Skip to content
OpenAdvisories
High ELSA-2026-79122 1 CVE

Important: cjose security update (Oracle Linux 10)

Published Oct 8, 2026 · Updated Oct 8, 2026

Ecosystem: Oracle Linux

Summary

[0.6.2.2-7.1]
- Fix CVE-2026-53938: heap buffer overflow in AES key unwrap
Resolves: RHEL-256962

Fixed packages 2

ReleasePackageFixed in
Oracle Linux · 10 cjose 0:0.6.2.2-7.el10_2.1
Oracle Linux · 10 cjose-devel 0:0.6.2.2-7.el10_2.1

Vulnerabilities 1

  • High 8.2
    CVE-2026-53938

    OpenIDC/cjose has a heap buffer overflow in AES Key Wrap decryption (A128KW/A192KW/A256KW)

    OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). Prior to version 0.6.2.5, cjose's JWE decryption path for the AES Key Wrap key-management algorithms (`alg` = `A128KW`, `A192KW`, `A256KW`) does not validate the le…

    OpenIDC cjose cjose cjose Debian Ubuntu Azure Linux