TI-2026-38907 CVE-2026-53938
OpenIDC/cjose has a heap buffer overflow in AES Key Wrap decryption (A128KW/A192KW/A256KW)
Priority MEDIUM 41
OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE).
RHSA-2026:77370
mod_auth_openidc:2.3 security update
Released 2026-10-07 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream E4S (v.8.8) cjose-0.6.1-3.module+el8.8.0+24970+620d53ef.1.ppc64le::mod_auth_openidc:2.3, cjose-0.6.1-3.module+el8.8.0+24970+620d53ef.1.src::mod_auth_openidc:2.3, cjose-0.6.1-3.module+el8.8.0+24970+620d53ef.1.x86_64::mod_auth_openidc:2.3 +5
- Red Hat Enterprise Linux AppStream TUS (v.8.8) cjose-0.6.1-3.module+el8.8.0+24970+620d53ef.1.src::mod_auth_openidc:2.3, cjose-0.6.1-3.module+el8.8.0+24970+620d53ef.1.x86_64::mod_auth_openidc:2.3, cjose-devel-0.6.1-3.module+el8.8.0+24970+620d53ef.1.x86_64::mod_auth_openidc:2.3 +2