{"id":"CVE-2026-48990","title":"joserfc: joserfc: Resource exhaustion via oversized JSON Web Signature (JWS) payloads (CVE-2026-48990)","summary":"A flaw was found in joserfc, a Python library for JSON Object Signing and Encryption (JOSE). This vulnerability allows a remote attacker to cause resource exhaustion, leading to a Denial of Service (DoS), by sending oversized JSON Web Sign…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvssSource":"vendor","cwe":["CWE-770","CWE-400"],"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6","affected":["ansible_automation_platform 2.6","ansible_automation_platform 2.7","hardened_images","migration_toolkit_for_applications 8.2"],"patched":["ansible_automation_platform 2.6","ansible_automation_platform 2.7","hardened_images","migration_toolkit_for_applications 8.2"],"published":"2026-06-17","updated":"2026-10-16","sourceUpdated":"2026-10-16T11:23:26+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48990.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48990.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-48990"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490168"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48990"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48990"},{"url":"https://github.com/authlib/joserfc/releases/tag/1.6.7"},{"url":"https://github.com/authlib/joserfc/security/advisories/GHSA-wphv-vfrh-23q5"},{"url":"https://access.redhat.com/errata/RHSA-2026:50479"},{"url":"https://access.redhat.com/errata/RHSA-2026:50340"},{"url":"https://access.redhat.com/errata/RHSA-2026:25039"},{"url":"https://access.redhat.com/errata/RHSA-2026:43038"},{"url":"https://github.com/authlib/joserfc"},{"url":"https://github.com/advisories/GHSA-wphv-vfrh-23q5"}],"tags":["csaf","vex","red-hat","osv","pip","ghsa"],"epss":0.00163,"epssPercentile":0.05419,"aliases":["GHSA-wphv-vfrh-23q5","PYSEC-2026-2530"],"ecosystem":"pip","ingestedAt":"2026-06-29T13:24:35.253Z","slug":"CVE-2026-48990","body":"## Overview\n\nA flaw was found in joserfc, a Python library for JSON Object Signing and Encryption (JOSE). This vulnerability allows a remote attacker to cause resource exhaustion, leading to a Denial of Service (DoS), by sending oversized JSON Web Signature (JWS) payloads. The library fails to apply size limits, specifically JWSRegistry.max_payload_length, when processing RFC7797 b64=false JWS payloads.\n\n## Vendor advisories\n\n- **RHSA-2026:50479** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50479)\n- **RHSA-2026:50340** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50340)\n- **RHSA-2026:25039** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-06-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:25039)\n- **RHSA-2026:43038** · Red Hat · fixed in: Red Hat Migration Toolkit for Applications 8.2 · released 2026-07-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:43038)\n\n**joserfc: joserfc: Resource exhaustion via oversized JSON Web Signature (JWS) payloads** — rated Moderate by Red Hat. Released 2026-06-17, updated 2026-10-16.\n\nFixed:\n\n- Red Hat Ansible Automation Platform 2.6\n- Red Hat Ansible Automation Platform 2.7\n- Red Hat Hardened Images\n- Red Hat Migration Toolkit for Applications 8.2\n\nNot affected:\n\n- Red Hat Ansible Automation Platform 2.6\n- Red Hat Ansible Automation Platform 2.7\n- Red Hat Migration Toolkit for Applications 8.2\n- Red Hat Satellite 6\n\n## Remediation\n\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade https://access.redhat.com/errata/RHSA-2026:50479\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.7#Upgrade https://access.redhat.com/errata/RHSA-2026:50340\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:25039\n\nWorkarounds / mitigations:\n\n- The risk can be mitigated by rejecting oversized serialized JWS inputs before they reach joserfc and enforcing strict request/body size limits at the application or reverse-proxy layer.\n\n## Package advisory (CVE-2026-48990)\n\nAffected packages:\n\n- `joserfc >= 1.3.4, < 1.6.7`\n\nPatched in:\n\n- `joserfc 1.6.7`\n\nSource: https://osv.dev/vulnerability/GHSA-wphv-vfrh-23q5","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}