Threats tagged 'brew-kimi-cli-cve-2026-119284'

joserfc 1.7.4 has a vulnerability in its compact JWS size guard where it allocates attacker-controlled segments before rejecting oversized inputs. This occurs because the library calls bytes.split() on the input before validating its size, causing an additional allocation roughly equal to the payload size. The issue leads to increased memory usage prior to rejection but does not prevent transport-layer large headers. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity).