{"id":"CVE-2026-119284","aliases":["GHSA-9pg5-8c7x-5hfx"],"title":"joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"## Summary\n\njoserfc 1.7.4 defines compact-JWS header, payload, and signature limits, but\ncalls `value.split(b\".\")` before validating them. Python `bytes.split()` copies\nthe attacker-controlled segments, so the current guard allocates roughly one\ncomplete payload before rejecting it.\n\n## Reproduction\n\n```bash\n.venv-research/bin/python 06-practical-testing/preauth-memory-profile.py\n```\n\nThe input is resident before a fork-isolated verifier runs, and every signature\nis invalid.\n\n| Input | Peak RSS delta | Amplification | Result |\n|---:|---:|---:|---|\n| 1 MiB | 1.11 MiB | 1.11× | size rejected |\n| 4 MiB | 4.04 MiB | 1.01× | size rejected |\n| 8 MiB | 8.04 MiB | 1.01× | size rejected |\n| 16 MiB | 16.04 MiB | 1.00× | size rejected |\n| 32 MiB | 31.74 MiB | 0.99× | size rejected |\n| 64 MiB | 63.80 MiB | 1.00× | size rejected |\n\nThe unconstrained profile is the primary evidence: joserfc allocates an\nadditional attacker-sized object before producing its intended\n`ExceededSizeError`. A separate baseline-plus-headroom stress test raises\n`MemoryError` when that copy cannot fit, but this report does not characterize\nan absolute `RLIMIT_AS` value as a realistic worker memory budget.\n\n## Security Argument\n\nThe issue is not that joserfc can prevent the transport layer from receiving a\nlarge header. The issue is narrower: once bytes reach `deserialize_compact()`,\nthe library's existing size guard cannot fulfill its allocation-limiting purpose\nbecause attacker-controlled segment copies are created first.\n\nThis differs from\n[GHSA-frfh-8v73-gjg4](https://github.com/authlib/joserfc/security/advisories/GHSA-frfh-8v73-gjg4),\nwhich concerned embedding already-loaded oversized segments in exception and log\nmessages. Here, the current implementation itself creates an additional\npayload-sized allocation before its fixed size exception.\n\n## Recommended Fix\n\nCheck `len(value)` against a maximum compact-serialization size before\n`split()`. If per-segment diagnostics are needed, locate delimiters with bounded\n`find()` operations or memory views, validate offsets and lengths, and only then\nmaterialize acceptable segments.","severity":"medium","score":6.9,"published":"2026-10-29T21:33:16.529Z","modified":"2026-10-30T17:05:38.184Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"PyPI","name":"joserfc","sources":[{"name":"OSV · GHSA-9pg5-8c7x-5hfx","url":"https://osv.dev/vulnerability/GHSA-9pg5-8c7x-5hfx"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.7.6"}],"type":"ECOSYSTEM"}],"versions":["0.1.0","0.10.0","0.11.0","0.11.1","0.12.0","0.2.0","0.3.0","0.4.0","0.5.0","0.6.0","0.7.0","0.8.0","0.9.0","1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.1.0","1.2.0","1.2.1","1.2.2","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.4.0","1.4.1","1.4.2","1.4.3","1.5.0","1.6.0","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5","1.6.7","1.6.8","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5"],"fixed":["1.7.6"]}],"sourceAffected":[],"references":["https://github.com/authlib/joserfc/security/advisories/GHSA-9pg5-8c7x-5hfx","https://nvd.nist.gov/vuln/detail/CVE-2026-119284","https://github.com/authlib/joserfc/commit/397e04f4bbce0b94d86e31c1c003f4640af8fb39","https://github.com/authlib/joserfc","https://github.com/authlib/joserfc/releases/tag/1.7.6"],"sources":[{"name":"OSV","id":"GHSA-9pg5-8c7x-5hfx","modified":"2026-10-30T15:15:03.588544987Z","url":"https://osv.dev/vulnerability/GHSA-9pg5-8c7x-5hfx"},{"name":"CVE","id":"CVE-2026-119284","modified":"2026-10-30T17:05:38.184Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-119284"}],"assessments":[{"source":"OSV","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":6.9},{"source":"GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":6.9}],"cve":{"records":[{"id":"CVE-2026-119284","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-29T18:50:28.065Z","published":"2026-10-29T21:33:16.529Z","modified":"2026-10-30T17:05:38.184Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-29T21:33:16.529Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T17:05:38.184Z"}],"references":[{"url":"https://github.com/authlib/joserfc/security/advisories/GHSA-9pg5-8c7x-5hfx","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/authlib/joserfc/commit/397e04f4bbce0b94d86e31c1c003f4640af8fb39","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/authlib/joserfc/releases/tag/1.7.6","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/authlib/joserfc/security/advisories/GHSA-9pg5-8c7x-5hfx","tags":["exploit"],"source":"CISA-ADP"}],"weaknesses":[{"id":"CWE-400","description":"CWE-400: Uncontrolled Resource Consumption","source":"GitHub_M"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T17:05:14.978930Z","decisions":[{"name":"Exploitation","value":"poc"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"products":[{"vendor":"authlib","name":"joserfc","platforms":[],"versions":[{"version":"< 1.7.6","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-119284"}],"remediation":[],"observedAt":"2026-10-30T18:56:03.139Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T09:10:30.844Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-29T23:00:49.817Z","attemptedAt":"2026-10-29T23:00:49.817Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-29T23:00:37.991Z","attemptedAt":"2026-10-29T23:00:37.991Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-29T23:00:39.041Z","attemptedAt":"2026-10-29T23:00:39.041Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-29T23:00:37.796Z","attemptedAt":"2026-10-29T23:00:37.796Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-113401","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113401","modified":"Oct 29, 2026, 9:33:16 PM","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","checkedAt":"2026-10-29T23:00:39.041Z"},{"source":"NVD","id":"CVE-2026-119284","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119284","modified":"2026-10-29T22:17:01.327","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-10-29T23:00:49.817Z"}],"aiSummary":null}