Skip to content
OpenAdvisories

Package · PyPI

joserfc

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.9
    CVE-2026-119284

    joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection

    joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.6, joserfc compact JWS deserialization calls bytes.split() before enforcing the existing aggregate segment-size limits. Wh…

    authlib joserfc open-webui joserfc Debian Ubuntu Wolfi PyPI
  • Medium 5.3
    CVE-2026-48990

    joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization

    joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions 1.3.4 through 1.6.5, joserfc accepts oversized RFC7797 b64=false JWS payloads without applying JWSRegistry.max_payload_leng…

    authlib joserfc airflow-3 joserfc Debian Ubuntu Wolfi PyPI