Skip to content
OpenAdvisories

Package · Debian

joserfc

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-102946

    joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json

    joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Serialization with an empty signatures array as authenticated…

    authlib joserfc joserfc joserfc Debian Ubuntu
  • Critical 9.2
    CVE-2025-65015

    joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads

    joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions from 1.3.3 to before 1.3.5 and from 1.4.0 to before 1.4.2, the ExceededSizeError exception messages are embedded with non-d…

    authlib joserfc joserfc joserfc Debian Ubuntu PyPI