A high-severity flaw in the open-source cjose library, used for JSON Object Signing and Encryption, fails to check the size of an attacker-supplied encrypted key before copying it into a fixed-size memory buffer. Versions prior to 0.6.2.5 could let a remote, unauthenticated attacker trigger a heap-based buffer overflow simply by sending a malformed JWE token to an application that relies on the library. The bug underscores how a single unvalidated length check in a widely embedded crypto library can expose downstream applications to memory corruption.
// source: nvd.nist.gov ↗