{"metadata": {"vulnerability": "CVE-2026-119283", "count": 42, "kinds": {"milestone": 15, "sighting": 4, "kev": 0, "other": 23}, "linked_omitted": 0}, "data": [{"timestamp": "2026-10-06T13:46:43Z", "date_only": false, "value": "2026-10-06T13:46:43.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/authlib/joserfc/security/advisories/GHSA-jpxq-7h8p-2q76", "record": "CVE-2026-119283", "field": "creation_timestamp", "uuid": "7daf2d10-13c0-4580-9dbe-c2cd29bb30b9", "url": "https://github.com/authlib/joserfc/security/advisories/GHSA-jpxq-7h8p-2q76", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-29T18:50:28.064Z", "date_only": false, "value": "2026-10-29T18:50:28.064Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-119283", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-29T21:10:05.490Z", "date_only": false, "value": "2026-10-29T21:10:05.490Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-119283", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-29T21:10:05.490Z", "date_only": false, "value": "2026-10-29T21:10:05.490Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-119283", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-29T21:19:12.690Z", "date_only": false, "value": "2026-10-29T21:19:12.690417Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117526282383668732", "record": "CVE-2026-119283", "field": "creation_timestamp", "uuid": "76ff1a2d-e44c-4879-9615-e7c2a61d6701", "content": "CVE-2026-119283 joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.5, joserfc.jwe.decrypt_json() accepts a JWE General JSON Serialization recipients array without a count limit and calls decrypt_cek() for every entry. An unauthenticated attacker who can submit a JWE to an endpoint using an RSA key-management algorithm can choose the number of private-key decryption operations performed by one request. The verify_all_recipients option does not reduce this work because the affected loop processes every recipient before consulting that setting, allowing repeated requests to exhaust service CPU without affecting confidentiality or integrity. This issue is fixed in version 1.7.5.\nhttps://www.cve.org/CVERecord?id=CVE-2026-119283https://github.com/authlib/joserfc/security/advisories/GHSA-jpxq-7h8p-2q76https://github.com/authlib/joserfc/commit/d6dc8df6c7609277e741069d3733e43996c1cd17https://github.com/authlib/joserfc/releases/tag/1.7.5#authlib #joserfc#CVE_2026_119283#bot", "url": "https://infosec.exchange/users/cve/statuses/117526282383668732"}, {"timestamp": "2026-10-29T22:17:00Z", "date_only": false, "value": "2026-10-29T22:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-119283", "record": "UBUNTU-CVE-2026-119283", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-29T22:17:01Z", "date_only": false, "value": "2026-10-29T22:17:01Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-JPXQ-7H8P-2Q76", "record": "GHSA-JPXQ-7H8P-2Q76", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-29T22:17:01.047Z", "date_only": false, "value": "2026-10-29T22:17:01.047", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-119283", "record": "FKIE_CVE-2026-119283", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T03:46:45.039Z", "date_only": false, "value": "2026-10-30T03:46:45.039594Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mz2umkkhdq25", "record": "CVE-2026-119283", "field": "creation_timestamp", "uuid": "dca5b175-1e4c-4679-b6b1-990f123f81ed", "content": "\ud83d\udfe0 CVE-2026-119283 - High (7.5)\n\njoserfc is a Python library that provides an implementation of several JSON Object Signing and En...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-119283/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mz2umkkhdq25"}, {"timestamp": "2026-10-30T14:54:20Z", "date_only": false, "value": "2026-10-30T14:54:20Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-JPXQ-7H8P-2Q76", "record": "GHSA-JPXQ-7H8P-2Q76", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T14:54:20Z", "date_only": false, "value": "2026-10-30T14:54:20Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-JPXQ-7H8P-2Q76", "record": "GHSA-JPXQ-7H8P-2Q76", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-30T16:30:50Z", "date_only": false, "value": "2026-10-30T16:30:50.