SZB-477c7ca44c
EUVD lists CVSS 6.9 JWS parsing issue in joserfc before 1.7.6
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- authlib
- Product
- joserfc
- First seen
Summary
The EUVD entry EUVD-2026-113401 describes an issue in joserfc before 1.7.6, where compact JWS deserialization splits input before enforcing segment-size limits. The item gives a CVSS v3.1 score of 6.9.
If you use authlib
Upgrade joserfc to version 1.7.6 or later
Limit the size of untrusted JWS input before parsing
Upgrade joserfc to the patched version listed in the EUVD entry
Limit or reject JWE inputs with excessive recipients until patched
What the sources say 2
· Mastodon: “Prior to 1.7.6, joserfc compact JWS deserialization calls bytes.split() before enforcing the existing aggregate segment-size limits....” Source
· Mastodon: “joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption” Source