DEBIAN-CVE-2026-119284: Medium severity debian/joserfc vulnerability

Q: Who is exposed to this issue?

Applications using joserfc that pass attacker-controlled compact JWS serialization bytes to deserialize_compact() are exposed. An attacker can trigger the condition remotely where such input is accepted over a network.

Q: Does exploitation require authentication or a valid signature?

No. The issue has no authentication or user-interaction requirement, and the token signature does not need to verify. Memory can be exhausted before the oversized token is rejected.

Q: What happens during exploitation?

joserfc splits the supplied compact JWS bytes into header, payload, and signature copies before applying its aggregate segment-size limits. This creates an extra allocation roughly proportional to the supplied token and can cause a process availability failure if memory is exhausted.

Q: What version contains the fix?

The issue is fixed in joserfc version 1.7.6.

Published Oct 29, 2026

Updated

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.6, joserfc compact JWS deserialization calls bytes.split() before enforcing the existing aggregate segment-size limits. When attacker-controlled compact serialization bytes reach deserializecompact(), the split creates copies of the header, payload, and signature segments before ExceededSizeError rejects them, causing an additional allocation approximately proportional to the supplied token. Requests that exhaust available process memory can therefore cause an availability failure even though signature verification fails. This issue is fixed in version 1.7.6.

Affected Software

2 affected componentsFixes available

debian/joserfc*

debian/joserfc<1.7.7-1

1.7.7-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/joserfc to a version that resolves this vulnerability.
Fixed in 1.7.7-1
Upgrade
Upgrade joserfc to a version that resolves this vulnerability.
Fixed in 1.7.6

Event History

Oct 29, 2026

CVE Published

via OSV·10:17 PM

Data Sourced

via OSV·10:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Applications using joserfc that pass attacker-controlled compact JWS serialization bytes to deserialize_compact() are exposed. An attacker can trigger the condition remotely where such input is accepted over a network.

Does exploitation require authentication or a valid signature?

No. The issue has no authentication or user-interaction requirement, and the token signature does not need to verify. Memory can be exhausted before the oversized token is rejected.

What happens during exploitation?

joserfc splits the supplied compact JWS bytes into header, payload, and signature copies before applying its aggregate segment-size limits. This creates an extra allocation roughly proportional to the supplied token and can cause a process availability failure if memory is exhausted.

What version contains the fix?

The issue is fixed in joserfc version 1.7.6.

DEBIAN-CVE-2026-119284: Medium severity debian/joserfc vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

Does exploitation require authentication or a valid signature?

What happens during exploitation?

What version contains the fix?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

Does exploitation require authentication or a valid signature?

What happens during exploitation?

What version contains the fix?