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/52ec63f0f0f608c3d91beaa580eb29e1", "record": "CVE-2026-119283", "field": "creation_timestamp", "uuid": "fdcb1ad7-86d0-4867-9a3f-a1ab3c8cc391", "content": "# CVE-2026-119283: CVE-2026-119283: Unbounded JWE Recipients Array Causes CPU Exhaustion in Authlib joserfc\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-10-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-119283\n\n## Summary\nA resource consumption vulnerability exists in the Authlib joserfc Python library prior to version 1.7.5. When processing JSON Web Encryption (JWE) objects formatted using General JSON Serialization, the library fails to enforce an upper bound on the number of elements within the recipients array. An unauthenticated attacker can supply a JWE containing thousands of recipient entries targeting an RSA key management algorithm, forcing the server to perform an equivalent number of computationally expensive RSA private-key decryption operations per request and exhausting available CPU resources.\n\n## TL;DR\nAuthlib joserfc versions prior to 1.7.5 do not limit the size of the JWE General JSON Serialization recipients array and fail to short-circuit decryption loops when verify_all_recipients is disabled. Attackers can send a single JWE request containing thousands of RSA recipient blocks to trigger repeated private-key modular exponentiation, causing a high-impact denial of service via CPU exhaustion.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **Vulnerability Class**: CWE-400: Uncontrolled Resource Consumption\n- **Attack Vector**: Network (Unauthenticated JWE General JSON payload)\n- **CVSS v3.1 Score**: 7.5 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\n- **EPSS Score**: 0.23% (13.73rd percentile)\n- **Security Impact**: Denial of Service via CPU exhaustion from repeated RSA decryptions\n- **Affected Function**: joserfc.jwe.decrypt_json() / _perform_decrypt()\n- **Patched Version**: joserfc 1.7.5\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Authlib joserfc Python library (< 1.7.5)\n- **joserfc**: < 1.7.5 (Fixed in: `1.7.5`)\n\n## Mitigation\n\n- Upgrade joserfc to version 1.7.5 or later to enforce the default 16-recipient limit on JWE General JSON Serialization objects.\n- Configure JWERegistry with a lower max_recipients value (e.g., max_recipients=1 or 2) and set verify_all_recipients=False if full multi-recipient verification is not required by the application architecture.\n- Use joserfc.jwe.decrypt_compact() instead of decrypt_json() on endpoints that only need to support JWE Compact Serialization.\n- Enforce HTTP request body size limits and JSON array length validation at the API gateway or WAF layer.\n\n**Remediation Steps:**\n1. Audit Python dependency manifests (requirements.txt, pyproject.toml, Pipfile.lock, poetry.lock) for versions of joserfc prior to 1.7.5.\n2. Run `pip install --upgrade 'joserfc>=1.7.5'` in affected environments and rebuild application containers.\n3. Review all calls to `joserfc.jwe.decrypt_json()` and pass a customized `JWERegistry(max_recipients=N, verify_all_recipients=False)` matching business requirements.\n4. Verify the remediation by running unit tests that submit a JWE General JSON payload exceeding `max_recipients` and confirming `ExceededSizeError` is raised.\n\n## References\n\n- [GitHub Security Advisory: GHSA-jpxq-7h8p-2q76](https://github.com/authlib/joserfc/security/advisories/GHSA-jpxq-7h8p-2q76)\n- [Authlib joserfc Patch Commit d6dc8df6c7609277e741069d3733e43996c1cd17](https://github.com/authlib/joserfc/commit/d6dc8df6c7609277e741069d3733e43996c1cd17)\n- [Authlib joserfc Release 1.7.5](https://github.com/authlib/joserfc/releases/tag/1.7.5)\n- [NVD - CVE-2026-119283](https://nvd.nist.gov/vuln/detail/CVE-2026-119283)\n- [CVE.org Record: CVE-2026-119283](https://www.cve.org/CVERecord?id=CVE-2026-119283)\n- [CVEList V5 JSON Record: CVE-2026-119283](https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119283.json)\n- [Shodan CVEDB: CVE-2026-119283](https://cvedb.shodan.io/cve/CVE-2026-119283)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-119283) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/52ec63f0f0f608c3d91beaa580eb29e1"}, {"timestamp": "2026-10-30T17:08:00.789Z", "date_only": false, "value": "2026-10-30T17:08:00.789446Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-119283", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-30T17:08:00.789Z", "date_only": false, "value": "2026-10-30T17:08:00.789446Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-119283", "record": "FKIE_CVE-2026-119283", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-10-30T17:08:26.483Z", "date_only": false, "value": "2026-10-30T17:08:26.483Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-119283", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-30T17:08:26.483Z", "date_only": false, "value": "2026-10-30T17:08:26.483Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