TI-2026-38907 CVE-2026-53938
OpenIDC/cjose has a heap buffer overflow in AES Key Wrap decryption (A128KW/A192KW/A256KW)
Priority MEDIUM 41
OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE).
RHSA-2026:77369
mod_auth_openidc:2.3 security update
Released 2026-10-07 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) cjose-0.6.1-5.module+el8.10.0+24880+4db9166e.aarch64::mod_auth_openidc:2.3, cjose-0.6.1-5.module+el8.10.0+24880+4db9166e.ppc64le::mod_auth_openidc:2.3, cjose-0.6.1-5.module+el8.10.0+24880+4db9166e.s390x::mod_auth_openidc:2.3 +11
Fixes 2 records
TI-2026-39595 CVE-2026-54789
mod_auth_openidc has out-of-bounds read and write in state cookie parsing
Priority LOW 39
mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality.