CVE-2025-65015

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions from 1.3.3 to before 1.3.5 and from 1.4.0 to before 1.4.2, the ExceededSizeError exception messages are embedded with non-decoded JWT token parts and may cause Python logging to record an arbitrarily large, forged JWT payload. In situations where a misconfigured — or entirely absent — production-grade web server sits in front of a Python web application, an attacker may be able to send arbitrarily large bearer tokens in the HTTP request headers. When this occurs, Python logging or diagnostic tools (e.g., Sentry) may end up processing extremely large log messages containing the full JWT header during the joserfc.jwt.decode() operation. The same behavior also appears when validating claims and signature payload sizes, as the library raises joserfc.errors.ExceededSizeError() with the full payload embedded in the exception message. Since the payload is already fully loaded into memory at this stage, the library cannot prevent or reject it. This issue has been patched in versions 1.3.5 and 1.4.2.

• CWE-770

• https://github.com/authlib/joserfc/commit/63932f169d924caffafa761af2122b82059017f7Patch
• https://github.com/authlib/joserfc/commit/673c8743fd0605b0e1de6452be6cba75f44e466bPatch
• https://github.com/authlib/joserfc/releases/tag/1.3.5Release Notes
• https://github.com/authlib/joserfc/releases/tag/1.4.2Release Notes
• https://github.com/authlib/joserfc/security/advisories/GHSA-frfh-8v73-gjg4Exploit, Vendor Advisory
• https://github.com/authlib/joserfc/security/advisories/GHSA-frfh-8v73-gjg4Exploit, Vendor Advisory

Published

Nov 18, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-6501A vulnerability, which was classified as critical, was found…9.8
• CVE-2025-65010WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR2…7.1
• CVE-2025-65011In WODESYS WD-R608U router (also known as WDR122B V2.0 and W…7.1
• CVE-2025-65012Kirby is an open-source content management system. From vers…5.4
• CVE-2025-65013LibreNMS is an auto-discovering PHP/MySQL/SNMP based network…6.1
• CVE-2025-65014LibreNMS is an auto-discovering PHP/MySQL/SNMP based network…3.7
• CVE-2025-65017Decidim is a participatory democracy framework. In versions …6.5
• CVE-2025-65018LIBPNG is a reference library for use in applications that r…7.1
• CVE-2025-65019Astro is a web framework. Prior to version 5.15.9, when usin…6.1
• CVE-2025-6502A vulnerability has been found in code-projects Inventory Ma…9.8
• CVE-2025-65020Rallly is an open-source scheduling and collaboration tool. …6.5
• CVE-2025-65021Rallly is an open-source scheduling and collaboration tool. …9.1