Is CVE-2026-92091 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92091 being exploited in the wild.

How severe is CVE-2026-92091?

Medium severity, with a CVSS score of 5.9, published 16 September 2026.

Is there a fix for CVE-2026-92091?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-92091 attacked?

It is attacked over the network.

Am I affected by CVE-2026-92091?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92091: jwcrypto JWK.import_key denial of service via O(n²) complexity

CVE-2026-92091 · Severity: medium · CVSS 5.9 · Published 2026-09-16

jwcrypto is a library used to handle JSON Web Key (JWK) cryptographic material, commonly integrated into identity and access management systems. An attacker can exploit an inefficient validation algorithm in the JWK import function by submitting a specially crafted key with an extremely large array of key operations, causing the affected application to consume excessive CPU resources and become unresponsive. This denial-of-service attack requires no authentication and can be triggered through multiple standard integration points including OIDC client registration, DPoP, and ACME protocols.

Quick answers

Is CVE-2026-92091 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92091 being exploited in the wild.
How severe is CVE-2026-92091?: Medium severity, with a CVSS score of 5.9, published 16 September 2026.
Which products and versions are affected?: jwcrypto jwcrypto <UNKNOWN>.
Is there a fix for CVE-2026-92091?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-92091 attacked?: It is attacked over the network.
Am I affected by CVE-2026-92091?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in jwcrypto's JWK.import_key() function, which validates the key_ops JWK member for duplicate values using an O(n²) time complexity algorithm (nested loop comparison). The key_ops array length is not bounded during import, allowing an attacker to supply an arbitrarily large array. A remote, unauthenticated attacker can craft a JWK with a massive key_ops array and pass it to any public API that imports untrusted key material, such as ECDH-ES key agreement, OIDC dynamic client registration, DPoP token validation, or ACME account key registration. The inefficient duplicate-checking algorithm will consume excessive CPU cycles proportional to the square of the array length, resulting in denial of service. No patch or workaround is documented as of the advisory date.

Affected products

jwcrypto jwcrypto <UNKNOWN>

Timeline

2026-09-16: disclosed: CVE-2026-92091 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.