Hi,

The following vulnerability was published for python-jwcrypto.

CVE-2026-92091[0]:
| A flaw was found in jwcrypto. The JWK.import_key() function
| validates the key_ops JWK member for duplicate values using an
| algorithm with O(n^2) time complexity, and the length of key_ops is
| not bounded. A remote, unauthenticated attacker can supply a JWK
| with a large key_ops array to an application that passes attacker-
| controlled key material to a public key-import API (reachable via
| ECDH-ES key agreement, OIDC dynamic client registration, DPoP, or
| ACME account key registration, among others) to consume excessive
| CPU time, resulting in a denial of service.

https://github.com/latchset/jwcrypto/security/advisories/GHSA-pwgw-f7xr-863h
https://github.com/latchset/jwcrypto/pull/398
https://github.com/latchset/jwcrypto/commit/21d2a2c20dbc1201ebe0b9b2621417629f37bfcd (v1.6.1)


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-92091
https://www.cve.org/CVERecord?id=CVE-2026-92091

Please adjust the affected versions in the BTS as needed.