-119283", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-30T17:17:17.740Z", "date_only": false, "value": "2026-10-30T17:17:17.740", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-119283", "record": "FKIE_CVE-2026-119283", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-31T08:46:31Z", "date_only": false, "value": "2026-10-31T08:46:31Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-SAFETY-CVE-2026-119283", "record": "BREW-SAFETY-CVE-2026-119283", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-31T08:46:31Z", "date_only": false, "value": "2026-10-31T08:46:31Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-SAFETY-CVE-2026-119283", "record": "BREW-SAFETY-CVE-2026-119283", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-31T09:09:54Z", "date_only": false, "value": "2026-10-31T09:09:54Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-OTERM-CVE-2026-119283", "record": "BREW-OTERM-CVE-2026-119283", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-31T09:09:54Z", "date_only": false, "value": "2026-10-31T09:09:54Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-OTERM-CVE-2026-119283", "record": "BREW-OTERM-CVE-2026-119283", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-31T09:19:49Z", "date_only": false, "value": "2026-10-31T09:19:49Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-MCP-ATLASSIAN-CVE-2026-119283", "record": "BREW-MCP-ATLASSIAN-CVE-2026-119283", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-31T09:57:52Z", "date_only": false, "value": "2026-10-31T09:57:52Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-WEAVIATE-CLI-CVE-2026-119283", "record": "BREW-WEAVIATE-CLI-CVE-2026-119283", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-31T09:57:52Z", "date_only": false, "value": "2026-10-31T09:57:52Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-WEAVIATE-CLI-CVE-2026-119283", "record": "BREW-WEAVIATE-CLI-CVE-2026-119283", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-31T10:19:08Z", "date_only": false, "value": "2026-10-31T10:19:08Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-FASTMCP-CVE-2026-119283", "record": "BREW-FASTMCP-CVE-2026-119283", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-31T10:32:15Z", "date_only": false, "value": "2026-10-31T10:32:15Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-MCPM-CVE-2026-119283", "record": "BREW-MCPM-CVE-2026-119283", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-31T10:32:15Z", "date_only": false, "value": "2026-10-31T10:32:15Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-MCPM-CVE-2026-119283", "record": "BREW-MCPM-CVE-2026-119283", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-31T10:32:38Z", "date_only": false, "value": "2026-10-31T10:32:38Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-KASKADE-CVE-2026-119283", "record": "BREW-KASKADE-CVE-2026-119283", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-31T10:32:38Z", "date_only": false, "value": "2026-10-31T10:32:38Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-KASKADE-CVE-2026-119283", "record": "BREW-KASKADE-CVE-2026-119283", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-31T11:03:21Z", "date_only": false, "value": "2026-10-31T11:03:21Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-KIMI-CLI-CVE-2026-119283", "record": "BREW-KIMI-CLI-CVE-2026-119283", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-31T11:23:21Z", "date_only": false, "value": "2026-10-31T11:23:21Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-MOTO-CVE-2026-119283", "record": "BREW-MOTO-CVE-2026-119283", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-31T11:23:21Z", "date_only": false, "value": "2026-10-31T11:23:21Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-MOTO-CVE-2026-119283", "record": "BREW-MOTO-CVE-2026-119283", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-02T11:01:00Z", "date_only": false, "value": "2026-11-02T11:01:00Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-KIMI-CLI-CVE-2026-119283", "record": "BREW-KIMI-CLI-CVE-2026-119283", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-05T04:42:51Z", "date_only": false, "value": "2026-11-05T04:42:51Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-119283", "record": "UBUNTU-CVE-2026-119283", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-10T09:52:21Z", "date_only": false, "value": "2026-11-10T09:52:21Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-MCP-ATLASSIAN-CVE-2026-119283", "record": "BREW-MCP-ATLASSIAN-CVE-2026-119283", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-11T00:00:00Z", "date_only": false, "value": "2026-11-11T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12533-1", "record": "OPENSUSE-SU-2026:12533-1", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-11T00:00:00Z", "date_only": false, "value": "2026-11-11T00:00:00Z", "kind": "other", "label": "Document