joserfc

PyPI · Package

6 reports

Vulnerability alerts

Report	Product	Ecosystem	Severity	Fix status	Last updated
joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key DecryptionCVE-2026-119283 · GHSA-JPXQ-7H8P-2Q76	joserfc Exploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9	PyPIRed Hat	High	Fix reported	2026-10-30
joserfc: Compact JWS size guard allocates attacker-controlled segments before rejectionCVE-2026-119284 · GHSA-9PG5-8C7X-5HFX	joserfc Exploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9	PyPIRed Hat	Medium	Fix reported	2026-10-30
joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token PayloadsCVE-2025-65015 · GHSA-FRFH-8V73-GJG4Version ranges need review.	joserfc	PyPI	Critical	Fix reported	2026-10-27
joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)CVE-2026-49852 · GHSA-GG9X-QCX2-XMRHVersion ranges need review.	joserfc	PyPI	High	Fix reported	2026-09-10
joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserializationCVE-2026-48990 · GHSA-WPHV-VFRH-23Q5Version ranges need review.	joserfc	PyPI	Medium	Fix reported	2026-09-10
joserfc's PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS)CVE-2026-27932 · GHSA-W5R5-M38G-F9F9Version ranges need review.	joserfc	PyPI	High	Fix reported	2026-09-10