# Gnoppix Security Announcement - 2026-09-15T20:03:38.769-04:00 **URL:** \ **Category:** Issues and Help\ **Created:** [September 16, 2026, 12:03am UTC](https://forum.gnoppix.org/t/gnoppix-security-announcement-2026-09-15t2038-769-04-00/7356 "2026-09-16T00:03:39Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![amu](https://forum.gnoppix.org/user_avatar/forum.gnoppix.org/amu/32/7_2.png) [@amu](https://forum.gnoppix.org/u/amu)\ **Post date:** [September 16, 2026, 12:03am UTC](https://forum.gnoppix.org/t/gnoppix-security-announcement-2026-09-15t2038-769-04-00/7356/1 "2026-09-16T00:03:39Z")
## Gnoppix Security Advisory: cjose Security Update Gnoppix Security released GSA-6499-1 for the cjose library. The update fixes a vulnerability that could let remote attackers crash services or run arbitrary code. Upgrade immediately. ### What Is Affected? cjose is a C library for JSON Object Signing and Encryption (JOSE). It parses and validates JWT, JWS, and JWE tokens in many applications. ### Vulnerability Details A malformed JWE token triggers an invalid pointer dereference. This causes a denial of service. Memory corruption could lead to remote code execution in some environments. > Critical warning: Any service processing untrusted JOSE tokens is exposed. Patch before accepting untrusted input. ### Affected Versions - **Gnoppix 24/25 (oldstable):** versions before 0.6.2.2 - **Gnoppix 26 (stable):** versions before 0.6.2.2 - **Gnoppix 27 (testing):** versions before 0.6.2.3 ### Fixed Packages - **Gnoppix 24/25 (oldstable):** upgrade to 0.6.2.2-1 - **Gnoppix 26 (stable):** upgrade to 0.6.2.2-1 - **Gnoppix 27 (testing):** upgrade to 0.6.2.3-1 ### Action Required Run `apt update && apt upgrade cjose`, then restart all dependent services. A full restart is required for the fix to take effect. ### No Workaround There is no practical workaround. Restrict access to trusted clients until the upgrade is complete. See the Gnoppix Security tracker for package hashes. - Please update your systems.