PyPIPackage

joserfc

6 known vulnerabilities (1 critical, 3 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release: 1.8.0 (Nov 3, 2026): no advisory affects it
Newest unaffected release: 1.8.0 (Nov 3, 2026), the latest release
Advisories: 6 · 1 critical, 3 high, 2 medium

Weekly downloads: 27.1M
Dependents: 10.3K
Releases: 50 since 0.1.0 (Mar 5, 2023)
Registry: PyPI
Releases read: Nov 8, 2026

Version timeline

CVE-2026-119284
Affects 0.1.0 to 1.7.5 (1.7.6 is outside it)
CVE-2026-119283
Affects 0.1.0 to 1.7.4 (1.7.5 is outside it)
CVE-2026-49852
Affects 0.1.0 to 1.6.7 (1.6.8 is outside it)
CVE-2026-48990
Affects 1.3.4 to 1.6.5 (1.6.7 is outside it)
CVE-2026-27932
Affects 0.1.0 to 1.6.2 (1.6.3 is outside it)
CVE-2025-65015
Affects 1.3.3 to 1.3.4 (1.3.5 is outside it); 1.4.0 to 1.4.1 (1.4.2 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 6

CVE-2026-119284Medium 6.9
joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection
Affected: fixed in 1.7.6.
Fixed in 1.7.6 (released Oct 18, 2026, 11 days before disclosure).
The latest release, 1.8.0, is not affected.
CVE-2026-119283High 7.5
joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption
Affected: fixed in 1.7.5.
Fixed in 1.7.5 (released Aug 29, 2026, 61 days before disclosure).
The latest release, 1.8.0, is not affected.
CVE-2026-49852High 8.7
joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)
Affected: fixed in 1.6.8.
Fixed in 1.6.8 (released May 27, 2026, 51 days before disclosure).
The latest release, 1.8.0, is not affected.
CVE-2026-48990Medium 5.3
joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization
Affected: from 1.3.4, fixed in 1.6.7.
Fixed in 1.6.7 (released May 23, 2026, 25 days before disclosure).
The latest release, 1.8.0, is not affected.
CVE-2026-27932High 7.5
joserfc PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS)
Affected: fixed in 1.6.3.
Fixed in 1.6.3 (released Feb 25, 2026, 6 days before disclosure).
The latest release, 1.8.0, is not affected.
CVE-2025-65015Critical 9.2
joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads
Affected: from 1.3.3, fixed in 1.3.5; from 1.4.0, fixed in 1.4.2.
Fixed in 1.3.5 (released Nov 18, 2025, the day of disclosure) and 1.4.2 (released Nov 17, 2025, 1 day before disclosure).
The latest release, 1.8.0, is not affected.