generated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12533-1", "record": "OPENSUSE-SU-2026:12533-1", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-11T00:00:00Z", "date_only": false, "value": "2026-11-11T00:00:00Z", "kind": "other", "label": "Impact", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12533-1", "record": "OPENSUSE-SU-2026:12533-1", "field": "vulnerabilities.0.threats.0.date", "linked_record": true}, {"timestamp": "2026-11-11T00:00:00Z", "date_only": false, "value": "2026-11-11T00:00:00Z", "kind": "milestone", "label": "Published", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12533-1", "record": "OPENSUSE-SU-2026:12533-1", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-11T10:24:35Z", "date_only": false, "value": "2026-11-11T10:24:35Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-FASTMCP-CVE-2026-119283", "record": "BREW-FASTMCP-CVE-2026-119283", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-12T11:01:49Z", "date_only": false, "value": "2026-11-12T11:01:49Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12533-1", "record": "OPENSUSE-SU-2026:12533-1", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-11-12T11:01:49Z", "date_only": false, "value": "2026-11-12T11:01:49Z", "kind": "other", "label": "Updated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12533-1", "record": "OPENSUSE-SU-2026:12533-1", "field": "document.tracking.current_release_date", "linked_record": true}], "metrics": {"as_of": "2026-11-13T01:07:48.026Z", "anchors": {"origin": {"timestamp": "2026-10-29T21:10:05.490Z", "date_only": false, "value": "2026-10-29T21:10:05.490Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-119283", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-29T21:10:05.490Z", "date_only": false, "value": "2026-10-29T21:10:05.490Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-119283", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-10-06T13:46:43Z", "date_only": false, "value": "2026-10-06T13:46:43.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/authlib/joserfc/security/advisories/GHSA-jpxq-7h8p-2q76", "record": "CVE-2026-119283", "field": "creation_timestamp", "uuid": "7daf2d10-13c0-4580-9dbe-c2cd29bb30b9", "url": "https://github.com/authlib/joserfc/security/advisories/GHSA-jpxq-7h8p-2q76", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": -2013802.49, "hours": -559.3895805555555, "days": -23.307899189814815, "min_seconds": -2013802.49, "max_seconds": -2013802.49, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": true, "start": {"timestamp": "2026-10-29T21:10:05.490Z", "date_only": false, "value": "2026-10-29T21:10:05.490Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-119283", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-06T13:46:43Z", "date_only": false, "value": "2026-10-06T13:46:43.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/authlib/joserfc/security/advisories/GHSA-jpxq-7h8p-2q76", "record": "CVE-2026-119283", "field": "creation_timestamp", "uuid": "7daf2d10-13c0-4580-9dbe-c2cd29bb30b9", "url": "https://github.com/authlib/joserfc/security/advisories/GHSA-jpxq-7h8p-2q76", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 1223862.536405, "hours": 339.9618156680555, "days": 14.165075652835647, "min_seconds": 1223862.536405, "max_seconds": 1223862.536405, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-29T21:10:05.490Z", "date_only": false, "value": "2026-10-29T21:10:05.490Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-119283", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-13T01:07:48.026Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 3237665.026405, "hours": 899.3513962236111, "days": 37.472974842650466, "min_seconds": 3237665.026405, "max_seconds": 3237665.026405, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-06T13:46:43Z", "date_only": false, "value": "2026-10-06T13:46:43.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/authlib/joserfc/security/advisories/GHSA-jpxq-7h8p-2q76", "record": "CVE-2026-119283", "field": "creation_timestamp", "uuid": "7daf2d10-13c0-4580-9dbe-c2cd29bb30b9", "url": "https://github.com/authlib/joserfc/security/advisories/GHSA-jpxq-7h8p-2q76", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-13T01:07:48.026Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}