TI-2026-38907 CVE-2026-53938
OpenIDC/cjose has a heap buffer overflow in AES Key Wrap decryption (A128KW/A192KW/A256KW)
Priority MEDIUM 41
OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE).
RHSA-2026:77371
mod_auth_openidc:2.3 security update
Released 2026-10-07 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream AUS (v.8.6) cjose-0.6.1-3.module+el8.6.0+24971+334c209b.1.src::mod_auth_openidc:2.3, cjose-0.6.1-3.module+el8.6.0+24971+334c209b.1.x86_64::mod_auth_openidc:2.3, cjose-devel-0.6.1-3.module+el8.6.0+24971+334c209b.1.x86_64::mod_auth_openidc:2.3 +2
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) cjose-0.6.1-3.module+el8.6.0+24971+334c209b.1.aarch64::mod_auth_openidc:2.3, cjose-0.6.1-3.module+el8.6.0+24971+334c209b.1.ppc64le::mod_auth_openidc:2.3, cjose-0.6.1-3.module+el8.6.0+24971+334c209b.1.s390x::mod_auth_openidc:2.3 +11