CVE-2026-48990

Deferred Deferred - Pending Action

joserfc JWS Payload Size Validation Bypass

Publication date: 2026-06-17

Last updated on: 2026-06-23

Assigner: GitHub, Inc.

Description

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions 1.3.4 through 1.6.5, joserfc accepts oversized RFC7797 b64=false JWS payloads without applying JWSRegistry.max_payload_length, which can lead to resource exhaustion. The normal JWS compact and flattened JSON paths reject payloads above the configured payload-size limit with ExceededSizeError. The RFC7797 unencoded payload paths do not make the same check. A valid b64=false compact or flattened JSON JWS can therefore deserialize successfully with a payload larger than JWSRegistry.max_payload_length. Applications that accept lower-trust JWS values and rely on joserfc to reject oversized token content during verification have a moderate availability risk. This issue has been fixed in version 1.6.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-17

Last Modified

2026-06-23

Generated

2026-07-08

AI Q&A

2026-06-18

EPSS Evaluated

2026-07-06

NVD

CVE-2026-48990

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Compliance Impact

The vulnerability in joserfc allows oversized JWS payloads to be accepted without proper size checks, leading to potential resource exhaustion and moderate availability risk. However, there is no information provided about any direct impact on data confidentiality, integrity, or privacy controls that are typically required for compliance with standards like GDPR or HIPAA.

Since the vulnerability primarily affects availability and does not disclose or alter data, its effect on compliance with regulations focused on data protection and privacy is unclear based on the provided information.

Executive Summary

The vulnerability exists in the joserfc Python library versions 1.3.4 through 1.6.5, which implements JSON Object Signing and Encryption (JOSE) standards. Specifically, the library accepts oversized RFC7797 b64=false JWS payloads without enforcing the maximum payload length limit defined by JWSRegistry.max_payload_length. While normal JWS compact and flattened JSON paths reject payloads exceeding the size limit, the RFC7797 unencoded payload paths do not perform this check. This allows a valid b64=false compact or flattened JSON JWS to deserialize successfully with a payload larger than the configured maximum size.

Impact Analysis

This vulnerability can lead to resource exhaustion because oversized payloads are accepted without size checks. Applications that accept lower-trust JWS values and rely on joserfc to reject oversized token content during verification may experience moderate availability risks, such as denial of service or degraded performance.

Mitigation Strategies

To mitigate this vulnerability, upgrade the joserfc Python library to version 1.6.7 or later, where the issue has been fixed.

Avoid using affected versions (1.3.4 through 1.6.5) in applications that accept lower-trust JWS values and rely on joserfc to reject oversized token content during verification.

Hi! I’m here to help you understand CVE-2026-48990. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70