ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2025-65015

sync 2026-10-27T17:28:59Z

Published Nov 18, 2025 · catalog updated Oct 27, 2026 · sync 2026-10-27T17:28:59Z

Last checked Nov 2, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2025-65015. EPSS is 0.44%. Act only if a listed version of sync 2026-10-27T17:28:59Z is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (sync 2026-10-27T17:28:59Z).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.

Same product and reporting

Severity
Critical9.2
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.44%
Remediation
Version ranges on file
Affected products
PyPI joserfc · stated named in the record · vendor authlib joserfc 1.4.0, < 1.4.2

### Summary The exception messages are embedded with non-decoded JWT token parts and may cause Python logging to record an arbitrarily large, forged JWT payload. ### Details In situations where a misconfigured — or entirely absent — production-grade web server sits in front of a Python web application, an attacker may be able to send arbitrarily large bearer tokens in the HTTP request headers. When this occurs, Python logging or diagnostic tools (e.g., Sentry) may end up processing extremely large log messages containing the full JWT header during the operation. The same behavior also appears when validating claims and signature payload sizes, as the library raises with the full payload embedded in the exception message. Since the payload is already fully loaded into memory at this stage, the library cannot prevent or reject it per se. It is therefore the responsibility of the underlying web server ( / , , , , ...etc) to enforce limits on header sizes. For example, a / application running _without_ and/or cannot enforce header size limits on its own. With / , the [--h11-max-incomplete-event-size ](https://uvicorn.dev/settings/#implementation:~:text=%2D%2Dh11%2Dmax%2Dincomplete%2Devent%2Dsize%20%3Cint%3E) option can restrict the total size of the header _plus_ body, but not the header alone. Similarly, [vLLM serve](https://docs.vllm.ai/en/latest/cli/serve/#-h11-max-incomplete-event-size) —due to its reliance on / and the need for heavy data transfer in ML inference workloads, sets a default limit of 4 MB for header _plus_ body and is frequently increased. In practice, a robust reverse proxy (such as ) is typically required because it can explicitly cap maximum header size. Unfortunately, many web applications do not run behind a proper reverse proxy. Given these constraints, the library cannot safely log or embed payloads of arbitrary size. This issue is particularly subtle, as it occurs only when a maliciously crafted JWT finally reaches the Python application, a sc

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • PyPI joserfc1.3.3 → 1.3.5
  • PyPI joserfc1.4.0 → 1.4.2
  • stated named in the record< 1.4.2
  • vendor authlib joserfc 1.4.0, < 1.4.21.4.0, < 1.4.2

How to fix CVE-2025-65015

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2025-65015. EPSS is 0.44%. Act only if a listed version of sync 2026-10-27T17:28:59Z is installed.

Which versions are affected?

Compare what you have installed with named in the record < 1.4.2; authlib joserfc 1.4.0, < 1.4.2 1.4.0, < 1.4.2. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-770: Allocation of Resources Without Limits or Throttling. EPSS 0.44%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 27, 2026 · PyPA Advisory Database

    Fix available

    joserfc fixed in 1.3.5; joserfc fixed in 1.4.2

  2. Oct 27, 2026 · PyPA Advisory Database

    Fix available

    joserfc fixed in 1.3.5

  3. Oct 27, 2026 · PyPA Advisory Database

    Fix available

    joserfc fixed in 1.4.2

  4. Oct 27, 2026 · PyPA Advisory Database

    Updated

    ### Summary The exception messages are embedded with non-decoded JWT token parts and may cause Python logging to record an arbitrarily large, forged JWT payload. ### Details In situations where a misconfigured — or entirely absent — production-grade web server sits in front of a Python web application, an attacker may be able to send arbitrarily large bearer tokens in the HTTP request headers. Whe

  5. Oct 27, 2026 · GitLab Advisory Database

    Detected

    The exception messages are embedded with non-decoded JWT token parts and may cause Python logging to record an arbitrarily large, forged JWT payload." -date: "2025-11-19" +date: "2026-10-27" pubdate: "2025-11-18" affected_range: ">=1.3.3, =1.4.0,<1.4.2" fixed_versions: @@ -26,9 +26,10 @@ urls: - "https://github.com/authlib/joserfc/security/advisories/GHSA-frfh-8v73-gjg4" - "https://github.com/auth

Sources

  • CVE.orgVulnerability recordCVE-2025-65015

    Official CVE identifier

    cve.org
  • EUVDVulnerability recordEUVD-2025-198059

    joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions from 1.3.3 to before 1.3.5 and from 1.4.0 to before 1.4.2, the ExceededSizeError exception messages are embedded with non-decoded JWT token part

    euvd.enisa.europa.eu
  • GitLab Advisory DatabasePackage advisorypypi/joserfc/CVE-2025-65015.yml

    The exception messages are embedded with non-decoded JWT token parts and may cause Python logging to record an arbitrarily large, forged JWT payload." -date: "2025-11-19" +date: "2026-10-27" pubdate: "2025-11-18" affected_range: ">=1.3.3, =1.4.0,<1.4.2" fixed_versions: @@ -26,9 +26,10 @@ urls: - "https://github.com/authlib/joserfc/security/advisories/GHSA-frfh-8v73-gjg4" - "https://github.com/auth

    gitlab.com
  • PyPA Advisory DatabasePackage advisoryGHSA-frfh-8v73-gjg4

    joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads

    osv.dev

References

Freshness

Last verified in this catalog Nov 2, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • EUVDOct 28, 2026
  • PyPA Advisory DatabaseOct 28, 2026
  • CVE.orgOct 27, 2026
  • GitLab Advisory DatabaseOct 27, 2026