# CVE-2026-27932: PYSEC-2026-2529 - joserfc's PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS)

Source: https://junglewise.ai/threats/cve-2026-27932-joserfc-s-pbes2-p2c-unbounded-iteration-count-enables-denial-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-13  
License: CC BY 4.0 with a link back

CVE-2026-27932 · Severity: low · CVSS 3.1 · Published 2026-07-13

joserfc's PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS)

Technologies: [joserfc (PyPI)](https://junglewise.ai/threats/technologies/pypi-joserfc). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-27932 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-27932 being exploited in the wild.

**How severe is CVE-2026-27932?** Low severity, with a CVSS score of 3.1, published 13 July 2026.

**Which products and versions are affected?** joserfc (PyPI) ECOSYSTEM:introduced=0,fixed=1.6.3.

**Is there a fix for CVE-2026-27932?** Yes. joserfc (PyPI): upgrade to 1.6.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-27932?** Check whether you run joserfc (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- joserfc (PyPI): upgrade to 1.6.3 or later

  ```sh
  pip install "joserfc>=1.6.3"
  ```


## Affected products

- joserfc (PyPI) ECOSYSTEM:introduced=0,fixed=1.6.3

## Identifiers

- CVE-2026-27932
- GHSA-w5r5-m38g-f9f9
- PYSEC-2026-2529

## Related threats

- [joserfc memory exhaustion in compact JWS deserialization](https://junglewise.ai/threats/cve-2026-119284-joserfc-is-a-python-library-that-provides-an-implementation-of)
- [joserfc JWE denial of service via unlimited recipients](https://junglewise.ai/threats/cve-2026-119283-joserfc-is-a-python-library-that-provides-an-implementation-of)
- [authlib joserfc authentication bypass via empty HMAC key](https://junglewise.ai/threats/cve-2026-49852-authlib-joserfc-authentication-bypass-via-empty-hmac-key)
- [authlib joserfc resource exhaustion via oversized RFC7797 payloads](https://junglewise.ai/threats/cve-2026-48990-authlib-joserfc-resource-exhaustion-via-oversized-rfc7797)
- [joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads](https://junglewise.ai/threats/cve-2025-65015-joserfc-has-possible-uncontrolled-resource-consumption)