PT-2026-132852
CVE-2026-119284
·
Published
2026-10-29
·
Updated
2026-10-30
Description by
CVSS 4.0
6.9
MediumMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
joserfc versions prior to 1.7.6
Description
In the compact JWS deserialization process, the library calls
bytes.split() before enforcing aggregate segment-size limits. When attacker-controlled compact serialization bytes are processed by the deserialize compact() function, the split operation creates copies of the header, payload, and signature segments before an ExceededSizeError is triggered. This results in an additional memory allocation proportional to the size of the supplied token, which can lead to process memory exhaustion and an availability failure, regardless of whether signature verification fails.Recommendations
Update to version 1.7.6.
Found an issue in the description? Have something to add? Feel free to write us 👾