CVE-2026-48990

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions 1.3.4 through 1.6.5, joserfc accepts oversized RFC7797 b64=false JWS payloads without applying JWSRegistry.max_payload_length, which can lead to resource exhaustion. The normal JWS compact and flattened JSON paths reject payloads above the configured payload-size limit with ExceededSizeError. The RFC7797 unencoded payload paths do not make the same check. A valid b64=false compact or flattened JSON JWS can therefore deserialize successfully with a payload larger than JWSRegistry.max_payload_length. Applications that accept lower-trust JWS values and rely on joserfc to reject oversized token content during verification have a moderate availability risk. This issue has been fixed in version 1.6.7.

• CWE-400
• CWE-770

• https://github.com/authlib/joserfc/releases/tag/1.6.7
• https://github.com/authlib/joserfc/security/advisories/GHSA-wphv-vfrh-23q5
• https://github.com/authlib/joserfc/security/advisories/GHSA-wphv-vfrh-23q5

Published

Jun 17, 2026

Last Modified

Jun 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48984pam_usb provides hardware authentication for Linux using ord…4.7
• CVE-2026-48985pam_usb provides hardware authentication for Linux using ord…5.5
• CVE-2026-48986pam_usb provides hardware authentication for Linux using rem…4.7
• CVE-2026-48988markdown-it is a Markdown parser. Versions 14.1.1 and below …5.3
• CVE-2026-48989Windows-MCP is an open-source project that integrates AI age…8.9
• CVE-2026-4899A security flaw has been discovered in code-projects Online …2.4
• CVE-2026-48991XianYuLauncher is a Minecraft Java Edition launcher. In vers…5.5
• CVE-2026-48994ImageMagick is free and open-source software used for editin…5.9
• CVE-2026-48995pnpm is a package manager. Prior to 10.33.4 and 11.0.7, a ma…7.5
• CVE-2026-48997e107 is a content management system (CMS). Versions 2.3.5 a…7.1
• CVE-2026-48998guzzlehttp/psr7 is a PSR-7 HTTP message library implementati…5.3
• CVE-2026-48999Attackers carefully craft malicious scripts, such as JavaScr…5.7