Medium 6.9Published Oct 29, 2026

CVE-2026-119284joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection

Updated under an hour ago (Oct 30, 2026, 4:23 AM ET)

Does this affect you?

It affects authlib joserfc. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stackFree account, 3 products Every CVE for authlib joserfc Exploited in the last 30 days

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.6, joserfc compact JWS deserialization calls bytes.split() before enforcing the existing aggregate segment-size limits. When attacker-controlled compact serialization bytes reach deserialize_compact(), the split creates copies of the header, payload, and signature segments before ExceededSizeError rejects them, causing an additional allocation approximately proportional to the supplied token. Requests that exhaust available process memory can therefore cause an availability failure even though signature verification fails. This issue is fixed in version 1.7.6.

CVSS: 6.9 MEDIUM (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness (CWE): CWE-400
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Deferred
Record last updated: Oct 29, 2026
First seen by InfoSec Signals: Oct 29, 2026

Affected products

Affected products

authlib joserfc authlib:joserfc (from the name)	before 1.7.6	CNA record

References

References

https://github.com/authlib/joserfc/security/advisories/GHSA-9pg5-8c7x-5hfx	x-refsource-confirm
https://github.com/authlib/joserfc/commit/397e04f4bbce0b94d86e31c1c003f4640af8fb39	x-refsource-misc
https://github.com/authlib/joserfc/releases/tag/1.7.6	x-refsource-misc

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.