Red Hat Updates cjose for CVE-2026-53938 Across RHEL 9 SAP Solutions Branches
Tech GuruQuick Answer
RHSA-2026:73017 and RHSA-2026:73018 fix cjose for RHEL 9.2 and 9.4 Update Services for SAP Solutions (E4S), respectively. A crafted JSON Web Encryption (JWE) input can trigger an out-of-bounds heap write during AES Key Wrap decryption. Red Hat describes denial of service and possible further memory corruption, not a demonstrated code-execution result in this notice.
Confirm Scope And Apply The Supported Fix
What to do now: identify applications actually loading cjose, then update the installed runtime RPM from the matching entitled E4S repository. If patching is delayed, Red Hat documents rejecting untrusted JWEs that select A128KW, A192KW or A256KW before decryption. Validate that application-specific control and its impact on legitimate authentication first.
Last verified: October 2, 2026 UTC against both Red Hat CSAF records. No token-processing or SAP application test was performed.
Scope And Authority
| Product scope | cjose on entitled RHEL 9.2 and 9.4 Update Services for SAP Solutions (E4S) AppStream branches; E4S is not an abbreviation for Extended Update Support |
|---|---|
| Advisory | RHSA-2026:73017 / RHSA-2026:73018 |
| CVE | CVE-2026-53938 |
| Authoritative release date | RHSA-2026:73017: 2026-09-29 07:08:01 UTC; RHSA-2026:73018: 2026-09-29 07:08:06 UTC |
| Authority revision date | CSAF version 3 generated 2026-09-29 at 17:20:01 UTC / 17:20:04 UTC respectively; not evidence by itself of a material fix change. |
| Affected versions | The RHEL 9.2 and 9.4 AppStream E4S branches identified by RHSA-2026:73017 and RHSA-2026:73018 before their advisory-listed fixed builds. |
| Fixed version | Runtime cjose: 0:0.6.1-13.el9_2.1 for RHEL 9.2/RHSA-2026:73017; 0:0.6.1-16.el9_4.1 for RHEL 9.4/RHSA-2026:73018. Choose the listed architecture; .src denotes source, not a runtime install target. |
| CVSS base score | 8.2 (official CVSS v3.1) |
| CVSS severity | High |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
The vulnerable path is AES Key Wrap processing of an attacker-supplied JWE. The presence of cjose does not mean every SAP application uses that path; identify the actual consumer. Red Hat rates these updates Important, while the CVSS v3.1 base score is 8.2 High. Those are distinct severity labels, not evidence of exploitation.
What To Validate Now
- Match the consumer and branch. Record the application loading cjose, its installed runtime RPM/architecture and the 9.2 or 9.4 E4S repository. Do not apply the other minor stream's build.
- Install the supported fix. Update through the matching entitled repository, then ensure long-running consumers use the new library under their approved restart procedure.
- Use a bounded interim control. If relying on Red Hat's workaround, reject
A128KW,A192KWandA256KWuntrusted JWEs at the application layer before the vulnerable decrypt call. Rejection after parsing/decryption is not the stated control. Retain patching as the permanent action. - Test token behavior. In an authorized test environment, verify intended login/token flows and rejection of prohibited algorithms without constructing a memory-corruption payload. Do not log live tokens, keys or user secrets.
- Keep evidence and exceptions. Retain package versions, consuming-process state and positive/negative token outcomes. Document clients broken by an interim algorithm restriction and resolve them with the application owner rather than silently bypassing the control.
Operational Cautions
These are branch-specific extended-support fixes. Confirm entitlement and repository configuration before deployment, preserve configuration and rollback options, and do not treat the CVSS score as evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
