Threats tagged 'brew-mcp-atlassian-cve-2026-119284'

joserfc version 0.21.1_3 up to but not including 0.23.1_2 has a vulnerability in its compact JWS size guard. The library calls bytes.split() on attacker-controlled input before validating segment sizes, causing it to allocate memory roughly equal to the payload size before rejecting it. This can lead to excessive memory allocation prior to size checks. A fix is available in version 0.23.1_2 that adds length checks before splitting the input.