Threats tagged 'ghsa-frfh-8v73-gjg4'

The joserfc library versions 1.3.3 up to but not including 1.3.5 and 1.4.0 up to but not including 1.4.2 contain a vulnerability where logging or diagnostic tools may process arbitrarily large JWT tokens embedded in exception messages. This can lead to uncontrolled resource consumption when a maliciously crafted large JWT token is sent to a Python web application that does not have proper HTTP header size limits enforced by its web server or reverse proxy.