CVE-2022-32096

What it actually does

Buffer overflow in the r_jwe_aesgcm_key_unwrap component allows a crafted JWE token to trigger memory corruption and crash the process.

Why it matters to the business

Services relying on the library for handling encrypted tokens can be forced offline, interrupting authentication and API operations until the affected process is restarted.

How an attack unfolds

An attacker crafts a malicious JWE token that overflows the buffer during AES-GCM key unwrapping and sends it to any endpoint that processes tokens with the vulnerable library, resulting in an immediate denial of service.

How to fix it

Upgrade babelouest/rhonabwy to the commit b4c2923a1ba4fabf9b55a89244127e153a3e549b or later; rebuild and redeploy all dependent applications.

How to confirm the fix worked

Confirm the library version or commit hash matches the fixed revision; test token processing with both valid and malformed JWE inputs to verify absence of crashes.

Typical attack path

1. Identify an endpoint or service that accepts JWE tokens processed by Rhonabwy
2. Craft a JWE token that triggers the overflow in r_jwe_aesgcm_key_unwrap
3. Transmit the token to the target service
4. Observe process crash and service unavailability

How to detect it

Monitor application and system logs for unexpected crashes or segmentation faults in processes that use the Rhonabwy library during JWE token processing; review any available stack traces referencing r_jwe_aesgcm_key_unwrap.

What your security team should do

• Immediately update Rhonabwy to the fixed commit in all builds and deployments
• Add input validation or rate limiting around JWE token acceptance until patched
• Include the library in automated dependency scanning and update pipelines