Back to Security Advisories

Cjose Security Update — AlmaLinux 9 (ALSA-2026:90812)

ALSA-2026:90812 updates cjose on AlmaLinux 9, fixing CVE-2026-53938 — a heap buffer overflow in AES Key Wrap decryption (the JOSE signing/encryption C library) leading to denial of service. Update with dnf update cjose and restart services that link it — cjose sits under JWT/OIDC handling in Apache modules and identity tooling.

High 8.2 CVSS
AlmaLinux 9

What this means under a SharedLicense license

A heap overflow in the JOSE key-wrap decryption path is reachable by crafted tokens: applications verifying JWTs through cjose can be crashed — and heap overflows in token parsing carry potential code-execution risk.

Type:

security

Severity:

important

Release date:

2026-10-29

Description:

CJose is C library implementing the Javascript Object Signing and Encryption (JOSE).

Security Fix(es):

* cjose: cjose: Heap buffer overflow in AES Key Wrap decryption leads to denial of service (CVE-2026-53938)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture Package Checksum
aarch64 cjose-0.6.1-17.el9_8.1.aarch64.rpm 94fc7a5486ded882d6718ce9f1d50f149d37e7413150a2e281bf42a02a9b1d25
aarch64 cjose-devel-0.6.1-17.el9_8.1.aarch64.rpm fa6a3542eb09d68f587dbc50c25d3862a736a868d06194ba9c8c0ce78d01cd9f
i686 cjose-0.6.1-17.el9_8.1.i686.rpm 65b8894aa64a088f32e587233216881dcdb3e0c1a3a521d483f81421775680ca
i686 cjose-devel-0.6.1-17.el9_8.1.i686.rpm b93f16075b0aced7a0f035df6965c1c4cb60e846bcefc5804d25061aeff55d4a
ppc64le cjose-0.6.1-17.el9_8.1.ppc64le.rpm 49c57ede12109dc84703aaadf1aafeccb0bd54fa7bf5bd5f756e103a5d1d4605
ppc64le cjose-devel-0.6.1-17.el9_8.1.ppc64le.rpm 8b183c49a5666dc828bdafd2164ee9510d2fd0fa82d6a5317b2ff4a9e4e63a5d
s390x cjose-0.6.1-17.el9_8.1.s390x.rpm a88f06908a5abba65c86e33ebf6df1dce397ed641d3767f39d520bccdf6475c8
s390x cjose-devel-0.6.1-17.el9_8.1.s390x.rpm fb6a3a786cca5265a209ed9729c1a99fd39a94cb5991a07eb80c9f8225a10601
x86_64 cjose-0.6.1-17.el9_8.1.x86_64.rpm 078f73ad5e4ee742c1658a49b59c8e9bc431cf2bd3f8b8886474841e01f1cd3b
x86_64 cjose-devel-0.6.1-17.el9_8.1.x86_64.rpm 482ebf1443f52e529d59480c24e70f5be268a2bc306a49087c857ecec219576d

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Frequently Asked Questions

What is CVE-2026-53938?
It is a heap buffer overflow in cjose's AES Key Wrap decryption, leading to denial of service, fixed in the AlmaLinux 9 update ALSA-2026:90812.
Who is affected?
AlmaLinux 9 servers with cjose installed — typically as a dependency of OpenID Connect / JWT verification stacks such as Apache auth modules and identity tooling.
How do I apply the fix?
Run dnf update cjose and restart the services that link it (Apache modules, SSO daemons) so they reload the patched library.
Why does a JWT library flaw matter for authentication?
JOSE libraries parse untrusted tokens during every login — memory-corruption flaws in that parsing are reached by anyone who can submit a token, which is why token-parsing overflows are treated as security-critical even when the advertised impact is DoS.

References

Security Advisories

Related Advisories

Kernel Security Update — AlmaLinux 9 (ALSA-2026:93412)

2026-11-09

Fence-Agents Security Update — AlmaLinux 9 (ALSA-2026:94500)

2026-11-04

Cockpit Security Update — AlmaLinux 9 (ALSA-2026:94533)

2026-11-04

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System