Executive Summary

The vulnerability exists in the joserfc Python library versions 1.3.4 through 1.6.5, which implements JSON Object Signing and Encryption (JOSE) standards. Specifically, the library accepts oversized RFC7797 b64=false JWS payloads without enforcing the maximum payload length limit defined by JWSRegistry.max_payload_length. While normal JWS compact and flattened JSON paths reject payloads exceeding the size limit, the RFC7797 unencoded payload paths do not perform this check. This allows a valid b64=false compact or flattened JSON JWS to deserialize successfully with a payload larger than the configured maximum size.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to resource exhaustion because oversized payloads are accepted without size checks. Applications that accept lower-trust JWS values and rely on joserfc to reject oversized token content during verification may experience moderate availability risks, such as denial of service or degraded performance.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade the joserfc Python library to version 1.6.7 or later, where the issue has been fixed.

Avoid using affected versions (1.3.4 through 1.6.5) in applications that accept lower-trust JWS values and rely on joserfc to reject oversized token content during verification.

Useful 0 Not Useful 0