---
id: CVE-2026-119284
title: >-
  joserfc: Compact JWS size guard allocates attacker-controlled segments before
  rejection
summary: >-
  joserfc is a Python library that provides an implementation of several JSON
  Object Signing and Encryption (JOSE) standards. Prior to 1.7.6, joserfc
  compact JWS deserialization calls bytes.split() before enforcing the existing
  aggregate s…
severity: medium
cvss: 6.9
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-400
vendor: authlib
product: joserfc
affected:
  - joserfc < 1.7.6
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-30T17:05:14.978930Z'
exploitAvailable: true
published: '2026-10-29'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T17:05:38.184Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119284'
references:
  - url: 'https://github.com/authlib/joserfc/security/advisories/GHSA-9pg5-8c7x-5hfx'
    label: 'https://github.com/authlib/joserfc/security/advisories/GHSA-9pg5-8c7x-5hfx'
  - url: >-
      https://github.com/authlib/joserfc/commit/397e04f4bbce0b94d86e31c1c003f4640af8fb39
    label: >-
      https://github.com/authlib/joserfc/commit/397e04f4bbce0b94d86e31c1c003f4640af8fb39
  - url: 'https://github.com/authlib/joserfc/releases/tag/1.7.6'
    label: 'https://github.com/authlib/joserfc/releases/tag/1.7.6'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-119284'
  - url: 'https://github.com/authlib/joserfc'
  - url: 'https://github.com/advisories/GHSA-9pg5-8c7x-5hfx'
tags:
  - cve.org
  - exploit-available
  - osv
  - pip
  - ghsa
epss: 0.00192
epssPercentile: 0.08981
aliases:
  - GHSA-9pg5-8c7x-5hfx
ecosystem: pip
patched:
  - joserfc 1.7.6
ingestedAt: '2026-10-30T15:02:40.134Z'
---

## Overview

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.6, joserfc compact JWS deserialization calls bytes.split() before enforcing the existing aggregate segment-size limits. When attacker-controlled compact serialization bytes reach deserialize_compact(), the split creates copies of the header, payload, and signature segments before ExceededSizeError rejects them, causing an additional allocation approximately proportional to the supplied token. Requests that exhaust available process memory can therefore cause an availability failure even though signature verification fails. This issue is fixed in version 1.7.6.

## Affected

- `joserfc < 1.7.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-119284)

Affected packages:

- `joserfc < 1.7.6`

Patched in:

- `joserfc 1.7.6`

Source: https://osv.dev/vulnerability/GHSA-9pg5-8c7x-5hfx