code exists for this vulnerability, and a patch is available.

Technical ContextAI

Classified as CWE-770 (Allocation of Resources Without Limits or Throttling). Affects Joserfc. joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In 1.6.2 and earlier, a resource exhaustion vulnerability in joserfc allows an unauthenticated attacker to cause a Denial of Service (DoS) via CPU exhaustion. When the library decrypts a JSON Web Encryption (JWE) token using Password-Based Encryption (PBES2) algorithms, it reads the p2c (PBES2 Count) parameter directly from the token's protected header. This parameter defin