What’s Vulnerable › Products

authlib joserfc vulnerabilities

9 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Check whether your authlib joserfc version is affected

Latest authlib joserfc vulnerabilities

• CVE-2026-119284 — joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection (CVSS 6.9)
• CVE-2026-119283 — joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption (CVSS 7.5)
• CVE-2026-102946 — joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json (CVSS 9.1)
• CVE-2026-75509 — joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti) (CVSS 6.5)
• CVE-2026-62995 — joserfc accepts JWT with padding, leading to JWT malleability (CVSS 2.3)
• CVE-2026-49852 — joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363) (CVSS 8.7)
• CVE-2026-48990 — joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization (CVSS 5.3)
• CVE-2026-27932 — joserfc PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS) (CVSS 7.5)
• CVE-2025-65015 — joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads (CVSS 7.5)