RLSA-2026:92145: Critical: cjose security update

Q: What attacker access is indicated by the severity assessment?

The CVSS vector indicates network-based exploitation with low attack complexity, requiring no privileges and no user interaction.

Q: What security properties are affected?

The assessment rates confidentiality and integrity impact as high, with no availability impact indicated.

Q: Which cryptographic use case is implicated?

The issue affects AES-CBC-HMAC JWE encryption, where the Content Encryption Key may be all zero.

Published Oct 30, 2026

Updated

CJose is C library implementing the Javascript Object Signing and Encryption (JOSE).

Security Fix(es):

cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption (CVE-2026-53939)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

1 affected componentFixes available

rocky-linux/cjose<0:0.6.1-17.el9_8.2

0:0.6.1-17.el9_8.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rocky-linux/cjose to a version that resolves this vulnerability.
Fixed in 0:0.6.1-17.el9_8.2

Event History

Oct 30, 2026

Advisory Published

via OSV·12:04 PM

Data Sourced

via OSV·12:04 PM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-53939

Frequently Asked Questions

What attacker access is indicated by the severity assessment?

The CVSS vector indicates network-based exploitation with low attack complexity, requiring no privileges and no user interaction.

What security properties are affected?

The assessment rates confidentiality and integrity impact as high, with no availability impact indicated.

Which cryptographic use case is implicated?

The issue affects AES-CBC-HMAC JWE encryption, where the Content Encryption Key may be all zero.

RLSA-2026:92145: Critical: cjose security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What attacker access is indicated by the severity assessment?

What security properties are affected?

Which cryptographic use case is implicated?

Company

Resources

Contact

Frequently Asked Questions

What attacker access is indicated by the severity assessment?

What security properties are affected?

Which cryptographic use case is implicated?