CVE-2026-92091 Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array
Remote attackers can cause denial of service by sending large JWK key_ops arrays to applications using the JWCrypto library for key import.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-92091?
CVE-2026-92091 is a medium-severity denial of service vulnerability in Red Hat Ansible Automation Platform 2, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(n^2) time complexity, and the length of key_ops is not bounded. A remote, unauthenticated attacker can supply a JWK with a large key_ops array to an application that passes attacker-controlled key material to a public key-import API (reachable via ECDH-ES key agreement, OIDC dynamic client registration, DPoP, or ACME account key registration, among others) to consume excessive CPU time, resulting in a denial of service.
Weakness: CWE-407
Which versions are affected by CVE-2026-92091?
Linux distribution packages (4)
python-jwcrypto SUSE:Linux Enterprise Server 16.0 | All versions | 1.5.6-160000.5.1 |
python-jwcrypto SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 1.5.6-160000.5.1 |
python-jwcrypto openSUSE:Leap 16.0 | All versions | 1.5.6-160000.5.1 |
python-jwcrypto openSUSE:Tumbleweed | All versions | 1.6.1-1.1 |
How do I fix CVE-2026-92091?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-92091 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-92091 exists.
Sources
Also known as AZL-103095, DEBIAN-CVE-2026-92091, OESA-2026-4066, SUSE-SU-2026:24218-1, UBUNTU-CVE-2026-92091, openSUSE-SU-2026:11972-1 and 1 more.