The joserfc library's decrypt_json() function for JWE General JSON Serialization does not limit the number of recipients in the 'recipients' array. An attacker can supply a JWE with an unbounded number of recipients, causing the library to perform a costly RSA private-key decryption operation for each recipient. This leads to a CPU exhaustion denial-of-service (DoS) condition. The library's documented mitigation option verify_all_recipients=False does not reduce CPU usage, as all recipients are decrypted unconditionally before this flag is checked. A fix is available in version 2.15.0_3.
CVE-2026-116672 is a vulnerability in Authlib's implementation of the OAuth 2.0 Dynamic Client Registration Management Protocol (RFC 7592). The provided example code for the ClientConfigurationEndpoint fails to bind the registration_access_token to the specific client being accessed, allowing an attacker with any valid token and knowledge of a client_id to bypass authorization and modify or delete client registrations. This flaw arises because the example implementations do not verify that the token belongs to the client targeted by the request. A fix is available in version 2.15.0_5.
pyasn1 versions up to 0.6.4 contain a denial of service vulnerability in the decoding of binary-encoded ASN.1 REAL values with large mantissas. The decoding process has quadratic time complexity relative to the mantissa size, causing excessive CPU consumption during decoding. This affects BER, CER, and DER decoders using the shared RealPayloadDecoder. The vulnerability can be triggered by attacker-controlled ASN.1 input containing REAL values. A fix is available in pyasn1 version 0.6.5.
pyasn1 versions through 0.6.4 have a vulnerability in decoding constructed BIT STRING values where CPU consumption grows quadratically with input size due to repeated shifting and copying during decoding. This can lead to CPU exhaustion and denial of service when processing attacker-controlled ASN.1 data. The issue affects BER and CER decoders and certain schema-driven DER decoding paths. No confidentiality or integrity impact is reported. The vulnerability has a CVSS score of 7.5, indicating high severity.
pyasn1 versions 0.6.4 and earlier contain a denial-of-service vulnerability due to quadratic-time complexity when decoding constructed OCTET STRINGs, certain constructed character strings, and indefinite-length ANY types. This occurs because the decoder repeatedly copies accumulated fragments, causing CPU exhaustion with crafted ASN.1 inputs. The issue affects BER and CER decoding paths and certain non-conforming DER inputs when using an asn1Spec. No confidentiality or integrity impacts are reported. The vulnerability has a CVSS score of 7.5 (high severity).
CVE-2026-119194 is a vulnerability in the pyasn1 library used by mistral-vibe that causes quadratic CPU usage when decoding attacker-controlled BER, CER, or DER data without an ASN.1 schema. An attacker can craft inputs with many distinct long tag IDs that cause excessive CPU consumption, potentially leading to denial of service by exhausting CPU resources. The issue arises from the decoder's handling of TagSet insertion, which grows quadratically with the number of distinct tags. No confidentiality or integrity impact is reported.
OAuthlib contains a vulnerability in its token grant handlers where an authenticated client can supply a different client_id in the token request body, causing grant and scope validation to be performed under that other client identity. This affects the client_credentials and password grant flows. An attacker with credentials for a low-privilege client can obtain tokens with the privileges of a higher-privilege client if the application validator authorizes based on the attacker-supplied client_id argument. This is an authorization bypass requiring valid client credentials.