cjose vulnerabilities

3 known vulnerabilities in cjose from OpenIDC. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  cjose: Use of Hard-coded Cryptographic Key

  CVE-2026-53939Sep 9, 2026OpenIDC

  OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm (`A128CBC-HS256`, `A192CBC-HS384`, or `A256CBC-HS512`

• 8.2 High severity

  cjose: Heap-based Buffer Overflow

  CVE-2026-53938Sep 9, 2026OpenIDC

  OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). Prior to version 0.6.2.5, cjose's JWE decryption path for the AES Key Wrap key-management algorithms (`alg` = `A128KW`, `A192KW`, `A256KW`) does not validate the len

• 7.5 High severity

  cjose: Use of a Broken or Risky Cryptographic Algorithm

  CVE-2023-37464Jul 14, 2023OpenIDC

  OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec says that a fixed length of 16 octets