joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection

Summary joserfc 1.7.4 defines compact-JWS header, payload, and signature limits, but calls value.splitb"." before validating them. Python bytes.split copies the attacker-controlled segments, so the current guard allocates roughly one complete payload before rejecting it. Reproduction bash...

GHSA-9PG5-8C7X-5HFX joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection

Summary joserfc 1.7.4 defines compact-JWS header, payload, and signature limits, but calls value.splitb"." before validating them. Python bytes.split copies the attacker-controlled segments, so the current guard allocates roughly one complete payload before rejecting it. Reproduction bash...

CVE-2026-119284

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.6, joserfc compact JWS deserialization calls bytes.split before enforcing the existing aggregate segment-size limits. When attacker-controlled compact serializati...

DEBIAN-CVE-2026-119284

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.6, joserfc compact JWS deserialization calls bytes.split before enforcing the existing aggregate segment-size limits. When attacker-controlled compact serializati...

CVE-2026-119284 joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.6, joserfc compact JWS deserialization calls bytes.split before enforcing the existing aggregate segment-size limits. When attacker-controlled compact serializati...

CVE-2026-119284 joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.6, joserfc compact JWS deserialization calls bytes.split before enforcing the existing aggregate segment-size limits. When attacker-controlled compact serializati...

CVE-2026-119284 joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.6, joserfc compact JWS deserialization calls bytes.split before enforcing the existing aggregate segment-size limits. When attacker-controlled compact serializati...

CVE-2026-119284

The joserfc Python library, used for implementing JOSE standards, is vulnerable to an uncontrolled resource consumption issue (CWE-400) in versions prior to 1.7.6 . The flaw exists in the deserialize_compact() function, where the library calls bytes.split() before enforcing aggregate segment-size...