redhat ansible-automation-platform CVE-2026-92091 vulnerability in Red Hat Products
Published on September 16, 2026

Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array
A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(n^2) time complexity, and the length of key_ops is not bounded. A remote, unauthenticated attacker can supply a JWK with a large key_ops array to an application that passes attacker-controlled key material to a public key-import API (reachable via ECDH-ES key agreement, OIDC dynamic client registration, DPoP, or ACME account key registration, among others) to consume excessive CPU time, resulting in a denial of service.

NVD

Vulnerability Analysis

CVE-2026-92091 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. Public availability of a proof of concept (POC) exploit exists for CVE-2026-92091. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
HIGH
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
NONE
Availability Impact:
HIGH

Timeline

Reported to Red Hat.

Made public. 2 days later.

Weakness Type

Inefficient Algorithmic Complexity

An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.


Products Associated with CVE-2026-92091

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Ansible Automation Platform
 
Red Hat Enterprise Linux (RHEL)
 
Red Hat Openshift Ai
 
Red Hat Openstack
 

Affected Versions

Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 7: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 9: Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 16.2: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: