# CVE-2026-119283: joserfc JWE denial of service via unlimited recipients

Source: https://junglewise.ai/threats/cve-2026-119283-joserfc-is-a-python-library-that-provides-an-implementation-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-119283 · Severity: high · CVSS 7.5 · Published 2026-10-29

joserfc is a Python library that implements JSON Web Encryption (JWE) standards used by applications to encrypt and sign data. An attacker can send specially crafted encrypted messages with unlimited recipient entries, forcing the application to perform expensive decryption operations repeatedly and exhausting CPU resources. This causes service unavailability without compromising the security of encrypted data.

Technologies: [Authlib Joserfc](https://junglewise.ai/threats/technologies/joserfc), [joserfc (PyPI)](https://junglewise.ai/threats/technologies/pypi-joserfc). Vendors: [Authlib](https://junglewise.ai/threats/vendors/authlib), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-119283 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119283 being exploited in the wild.

**How severe is CVE-2026-119283?** High severity, with a CVSS score of 7.5, published 29 October 2026.

**Which products and versions are affected?** Authlib Joserfc before 1.7.5; joserfc (PyPI) < 1.7.5, ECOSYSTEM:introduced=0,fixed=1.7.5.

**Is there a fix for CVE-2026-119283?** Yes. joserfc (PyPI): upgrade to 1.7.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119283 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-119283?** Check whether you run Authlib Joserfc or joserfc (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- joserfc (PyPI): upgrade to 1.7.5 or later

  ```sh
  pip install "joserfc>=1.7.5"
  ```


## Technical details

The vulnerability exists in joserfc.jwe.decrypt_json() which processes all entries in a JWE General JSON Serialization recipients array without enforcing a count limit, calling decrypt_cek() for each recipient regardless of the verify_all_recipients setting. An unauthenticated attacker with network access to an endpoint using RSA key-management algorithms can craft requests with arbitrarily large recipient arrays to trigger repeated CPU-intensive private-key decryption operations, resulting in denial of service.

## Affected products

- authlib joserfc before 1.7.5

## Identifiers

- CVE-2026-119283
- GHSA-jpxq-7h8p-2q76

## Timeline

- 2026-10-29: advisory
- 2026-08-29: patched: version 1.7.5 released with max_recipients limit

## References

- [https://github.com/authlib/joserfc/commit/d6dc8df6c7609277e741069d3733e43996c1cd17](https://github.com/authlib/joserfc/commit/d6dc8df6c7609277e741069d3733e43996c1cd17)
- [https://github.com/authlib/joserfc/releases/tag/1.7.5](https://github.com/authlib/joserfc/releases/tag/1.7.5)

## Related threats

- [joserfc memory exhaustion in compact JWS deserialization](https://junglewise.ai/threats/cve-2026-119284-joserfc-is-a-python-library-that-provides-an-implementation-of)
- [authlib joserfc issuer validation bypass in JWT claims](https://junglewise.ai/threats/cve-2026-75509-authlib-joserfc-issuer-validation-bypass-in-jwt-claims)
- [authlib joserfc token malleability via trailing padding](https://junglewise.ai/threats/cve-2026-62995-authlib-joserfc-token-malleability-via-trailing-padding)
- [authlib joserfc authentication bypass via empty HMAC key](https://junglewise.ai/threats/cve-2026-49852-authlib-joserfc-authentication-bypass-via-empty-hmac-key)
- [PYSEC-2026-2529 - joserfc's PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS)](https://junglewise.ai/threats/cve-2026-27932-joserfc-s-pbes2-p2c-unbounded-iteration-count-enables-denial-of)