CVE-2026-119284

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.6, joserfc compact JWS deserialization calls bytes.split() before enforcing the existing aggregate segment-size limits. When attacker-controlled compact serialization bytes reach deserialize_compact(), the split creates copies of the header, payload, and signature segments before ExceededSizeError rejects them, causing an additional allocation approximately proportional to the supplied token. Requests that exhaust available process memory can therefore cause an availability failure even though signature verification fails. This issue is fixed in version 1.7.6.

• CWE-400

• https://github.com/authlib/joserfc/commit/397e04f4bbce0b94d86e31c1c003f4640af8fb39
• https://github.com/authlib/joserfc/releases/tag/1.7.6
• https://github.com/authlib/joserfc/security/advisories/GHSA-9pg5-8c7x-5hfx
• https://github.com/authlib/joserfc/security/advisories/GHSA-9pg5-8c7x-5hfx

Published

Oct 29, 2026

Last Modified

Oct 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-119279MariaDB Connector/J is used to connect applications develope…5.9
• CVE-2026-11928IBM Verify Identity Access is vulnerable to a buffer overflo…9.8
• CVE-2026-119280MariaDB Connector/J is used to connect applications develope…3.7
• CVE-2026-119281MariaDB Connector/J is used to connect applications develope…5.9
• CVE-2026-119282Nx is a monorepo solution for TypeScript and polyglot codeba…7.3
• CVE-2026-119283joserfc is a Python library that provides an implementation …7.5
• CVE-2026-119285Fiber is an Express inspired web framework written in Go. Fr…5.9
• CVE-2026-119286GraphQL-core is a Python port of the GraphQL.js reference im…7.5
• CVE-2026-119287Zuke is a code-first, strongly typed build automation system…8
• CVE-2026-119288Zuke is a code-first, strongly typed build automation system…7
• CVE-2026-119289Zuke is a code-first, strongly typed build automation system…7.1
• CVE-2026-11929IBM Security Verify Identity Access Reverse Proxy in certain…7.5