CVE-2022-38493: Rhonabwy Project Rhonabwy

High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days.

Rhonabwy 0.9.99 through 1.1.x before 1.1.7 doesn't check the RSA private key length before RSA-OAEP decryption. This allows attackers to cause a Denial of Service via a crafted JWE (JSON Web Encryption) token.

Affected products

• Rhonabwy Project Rhonabwy: from 0.9.99, before 1.1.6 (fixed in 1.1.6)

Published 2022-08-20. Last modified 2026-06-17.