Skip to content
OpenAdvisories
Critical ELSA-2026-92157 1 CVE

Critical: mod_auth_openidc:2.3 security update (Oracle Linux 8)

Published Oct 29, 2026 · Updated Oct 29, 2026

Ecosystem: Oracle Linux

Summary

cjose
[0.6.1-6]
- CVE-2026-53939 mod_auth_openidc:2.3/cjose: OpenIDC/cjose uses all-zero Content
Encryption Key for AES-CBC-HMAC JWE encryption
Resolves: RHEL-287898

mod_auth_openidc
[2.4.9.4-9]
- Resolves: RHEL-248080 CVE-2026-54789 Denial of Service via malformed state
cookie parsing

Fixed packages 3

ReleasePackageFixed in
Oracle Linux · 8 cjose 0:0.6.1-6.module+el8.10.0+91088+2d069dc4
Oracle Linux · 8 cjose-devel 0:0.6.1-6.module+el8.10.0+91088+2d069dc4
Oracle Linux · 8 mod_auth_openidc 0:2.4.9.4-9.module+el8.10.0+91088+2d069dc4

Vulnerabilities 1

  • Critical 9.1
    CVE-2026-53939

    OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption

    OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm (`A128CBC-HS256`, `A192CBC-HS384`, or `A256CBC-HS512…

    OpenIDC cjose cjose cjose Debian Ubuntu Azure Linux