CVE-2026-119284: CVE-2026-119284: Uncontrolled Resource Consumption in joserfc Compact Deserialization

#security #cve #cybersecurity

CVE-2026-119284: Uncontrolled Resource Consumption in joserfc Compact Deserialization

Vulnerability ID: CVE-2026-119284
CVSS Score: 6.9
Published: 2026-10-30

CVE-2026-119284 (GHSA-9pg5-8c7x-5hfx) is an uncontrolled resource consumption vulnerability (CWE-400) in the compact serialization deserialization routines of joserfc prior to version 1.7.6. The library enforced individual segment size limits only after invoking Python's bytes.split(b'.') on untrusted input tokens. By sending oversized compact JWS or JWE tokens, an unauthenticated remote attacker can force the Python interpreter to duplicate and allocate memory for every segment before size validation executes, resulting in memory exhaustion and an Endpoint Denial of Service (DoS).

TL;DR

Prior to version 1.7.6, joserfc split compact JWS and JWE tokens into byte segments in memory before verifying token size limits. Unauthenticated attackers can send oversized tokens to trigger memory allocation amplification and crash application workers via Out-Of-Memory (OOM) conditions.

Technical Details

CVE ID: CVE-2026-119284 (GHSA-9pg5-8c7x-5hfx)
Weakness Class: CWE-400 (Uncontrolled Resource Consumption)
CVSS v4.0 Score: 6.9 Medium (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N)
EPSS Score: 0.19% (8.91st Percentile)
Attack Vector: Network (Unauthenticated HTTP requests containing oversized JOSE tokens)
Security Impact: Endpoint Denial of Service (DoS) via Out-Of-Memory (OOM) termination
Patched Version: joserfc >= 1.7.6
CISA KEV Status: Not Listed

Affected Systems

joserfc (Python Package Index / PyPI)
joserfc: < 1.7.6 (Fixed in: 1.7.6)

Code Analysis

Commit: 397e04f

fix: validate compact value size before split

--- a/src/joserfc/_rfc7515/registry.py
+++ b/src/joserfc/_rfc7515/registry.py
@@ -100,6 +100,11 @@ def check_header(self, header: Header) -> None:
         if self.strict_check_header:
             check_supported_header(self.header_registry, header)

+    def validate_compact_value_size(self, value: bytes) -> None:
+        max_length = self.max_header_length + self.max_payload_length + self.max_signature_length
+        if value and len(value) > max_length:
+            raise ExceededSizeError(f"Value size exceeds {max_length} bytes.")
+
     def validate_header_size(self, header: bytes) -> None:
         if header and len(header) > self.max_header_length:
             raise ExceededSizeError(f"Header size exceeds {self.max_header_length} bytes.")
--- a/src/joserfc/_rfc7516/compact.py
+++ b/src/joserfc/_rfc7516/compact.py
@@ -34,6 +34,8 @@ def represent_compact(obj: CompactEncryption) -> bytes:


 def extract_compact(value: bytes, registry: JWERegistry) -> CompactEncryption:
+    registry.validate_compact_value_size(value)
+
     parts = value.split(b".")
     if len(parts) != 5:
         raise ValueError("Invalid JSON Web Encryption")
--- a/src/joserfc/_rfc7516/registry.py
+++ b/src/joserfc/_rfc7516/registry.py
@@ -106,6 +106,17 @@ def check_header(self, header: Header, check_more: bool = False) -> None:
         elif self.strict_check_header:
             check_supported_header(self.header_registry, header)

+    def validate_compact_value_size(self, value: bytes) -> None:
+        max_length = (
+            self.max_protected_header_length
+            + self.max_encrypted_key_length
+            + self.max_initialization_vector_length
+            + self.max_ciphertext_length
+            + self.max_auth_tag_length
+        )
+        if value and len(value) > max_length:
+            raise ExceededSizeError(f"Value size exceeds {max_length} bytes.")
+
     def validate_protected_header_size(self, header: bytes) -> None:
         if header and len(header) > self.max_protected_header_length:
             raise ExceededSizeError(f"Header size exceeds {self.max_protected_header_length} bytes.")
--- a/src/joserfc/_rfc7797/compact.py
+++ b/src/joserfc/_rfc7797/compact.py
@@ -37,13 +37,15 @@ def extract_rfc7515_compact(
     :param registry: optional JWSRegistry instance
     :raise DecodeError: when decoding fails
     """
+    if registry is None:
+        registry = default_registry
+
+    registry.validate_compact_value_size(value)
+
     parts = value.split(b".")
     if len(parts) != 3:
         raise DecodeError("Invalid JSON Web Signature")

-    if registry is None:
-        registry = default_registry
-
     header_segment, payload_segment, signature_segment = parts

     registry.validate_header_size(header_segment)

Mitigation Strategies

Upgrade joserfc to version 1.7.6 or later to enforce O(1) aggregate length validation prior to token splitting.
Configure reverse proxies, load balancers, and API gateways (such as Nginx, Envoy, or AWS ALB) to enforce strict upper bounds on HTTP request body sizes and HTTP header buffers.
Implement application-level input length validation before passing untrusted token strings or byte buffers to deserialization libraries.
Tune JWSRegistry and JWERegistry segment size limits to match the specific maximum token sizes expected by your application.

Remediation Steps:

Update project dependency specifications (requirements.txt, pyproject.toml, or Poetry/Pipfile locks) to require joserfc>=1.7.6.
Run 'pip install --upgrade joserfc>=1.7.6' across all affected application environments and rebuild container images.
Verify that upstream reverse proxies enforce 'client_max_body_size' and header buffer limits appropriate for your API endpoints.
If immediate patching is blocked, wrap all calls to joserfc compact deserialization methods with an upfront 'len(token) > MAX_LIMIT' guard.

References

Read the full report for CVE-2026-119284 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community