Skip to content
OpenAdvisories

Package · Debian

joserfc

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.5
    CVE-2026-119283

    joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption

    joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.5, joserfc.jwe.decrypt_json() accepts a JWE General JSON Serialization recipients array without a count limit and calls de…

    authlib joserfc joserfc joserfc Debian Ubuntu PyPI
  • High 8.7
    CVE-2026-49852

    joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)

    joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.6.8, joserfc.jwt.decode accepts attacker-forged HMAC-signed tokens when the caller-supplied verification key is the empty st…

    authlib joserfc joserfc joserfc Debian Ubuntu PyPI
  • High 7.5
    CVE-2026-27932

    joserfc PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS)

    joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In 1.6.2 and earlier, a resource exhaustion vulnerability in joserfc allows an unauthenticated attacker to cause a Denial of Service (D…

    authlib joserfc joserfc joserfc Debian Ubuntu PyPI