joserfc EUVD-2026-113392

Exploitation requires that the target application call joserfc.jwe.decrypt_json() (the General JSON Serialization parser) on externally supplied JWE input and decrypt it with an RSA key-management algorithm such as RSA-OAEP or RSA1_5, in any version prior to 1.7.5. No authentication, no user interaction, and no non-default configuration are required against vulnerable versions - the vulnerable loop has no recipient-count cap and processes every recipient before consulting any option. The documented verify_all_recipients=False flag does NOT limit exploitation, as confirmed at runtime: it only affects exception behavior, not the number of RSA operations performed. Limiting factors that reduce real-world exposure: applications that do not use General JSON Serialization (e.g. only compact JWE), that do not decrypt attacker-controlled JWE, or that use non-RSA key-management algorithms are not meaningfully affected; the asymmetric cost derives specifically from expensive RSA private-key operations.

This is a genuine, well-evidenced availability risk but not a confidentiality/integrity emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 High) is internally consistent with the description and the source-code analysis: a remote, unauthenticated attacker over the network, with low complexity and no user interaction, can force unbounded RSA private-key decryption operations, with impact limited entirely to availability (C:N/I:N - the advisory explicitly states confidentiality and integrity are unaffected). The vuln.today decision label is 'this_week', consistent with a serious-but-not-critical DoS that should be patched promptly rather than as a fire drill. No EPSS score and no KEV listing were provided, so there is no signal of active in-the-wild exploitation; exploitation status is best characterized as a published, confirmed proof-of-concept rather than observed attacks. The one point to verify operationally is reachability: the 7.5 assumes an application actually exposes joserfc.jwe.decrypt_json() to untrusted JWE General JSON input using an RSA key-management algorithm - environments that only use compact serialization or non-RSA algorithms face materially lower real-world risk than the raw score implies. No conflicting signals were found; the CVSS, CWE-400, the GHSA advisory, and the fix commit all agree this is uncontrolled resource consumption.

An application exposes an HTTP endpoint that accepts a JWE in General JSON Serialization and decrypts it with joserfc using an RSA-OAEP (or RSA1_5) private key. An unauthenticated attacker submits a single small request containing a 'recipients' array with thousands of entries, forcing one full RSA private-key decryption per recipient and consuming server CPU far out of proportion to the request size. A confirmed proof-of-concept in the GHSA advisory demonstrates near-linear scaling (e.g. ~1,500 recipients ≈ 1.9s CPU per request), and repeated requests can exhaust CPU and deny service.