ALSA-2026:90812: Important: cjose security update

Q: What deployments are exposed to this issue?

Systems using the AlmaLinux cjose or cjose-devel packages are in scope. Exposure specifically depends on whether the application performs AES Key Wrap decryption using cjose.

Q: What does an attacker need to trigger the flaw?

An attacker would need to cause the affected application to process data through cjose AES Key Wrap decryption. The provided information does not specify authentication requirements or a network attack path.

Q: What is the documented impact?

The vulnerability is a heap buffer overflow in AES Key Wrap decryption and can lead to denial of service. It is classified as a buffer overflow.

Published Oct 27, 2026

Updated

CJose is C library implementing the Javascript Object Signing and Encryption (JOSE).

Security Fix(es):

cjose: cjose: Heap buffer overflow in AES Key Wrap decryption leads to denial of service (CVE-2026-53938)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

2 affected componentsFixes available

almalinux/cjose<0.6.1-17.el9_8.1

0.6.1-17.el9_8.1

almalinux/cjose-devel<0.6.1-17.el9_8.1

0.6.1-17.el9_8.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade almalinux/cjose to a version that resolves this vulnerability.
Fixed in 0.6.1-17.el9_8.1
Upgrade
Upgrade almalinux/cjose-devel to a version that resolves this vulnerability.
Fixed in 0.6.1-17.el9_8.1

Event History

Oct 27, 2026

Advisory Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-53938

Frequently Asked Questions

What deployments are exposed to this issue?

Systems using the AlmaLinux cjose or cjose-devel packages are in scope. Exposure specifically depends on whether the application performs AES Key Wrap decryption using cjose.

What does an attacker need to trigger the flaw?

An attacker would need to cause the affected application to process data through cjose AES Key Wrap decryption. The provided information does not specify authentication requirements or a network attack path.

What is the documented impact?

The vulnerability is a heap buffer overflow in AES Key Wrap decryption and can lead to denial of service. It is classified as a buffer overflow.

ALSA-2026:90812: Important: cjose security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What deployments are exposed to this issue?

What does an attacker need to trigger the flaw?

What is the documented impact?

Company

Resources

Contact

Frequently Asked Questions

What deployments are exposed to this issue?

What does an attacker need to trigger the flaw?

What is the documented impact?