https://github.com/OpenIDC/cjose/security/advisories/GHSA-75r7-f5cv-g3wj reports:
OpenIDC/cjose is a C library implementing the Javascript
Object Signing and Encryption (JOSE). Prior to version
0.6.2.5, cjose's JWE decryption path for the AES Key Wrap
key-management algorithms (`alg` = `A128KW`, `A192KW`,
`A256KW`) does not validate the length of the
attacker-supplied `encrypted_key` (JWE Encrypted Key)
before unwrapping it into a fixed-size, heap-allocated
Content Encryption Key (CEK) buffer. A remote,
unauthenticated attacker who can submit a crafted JWE to
an application that decrypts it with an AES-KW symmetric
key can trigger an out-of-bounds heap write, corrupting
the heap. This leads at minimum to a crash (denial of
service) and, depending on the heap layout and allocator,
may be leverageable for further memory-corruption impact.
`cjose_jwe_import()` / `cjose_jwe_decrypt()` are
pre-authentication entry points: they parse and process
fully attacker-controlled input. Upgrade to cjose 0.6.2.5
to receive a patch. If upgrading is not immediately
possible, reject the AES Key Wrap algorithms
(`A128KW`/`A192KW`/`A256KW`) for untrusted JWEs at the
application layer.