Skip to content
OpenAdvisories
Critical ELSA-2026-80605 1 CVE

Critical: cjose security update (Oracle Linux 10)

Published Oct 11, 2026 · Updated Oct 11, 2026

Ecosystem: Oracle Linux

Summary

[0.6.2.2-7.2]
- Fix CVE-2026-53939 cjose: OpenIDC/cjose uses all-zero Content Encryption Key
for AES-CBC-HMAC JWE encryption
Resolves: RHEL-276901

Fixed packages 2

ReleasePackageFixed in
Oracle Linux · 10 cjose 0:0.6.2.2-7.el10_2.2
Oracle Linux · 10 cjose-devel 0:0.6.2.2-7.el10_2.2

Vulnerabilities 1

  • Critical 9.1
    CVE-2026-53939

    OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption

    OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm (`A128CBC-HS256`, `A192CBC-HS384`, or `A256CBC-HS512…

    OpenIDC cjose cjose cjose Debian Ubuntu Azure Linux