CVE-2026-48990: CWE-400: Uncontrolled Resource Consumption in authlib joserfc
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions 1.3.4 through 1.6.5, joserfc accepts oversized RFC7797 b64=false JWS payloads without applying JWSRegistry.max_payload_length, which can lead to resource exhaustion. The normal JWS compact and flattened JSON paths reject payloads above the configured payload-size limit with ExceededSizeError. The RFC7797 unencoded payload paths do not make the same check. A valid b64=false compact or flattened JSON JWS can therefore deserialize successfully with a payload larger than JWSRegistry.max_payload_length. Applications that accept lower-trust JWS values and rely on joserfc to reject oversized token content during verification have a moderate availability risk. This issue has been fixed in version 1.6.7.
AI Analysis
Technical Summary
In joserfc versions 1.3.4 through 1.6.5, the library fails to apply the configured maximum payload length (JWSRegistry.max_payload_length) to RFC7797 unencoded (b64=false) JWS payloads. While normal JWS compact and flattened JSON payloads are rejected if they exceed the size limit, the unencoded payload paths allow deserialization of oversized payloads. This can lead to uncontrolled resource consumption and availability degradation in applications relying on joserfc to enforce payload size limits during token verification. The vulnerability is tracked as CVE-2026-48990 and is fixed in version 1.6.7.
Potential Impact
The vulnerability allows an attacker to submit oversized unencoded JWS payloads that bypass the payload size checks, leading to resource exhaustion in the affected application. This results in a denial of service condition affecting availability. There is no impact on confidentiality or integrity. The risk is moderate and primarily affects applications that accept lower-trust JWS tokens and depend on joserfc for payload size enforcement.
Mitigation Recommendations
Upgrade joserfc to version 1.6.7 or later, where this issue is fixed. Until the upgrade, applications should implement additional payload size validation for RFC7797 b64=false JWS payloads before processing. Patch status is not explicitly stated in the vendor advisory, but the fix is available in version 1.6.7.
CVE-2026-48990: CWE-400: Uncontrolled Resource Consumption in authlib joserfc
Description
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions 1.3.4 through 1.6.5, joserfc accepts oversized RFC7797 b64=false JWS payloads without applying JWSRegistry.max_payload_length, which can lead to resource exhaustion. The normal JWS compact and flattened JSON paths reject payloads above the configured payload-size limit with ExceededSizeError. The RFC7797 unencoded payload paths do not make the same check. A valid b64=false compact or flattened JSON JWS can therefore deserialize successfully with a payload larger than JWSRegistry.max_payload_length. Applications that accept lower-trust JWS values and rely on joserfc to reject oversized token content during verification have a moderate availability risk. This issue has been fixed in version 1.6.7.
CVSS v3.1
Score 5.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In joserfc versions 1.3.4 through 1.6.5, the library fails to apply the configured maximum payload length (JWSRegistry.max_payload_length) to RFC7797 unencoded (b64=false) JWS payloads. While normal JWS compact and flattened JSON payloads are rejected if they exceed the size limit, the unencoded payload paths allow deserialization of oversized payloads. This can lead to uncontrolled resource consumption and availability degradation in applications relying on joserfc to enforce payload size limits during token verification. The vulnerability is tracked as CVE-2026-48990 and is fixed in version 1.6.7.
Potential Impact
The vulnerability allows an attacker to submit oversized unencoded JWS payloads that bypass the payload size checks, leading to resource exhaustion in the affected application. This results in a denial of service condition affecting availability. There is no impact on confidentiality or integrity. The risk is moderate and primarily affects applications that accept lower-trust JWS tokens and depend on joserfc for payload size enforcement.
Mitigation Recommendations
Upgrade joserfc to version 1.6.7 or later, where this issue is fixed. Until the upgrade, applications should implement additional payload size validation for RFC7797 b64=false JWS payloads before processing. Patch status is not explicitly stated in the vendor advisory, but the fix is available in version 1.6.7.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-26T23:26:07.975Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a33168ef198dc38c1148dbc
Added to database: 06/17/2026, 21:50:06 UTC
Last enriched: 06/17/2026, 22:06:08 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 89
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.