ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-119284

joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection

Published Oct 29, 2026 · catalog updated Oct 30, 2026 · joserfc: Compact JWS size

Last checked Nov 3, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-119284. EPSS is 0.19%. Act only if a listed version of joserfc: Compact JWS size is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (joserfc: Compact JWS size).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.

Same product and reporting

Severity
Medium6.9
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.19%
Remediation
Advisory link
Affected products
PyPI joserfc · pypi joserfc · vendor authlib joserfc

## Summary joserfc 1.7.4 defines compact-JWS header, payload, and signature limits, but calls before validating them. Python copies the attacker-controlled segments, so the current guard allocates roughly one complete payload before rejecting it. ## Reproduction The input is resident before a fork-isolated verifier runs, and every signature is invalid. | Input | Peak RSS delta | Amplification | Result | |---:|---:|---:|---| | 1 MiB | 1.11 MiB | 1.11× | size rejected | | 4 MiB | 4.04 MiB | 1.01× | size rejected | | 8 MiB | 8.04 MiB | 1.01× | size rejected | | 16 MiB | 16.04 MiB | 1.00× | size rejected | | 32 MiB | 31.74 MiB | 0.99× | size rejected | | 64 MiB | 63.80 MiB | 1.00× | size rejected | The unconstrained profile is the primary evidence: joserfc allocates an additional attacker-sized object before producing its intended . A separate baseline-plus-headroom stress test raises when that copy cannot fit, but this report does not characterize an absolute value as a realistic worker memory budget. ## Security Argument The issue is not that joserfc can prevent the transport layer from receiving a large header. The issue is narrower: once bytes reach , the library's existing size guard cannot fulfill its allocation-limiting purpose because attacker-controlled segment copies are created first. This differs from [GHSA-frfh-8v73-gjg4](https://github.com/authlib/joserfc/security/advisories/GHSA-frfh-8v73-gjg4), which concerned embedding already-loaded oversized segments in exception and log messages. Here, the current implementation itself creates an additional payload-sized allocation before its fixed size exception. ## Recommended Fix Check against a maximum compact-serialization size before . If per-segment diagnostics are needed, locate delimiters with bounded operations or memory views, validate offsets and lengths, and only then materialize acceptable segments.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • PyPI joserfc0 → 1.7.6
  • pypi joserfcversion unspecified
  • vendor authlib joserfcversion unspecified

How to fix CVE-2026-119284

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-119284. EPSS is 0.19%. Act only if a listed version of joserfc: Compact JWS size is installed.

Which versions are affected?

Compare what you have installed with 0 → 1.7.6. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-400: Uncontrolled Resource Consumption. EPSS 0.19%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 30, 2026 · PyPA Advisory Database

    Detected

    ## Summary joserfc 1.7.4 defines compact-JWS header, payload, and signature limits, but calls before validating them. Python copies the attacker-controlled segments, so the current guard allocates roughly one complete payload before rejecting it. ## Reproduction The input is resident before a fork-isolated verifier runs, and every signature is invalid. | Input | Peak RSS delta | Amplification | Re

  2. Oct 30, 2026 · PyPA Advisory Database

    Fix available

    joserfc fixed in 1.7.6

  3. Oct 30, 2026 · PyPA Advisory Database

    Fix available

    joserfc fixed in 1.7.6

  4. Oct 30, 2026 · PyPA Advisory Database

    Updated

    ## Summary joserfc 1.7.4 defines compact-JWS header, payload, and signature limits, but calls before validating them. Python copies the attacker-controlled segments, so the current guard allocates roughly one complete payload before rejecting it. ## Reproduction The input is resident before a fork-isolated verifier runs, and every signature is invalid. | Input | Peak RSS delta | Amplification | Re

  5. Oct 30, 2026 · CVE.org

    Updated

    joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.6, joserfc compact JWS deserialization calls bytes.split() before enforcing the existing aggregate segment-size limits. When attacker-controlled compact serialization bytes reach deserialize_compact(), the split creates copies of the header, payload, and signatur

Sources

  • CVE.orgVulnerability recordCVE-2026-119284

    joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.6, joserfc compact JWS deserialization calls bytes.split() before enforcing the existing aggregate segment-size limits. When attacker-controlle

    cve.org
  • GitLab Advisory DatabasePackage advisoryCVE-2026-119284

    joserfc 1.7.4 defines compact-JWS header, payload, and signature limits, but calls value.split(b".") before validating them. Python bytes.split() copies the attacker-controlled segments, so the current guard allocates roughly one complete payload before rejecting it.

    advisories.gitlab.com
  • PyPA Advisory DatabasePackage advisoryGHSA-9pg5-8c7x-5hfx

    joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection

    osv.dev

References

Freshness

Last verified in this catalog Nov 2, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • GitLab Advisory DatabaseNov 3, 2026
  • PyPA Advisory DatabaseOct 31, 2026
  • CVE.orgOct 30, 2026