authlib joserfc up to 1.7.5 Compact JWS Deserialization deserialize_compact allocation of resources

Summaryinfo

A vulnerability, which was classified as problematic, has been found in authlib joserfc up to 1.7.5. This affects the function deserialize_compact of the component Compact JWS Deserialization. Performing a manipulation results in allocation of resources. This vulnerability was named CVE-2026-119284. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in authlib joserfc up to 1.7.5. It has been classified as problematic. This affects the function deserialize_compact of the component Compact JWS Deserialization. The manipulation with an unknown input leads to a allocation of resources vulnerability. CWE is classifying the issue as CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. This is going to have an impact on availability. The summary by CVE is:

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.6, joserfc compact JWS deserialization calls bytes.split() before enforcing the existing aggregate segment-size limits. When attacker-controlled compact serialization bytes reach deserialize_compact(), the split creates copies of the header, payload, and signature segments before ExceededSizeError rejects them, causing an additional allocation approximately proportional to the supplied token. Requests that exhaust available process memory can therefore cause an availability failure even though signature verification fails. This issue is fixed in version 1.7.6.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-119284 since 10/29/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

Upgrading to version 1.7.6 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-113401). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• authlib

Name

• joserfc

Version

• 1.7.0
• 1.7.1
• 1.7.2
• 1.7.3
• 1.7.4
• 1.7.5

Website

• Product: https://github.com/authlib/joserfc/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion