A flaw in the jwcrypto library causes the JWK.import_key() method to perform an O(n^2) duplicate check on the key_ops array, while the array length is unbounded. A remote, unauthenticated attacker can supply a JWK containing a very large key_ops array to any application that forwards attacker‑controlled JWKs to the import_key API—such as through ECDH‑ES key agreement, OIDC dynamic client registration, DPoP, or ACME account key registration. The resulting quadratic validation consumes excessive CPU time, leading to a denial of service.

The vulnerability affects multiple Red Hat products. Red Hat Ansible Automation Platform (version 2), Red Hat Enterprise Linux (7, 8, 9, 10), Red Hat OpenShift AI, and Red Hat OpenStack Platform (versions 16.2 and 17.1) all contain the impacted jwcrypto component. No specific sub‑versions are listed, so any release containing the library should be considered potentially vulnerable.

The CVSS score of 5.9 indicates a moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Exploitation requires an unauthenticated remote party to send a JWK to an application that forwards the key material to the jwcrypto import_key method. The requirement to target a specific API endpoint and to supply large key_ops arrays makes the attack surface narrower, but any deployment that accepts public keys from external sources is at risk of CPU exhaustion. The overall risk is moderate but should be mitigated in systems that process untrusted JWKs.