authlib joserfc vulnerabilities

CVEs per yearBy the year they were published

1. 20251
2. 20268

Newest CVEs

• CVE-2026-119284

  joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection

  authlib · joserfc

  Medium6.9
• CVE-2026-119283

  joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption

  authlib · joserfc

  High7.5
• CVE-2026-102946

  joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json

  authlib · joserfc

  Critical9.1
• CVE-2026-75509

  joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti)

  authlib · joserfc

  Medium6.5
• CVE-2026-62995

  joserfc accepts JWT with padding, leading to JWT malleability

  authlib · joserfc

  Low2.3
• CVE-2026-49852

  joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)

  authlib · joserfc

  High8.7
• CVE-2026-48990

  joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization

  authlib · joserfc

  Medium5.3
• CVE-2026-27932

  joserfc PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS)

  authlib · joserfc

  High7.5
• CVE-2025-65015

  joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads

  authlib · joserfc

  Critical9.2