https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T08:06:17.730521+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2023:4411 ALSA-2023:4411 — Important: cjose security update 2026-10-03T08:06:17.969392+00:00

Affected: AlmaLinux:9: cjose

CJose is C library implementing the Javascript Object Signing and Encryption (JOSE).

Security Fix(es):

* cjose: AES GCM decryption uses the Tag length from the actual Authentication Tag provided in the JWE (CVE-2023-37464)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/cleanstart-2024-iv40707 CLEANSTART-2024-IV40707 — OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE) 2026-10-03T08:06:17.969473+00:00

Affected: CleanStart: cjose

Security vulnerability affects the cjose package. OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE).

 https://cve.radiocsirt.org/vuln/euvd-2026-216638 EUVD-2026-216638 2026-10-03T08:06:17.969510+00:00 EUVD-2026-216638 https://cve.radiocsirt.org/vuln/fkie_cve-2023-37464 fkie_cve-2023-37464 2026-10-03T08:06:17.969530+00:00

OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec says that a fixed length of 16 octets must be applied. Therefore this bug allows an attacker to provide a truncated Authentication Tag and to modify the JWE accordingly. Users should upgrade to a version >= 0.6.2.2. Users unable to upgrade should avoid using AES GCM encryption and replace it with another encryption algorithm (e.g. AES CBC).

 https://cve.radiocsirt.org/vuln/gsd-2023-37464 gsd-2023-37464 2026-10-03T08:06:17.969575+00:00 gsd-2023-37464 https://cve.radiocsirt.org/vuln/msrc_cve-2023-37464 msrc_CVE-2023-37464 — Incorrect Authentication Tag length usage in AES GCM decryption in OpenIDC/cjose 2026-10-03T08:06:17.969593+00:00 msrc_CVE-2023-37464 https://cve.radiocsirt.org/vuln/oesa-2023-1441 OESA-2023-1441 — cjose security update 2026-10-03T08:06:17.969619+00:00

Affected: openEuler:20.03-LTS-SP1: cjose, openEuler:20.03-LTS-SP3: cjose, openEuler:22.03-LTS: cjose, openEuler:22.03-LTS-SP1: cjose, openEuler:22.03-LTS-SP2: cjose

Implementation of JOSE for C/C++

Security Fix(es):

OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec says that a fixed length of 16 octets must be applied. Therefore this bug allows an attacker to provide a truncated Authentication Tag and to modify the JWE accordingly. Users should upgrade to a version >= 0.6.2.2. Users unable to upgrade should avoid using AES GCM encryption and replace it with another encryption algorithm (e.g. AES CBC).(CVE-2023-37464)

 https://cve.radiocsirt.org/vuln/opensuse-su-2024:13052-1 openSUSE-SU-2024:13052-1 — libcjose-devel-0.6.2.2-1.1 on GA media 2026-10-03T08:06:17.969678+00:00

libcjose-devel-0.6.2.2-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2023:4408 RHSA-2023:4408 — Red Hat Security Advisory: mod_auth_openidc:2.3 security update 2026-10-03T08:06:17.969705+00:00

cjose: AES GCM decryption uses the Tag length from the actual Authentication Tag provided in the JWE

 https://cve.radiocsirt.org/vuln/suse-su-2023:3030-1 SUSE-SU-2023:3030-1 — Security update for cjose 2026-10-03T08:06:17.969732+00:00

Security update for cjose

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-37464 UBUNTU-CVE-2023-37464 2026-10-03T08:06:17.969755+00:00

Affected: Ubuntu:Pro:18.04:LTS: cjose, Ubuntu:20.04:LTS: cjose, Ubuntu:22.04:LTS: cjose, Ubuntu:24.04:LTS: cjose, Ubuntu:25.10: cjose, Ubuntu:26.04:LTS: cjose

OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec says that a fixed length of 16 octets must be applied. Therefore this bug allows an attacker to provide a truncated Authentication Tag and to modify the JWE accordingly. Users should upgrade to a version >= 0.6.2.2. Users unable to upgrade should avoid using AES GCM encryption and replace it with another encryption algorithm (e.g. AES CBC).

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1940 WID-SEC-W-2023-1940 — Red Hat Enterprise Linux (mod_auth_openidc): Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen 2026-10-03T08:06:17.969802+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um Sicherheitsvorkehrungen zu umgehen.