CVE-2026-53938: OpenIDC/cjose has a heap buffer overflow in AES Key Wrap decryption (A128KW/A192KW/A256KW)
OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). Prior to version 0.6.2.5, cjose's JWE decryption path for the AES Key Wrap key-management algorithms (alg = A128KW, A192KW, A256KW) does not validate the length of the attacker-supplied encryptedkey (JWE Encrypted Key) before unwrapping it into a fixed-size, heap-allocated Content Encryption Key (CEK) buffer. A remote, unauthenticated attacker who can submit a crafted JWE to an application that decrypts it with an AES-KW symmetric key can trigger an out-of-bounds heap write, corrupting the heap. This leads at minimum to a crash (denial of service) and, depending on the heap layout and allocator, may be leverageable for further memory-corruption impact. cjosejweimport() / cjosejwedecrypt() are pre-authentication entry points: they parse and process fully attacker-controlled input. Upgrade to cjose 0.6.2.5 to receive a patch. If upgrading is not immediately possible, reject the AES Key Wrap algorithms (A128KW/A192KW/A256KW) for untrusted JWEs at the application layer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenIDC/cjoseto a version that resolves this vulnerability.Fixed in 0.6.2.5 - Configuration
If upgrading to cjose 0.6.2.5 is not immediately possible, reject JWE `alg` values `A128KW`, `A192KW`, and `A256KW` when decrypting attacker-supplied/untrusted JWEs at the application layer.
Application JWE implementation using OpenIDC/cjose Reject AES Key Wrap algorithms (alg = `A128KW`/`A192KW`/`A256KW`) for untrusted JWEs = enabled
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications using cjose before 0.6.2.5 are exposed if they decrypt untrusted JWEs using an AES Key Wrap symmetric key and permit A128KW, A192KW, or A256KW as the JWE key-management algorithm.
What does an attacker need to exploit this issue?
An attacker only needs network access to submit a crafted JWE to an application that processes it through cjose_jwe_import() or cjose_jwe_decrypt() with one of the affected AES-KW algorithms. No authentication or user interaction is required.
What is the impact of successful exploitation?
The crafted encrypted_key can cause an out-of-bounds heap write while the key is unwrapped into the CEK buffer. This can crash the application and may have additional memory-corruption consequences depending on heap layout and the allocator.
What can be done if upgrading is not immediately possible?
Reject A128KW, A192KW, and A256KW for untrusted JWEs at the application layer. This prevents the affected AES Key Wrap decryption path from processing attacker-controlled encrypted_key values.