CVE-2026-119284: joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection

October 30, 2026

joserfc 1.7.4 defines compact-JWS header, payload, and signature limits, but calls value.split(b".") before validating them. Python bytes.split() copies the attacker-controlled segments, so the current guard allocates roughly one complete payload before rejecting it.

References

github.com/advisories/GHSA-9pg5-8c7x-5hfx
github.com/authlib/joserfc/commit/397e04f4bbce0b94d86e31c1c003f4640af8fb39
github.com/authlib/joserfc/releases/tag/1.7.6
github.com/authlib/joserfc/security/advisories/GHSA-9pg5-8c7x-5hfx
nvd.nist.gov/vuln/detail/CVE-2026-119284

Code Behaviors & Features

Detect and mitigate CVE-2026-119284 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →