Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-48990 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions 1.3.4 through 1.6.5, joserfc accepts oversized RFC7797 b64=false JWS payloads without applying JWSRegistry.max_payload_length, which can lead to resource exhaustion. The normal JWS compact and flattened JSON paths reject payloads above the configured payload-size limit with ExceededSizeError. The RFC7797 unencoded payload paths do not make the same check. A valid b64=false compact or flattened JSON JWS can therefore deserialize successfully with a payload larger than JWSRegistry.max_payload_length. Applications that accept lower-trust JWS values and rely on joserfc to reject oversized token content during verification have a moderate availability risk. This issue has been fixed in version 1.6.7.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CNA: [email protected]CVSS-B:5.3 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/authlib/joserfc/security/advisories/GHSA-wphv-vfrh-23q5	CISA-ADP	AdvisoryExploitRemedyVendor
https://github.com/authlib/joserfc/releases/tag/1.6.7	[email protected]	Release NotesVendor
https://github.com/authlib/joserfc/security/advisories/GHSA-wphv-vfrh-23q5	[email protected]	AdvisoryExploitRemedyVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-400	Uncontrolled Resource Consumption	[email protected]
CWE-770	Allocation of Resources Without Limits or Throttling	[email protected]

Affected Products

Product	Versions
authlib joserfc	>= 1.3.4, <= 1.6.5 (semver)
CPE No CPEs found in CPE dictionary for this product. Remediation Upgrade: 1.6.7moderate efforthttps://github.com/authlib/joserfc/releases/tag/1.6.7 Mitigation:low effort Reject oversized serialized JWS inputs before passing them to joserfc, disable or disallow RFC7797 b64=false tokens if not needed, and enforce strict request/header/body size limits at the application or reverse-proxy layer.

Product

Versions

authlib joserfc

>= 1.3.4, <= 1.6.5 (semver)

CPE

No CPEs found in CPE dictionary for this product.

Remediation

Upgrade: 1.6.7moderate efforthttps://github.com/authlib/joserfc/releases/tag/1.6.7
Mitigation:low effort
Reject oversized serialized JWS inputs before passing them to joserfc, disable or disallow RFC7797 b64=false tokens if not needed, and enforce strict request/header/body size limits at the application or reverse-proxy layer.

Change History

2 change records found show changes

Date	Action	Recorded By
Jun 18, 2026	CVE Modified	CISA-ADP
Jun 17, 2026	New CVE Received	[email protected]