# joserfc (PyPI) vulnerabilities

6 known vulnerabilities (1 critical, 3 high, 2 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 1.8.0 (Nov 3, 2026): no advisory affects it
- Newest unaffected release: 1.8.0 (Nov 3, 2026), the latest release
- Weekly downloads: 27.1M
- Dependents: 10.3K
- Releases: 50 since 0.1.0 (Mar 5, 2023)
- Registry: https://pypi.org/project/joserfc/
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-119284: 0.1.0 to 1.7.5 (1.7.6 is outside it)
- CVE-2026-119283: 0.1.0 to 1.7.4 (1.7.5 is outside it)
- CVE-2026-49852: 0.1.0 to 1.6.7 (1.6.8 is outside it)
- CVE-2026-48990: 1.3.4 to 1.6.5 (1.6.7 is outside it)
- CVE-2026-27932: 0.1.0 to 1.6.2 (1.6.3 is outside it)
- CVE-2025-65015: 1.3.3 to 1.3.4 (1.3.5 is outside it); 1.4.0 to 1.4.1 (1.4.2 is outside it)

## Advisories (6)

### [CVE-2026-119284](https://cve.now/CVE-2026-119284): joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection

- Severity: Medium 6.9
- Published: Oct 29, 2026
- Affected: fixed in 1.7.6.
- Fixed in 1.7.6 (released Oct 18, 2026, 11 days before disclosure).
- The latest release, 1.8.0, is not affected.

### [CVE-2026-119283](https://cve.now/CVE-2026-119283): joserfc: Unbounded JWE General JSON \`recipients\` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption

- Severity: High 7.5
- Published: Oct 29, 2026
- Affected: fixed in 1.7.5.
- Fixed in 1.7.5 (released Aug 29, 2026, 61 days before disclosure).
- The latest release, 1.8.0, is not affected.

### [CVE-2026-49852](https://cve.now/CVE-2026-49852): joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)

- Severity: High 8.7
- Published: Jul 17, 2026
- Affected: fixed in 1.6.8.
- Fixed in 1.6.8 (released May 27, 2026, 51 days before disclosure).
- The latest release, 1.8.0, is not affected.

### [CVE-2026-48990](https://cve.now/CVE-2026-48990): joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization

- Severity: Medium 5.3
- Published: Jun 17, 2026
- Affected: from 1.3.4, fixed in 1.6.7.
- Fixed in 1.6.7 (released May 23, 2026, 25 days before disclosure).
- The latest release, 1.8.0, is not affected.

### [CVE-2026-27932](https://cve.now/CVE-2026-27932): joserfc PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS)

- Severity: High 7.5
- Published: Mar 3, 2026
- Affected: fixed in 1.6.3.
- Fixed in 1.6.3 (released Feb 25, 2026, 6 days before disclosure).
- The latest release, 1.8.0, is not affected.

### [CVE-2025-65015](https://cve.now/CVE-2025-65015): joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads

- Severity: Critical 9.2
- Published: Nov 18, 2025
- Affected: from 1.3.3, fixed in 1.3.5; from 1.4.0, fixed in 1.4.2.
- Fixed in 1.3.5 (released Nov 18, 2025, the day of disclosure) and 1.4.2 (released Nov 17, 2025, 1 day before disclosure).
- The latest release, 1.8.0, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/pypi/joserfc
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.