Read the docs
TI-2026-36246 Aliases CVE-2026-48990GHSA-wphv-vfrh-23q5

joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization

Priority MEDIUM 63CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions 1.3.4 through 1.6.5, joserfc accepts oversized RFC7797 b64=false JWS payloads without applying JWSRegistry.max_payload_length, which can lead to resource exhaustion. The normal JWS compact and flattened JSON paths reject payloads above the configured payload-size limit with ExceededSizeError. The RFC7797 unencoded payload paths do not make the same check. A valid b64=false compact or flattened JSON JWS can therefore deserialize successfully with a payload larger than JWSRegistry.max_payload_length. Applications that accept lower-trust JWS values and rely on joserfc to reject oversized token content during verification have a moderate availability risk. This issue has been fixed in version 1.6.7.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00237 14th percentileScored 2026-11-07
Fix Fixed joserfc (authlib): 1.6.7joserfc (PyPI): 1.6.7Red Hat: 4 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
authlibjoserfcbefore 1.6.71.6.7Patch availableCNA
—joserfc (PyPI)1.3.4 to before 1.6.71.6.7Patch availableGHSA-wphv-vfrh-23q5
  • joserfc Vendorauthlib Affected before 1.6.7 Fixed in 1.6.7 Patch available CNA
  • joserfc (PyPI) Vendor— Affected 1.3.4 to before 1.6.7 Fixed in 1.6.7 Patch available GHSA-wphv-vfrh-23q5

Remediation

  • Fix · CNA joserfc (authlib) Fixed in 1.6.7
  • Fix · GHSA-wphv-vfrh-23q5 joserfc (PyPI) Fixed in 1.6.7 Advisory →

Red Hat 4 advisories

  • RHSA-2026:50479 Released 2026-08-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9 +7
  • RHSA-2026:50340 Released 2026-08-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.7 Container Release Update
    • Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-27/de-supported-rhel9 +7
  • RHSA-2026:43038 Released 2026-07-21 · Red Hat rating Critical
    Migration Toolkit for Applications
    • Red Hat Migration Toolkit for Applications 8.2 registry.redhat.io/mta/mta-cli-rhel9, registry.redhat.io/mta/mta-solution-server-rhel9
Show 1 more Red Hat advisories
  • RHSA-2026:25039 Released 2026-06-10 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images jaeger-2.19.0-1.hum1@aarch64, jaeger-2.19.0-1.hum1@src, jaeger-2.19.0-1.hum1@x86_64

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ansible Automation Platform 2.6Fixed RHSA-2026:50479
Red Hat Ansible Automation Platform 2.7Fixed RHSA-2026:50340
Red Hat Hardened ImagesFixed RHSA-2026:25039
Red Hat Migration Toolkit for Applications 8.2Fixed RHSA-2026:43038
Not affected: 4 products
  • Red Hat Ansible Automation Platform 2.6
  • Red Hat Ansible Automation Platform 2.7
  • Red Hat Migration Toolkit for Applications 8.2
  • Red Hat Satellite 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48990
  2. 2026-10-03 Alias added: GHSA-wphv-vfrh-23q5

References

Advisory 1

Other 3

  • TI-2026-65772 Insufficient verification of data authenticity in Authlib CVSS 3.1CRITICAL 9.8
  • TI-2026-74876 Signature verification bypass in joserfc JWS deserialization CVSS 3.1CRITICAL 9.1
  • TI-2026-22305 Authlib JWS JWK Header Injection: Signature Verification Bypass CVSS 3.1CRITICAL 9.1
  • TI-2025-40202 Resource allocation without limits in authlib joserfc CVSS 4.0CRITICAL 9.2
  • TI-2026-36756 joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363) CVSS 4.0HIGH 8.7
  • TI-2026-79518 Authlib fix bypass lets attackers forge HS256 tokens with PEM keys CVSS 3.1CRITICAL 9.1
See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences