Skip to content
OpenAdvisories
High ELSA-2026-90812 1 CVE

Important: cjose security update (Oracle Linux 9)

Published Oct 28, 2026 · Updated Oct 28, 2026

Ecosystem: Oracle Linux

Summary

[0.6.1-17.1]
- CVE-2026-53938 cjose: heap buffer overflow in AES key unwrap
Resolves: RHEL-256972

Fixed packages 2

ReleasePackageFixed in
Oracle Linux · 9 cjose 0:0.6.1-17.el9_8.1
Oracle Linux · 9 cjose-devel 0:0.6.1-17.el9_8.1

Vulnerabilities 1

  • High 8.2
    CVE-2026-53938

    OpenIDC/cjose has a heap buffer overflow in AES Key Wrap decryption (A128KW/A192KW/A256KW)

    OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). Prior to version 0.6.2.5, cjose's JWE decryption path for the AES Key Wrap key-management algorithms (`alg` = `A128KW`, `A192KW`, `A256KW`) does not validate the le…

    OpenIDC cjose cjose cjose Debian Ubuntu Azure Linux