CVE-2026-89314
NoneCVSS
—
EPSS
0.3%
Published
Oct 23, 2026
CISA due date
—
The record
`jwkFields.CheckConsistency` detected duplicate `key_ops` entries with a pairwise nested loop, making validation cost grow with the **square** of the entry count. Because the check runs on every JWK and JWKS unmarshal, a modestly sized but hostile JWKS document could occupy a CPU core for many seconds.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-62160 Daptin is a GraphQL/JSON-API headless CMS. CWE-407
- CVE-2026-87768 DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop… CWE-407
- CVE-2026-119196 pyasn1 is a generic ASN.1 library for Python. CWE-407
- CVE-2026-119194 pyasn1 is a generic ASN.1 library for Python. CWE-407
- CVE-2026-119195 pyasn1 is a generic ASN.1 library for Python. CWE-407
- CVE-2026-119197 pyasn1 is a generic ASN.1 library for Python. CWE-407
- CVE-2019-25781 Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerability in… CWE-407
- CVE-2026-118694 python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows… CWE-407