Read the docs
TI-2025-40202 Aliases CVE-2025-65015GHSA-frfh-8v73-gjg4

Resource allocation without limits in authlib joserfc

Priority HIGH 79CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions from 1.3.3 to before 1.3.5 and from 1.4.0 to before 1.4.2, the ExceededSizeError exception messages are embedded with non-decoded JWT token parts and may cause Python logging to record an arbitrarily large, forged JWT payload. In situations where a misconfigured — or entirely absent — production-grade web server sits in front of a Python web application, an attacker may be able to send arbitrarily large bearer tokens in the HTTP request headers. When this occurs, Python logging or diagnostic tools (e.g., Sentry) may end up processing extremely large log messages containing the full JWT header during the joserfc.jwt.decode() operation. The same behavior also appears when validating claims and signature payload sizes, as the library raises joserfc.errors.ExceededSizeError() with the full payload embedded in the exception message. Since the payload is already fully loaded into memory at this stage, the library cannot prevent or reject it. This issue has been patched in versions 1.3.5 and 1.4.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0044 38th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed joserfc (authlib): 1.3.5, 1.4.2joserfc (PyPI): 1.3.5, 1.4.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
authlibjoserfc1.3.3 to before 1.3.5; 1.4.0 to before 1.4.21.3.5, 1.4.2Patch availableCNA
—joserfc (PyPI)1.3.3 to before 1.3.51.3.5Patch availableGHSA-frfh-8v73-gjg4
—joserfc (PyPI)1.4.0 to before 1.4.21.4.2Patch availableGHSA-frfh-8v73-gjg4
  • joserfc Vendorauthlib Affected 1.3.3 to before 1.3.5; 1.4.0 to before 1.4.2 Fixed in 1.3.5, 1.4.2 Patch available CNA
  • joserfc (PyPI) Vendor— Affected 1.3.3 to before 1.3.5 Fixed in 1.3.5 Patch available GHSA-frfh-8v73-gjg4
  • joserfc (PyPI) Vendor— Affected 1.4.0 to before 1.4.2 Fixed in 1.4.2 Patch available GHSA-frfh-8v73-gjg4

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:hsiaoming:joserfc:*:*:*:*:*:python:*:*1.3.3 to before 1.3.5; 1.4.0 to before 1.4.2VulnerableHsiaoming
  • cpe:2.3:a:hsiaoming:joserfc:*:*:*:*:*:python:*:* Versions 1.3.3 to before 1.3.5; 1.4.0 to before 1.4.2 Vulnerable ·Hsiaoming

Remediation

  • Fix · CNA joserfc (authlib) Fixed in 1.3.5, 1.4.2
  • Fix · GHSA-frfh-8v73-gjg4 joserfc (PyPI) Fixed in 1.3.5 Advisory →
  • Fix · GHSA-frfh-8v73-gjg4 joserfc (PyPI) Fixed in 1.4.2 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-65015
  2. 2026-10-03 Alias added: GHSA-frfh-8v73-gjg4

References

Exploit 1

Patch 2

Advisory 1

Other 5

  • TI-2026-65772 Insufficient verification of data authenticity in Authlib CVSS 3.1CRITICAL 9.8
  • TI-2026-74876 Signature verification bypass in joserfc JWS deserialization CVSS 3.1CRITICAL 9.1
  • TI-2026-22305 Authlib JWS JWK Header Injection: Signature Verification Bypass CVSS 3.1CRITICAL 9.1
  • TI-2026-36756 joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363) CVSS 4.0HIGH 8.7
  • TI-2026-79518 Authlib fix bypass lets attackers forge HS256 tokens with PEM keys CVSS 3.1CRITICAL 9.1
  • TI-2026-82772 Uncontrolled resource consumption in authlib joserfc CVSS 3.1HIGH 7.5
See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences