CVE-2026-48990: joserfc RFC7797 Payload Size Bypass Leads to Denial of Service

Technical summary

The vulnerability stems from incomplete input validation in joserfc's RFC7797 unencoded payload (b64=false) processing path. When JWSRegistry.max_payload_length is configured, the library enforces this limit during deserialization for standard JWS compact and flattened JSON formats, raising an ExceededSizeError for oversized content. However, the RFC7797 code path does not perform this same boundary check before accepting and processing the payload. This allows an attacker to construct a valid JWS with b64=false that contains a payload exceeding max_payload_length without triggering validation rejection. The oversized payload remains in memory during verification and processing, creating a resource exhaustion vector.

Business impact

Applications using joserfc to validate and process user-supplied JWS tokens face moderate availability risk if they rely on the library's max_payload_length setting as a defense against resource exhaustion. If an application accepts JWS tokens from lower-trust sources—such as third-party integrations, API clients, or user uploads—attackers can repeatedly submit crafted b64=false tokens to consume memory and degrade or disable service. This risk is most acute in multi-tenant environments, serverless platforms with per-function memory limits, and edge computing scenarios where memory is constrained. Organizations should assess whether their applications enforce JWS payload size restrictions and whether those restrictions are a documented security control.

Affected systems

The vulnerability affects joserfc versions 1.3.4 through 1.6.5. Any Python application that imports and uses joserfc for JWS verification or deserialization is potentially exposed if: (1) the application processes JWS tokens from untrusted sources, (2) JWSRegistry.max_payload_length is configured, and (3) the application does not implement additional upstream payload size checks. Applications using only standard JWS compact or JSON formats without RFC7797 support may have lower practical risk, depending on how the library is invoked. Patched version 1.6.7 is available.

Exploitability

The vulnerability has low barrier to exploitation. An attacker needs only to craft a valid JWS with b64=false and an oversized payload; no special cryptographic material, network access privileges, or complex social engineering is required. The attack can be automated and scaled to target multiple instances in parallel. However, practical impact depends on application design: applications that implement upstream payload size limits, rate-limit token processing, or use memory-bounded execution environments may experience limited effect. No known public exploits or active KEV listing indicate this is not yet widely weaponized, but the straightforward nature of the attack suggests rapid adoption if exploitation code emerges.

Remediation

Upgrade joserfc to version 1.6.7 or later immediately. For applications unable to upgrade promptly, implement compensating controls: validate JWS payload size upstream before passing tokens to joserfc, enforce strict rate limiting on token verification operations per source IP or user, and monitor memory usage for anomalous spikes correlated with JWS processing. Consider restricting acceptance of RFC7797 b64=false tokens if they are not a required feature; consult the application's JWS configuration to disable support if feasible.

Patch guidance

Upgrade the joserfc package to version 1.6.7 or any later release. If your application uses dependency pinning or vendoring, update your lock files and rebuild. Verify the upgrade by checking the version number in your Python environment (python -c "import joserfc; print(joserfc.__version__)") or by reviewing your dependency manifest. Test after upgrade to ensure RFC7797 token handling still works as expected for your use cases; version 1.6.7 introduces stricter validation that should not affect legitimate tokens but may reject previously-undetected oversized payloads.

Detection guidance

Monitor application logs and metrics for: (1) repeated ExceededSizeError exceptions or similar validation failures, which may indicate attempted exploitation; (2) unexpected memory growth or out-of-memory errors correlated with JWS verification activity; (3) HTTP 5xx errors from token validation endpoints. If feasible, instrument joserfc calls to log the b64 parameter and payload size of incoming JWS tokens; oversized b64=false payloads are a strong indicator of exploitation. Network-based detection is limited because the attack payload is encrypted or obscured within the JWS structure, but log analysis of validation failures and resource exhaustion is practical.

Why prioritize this

This vulnerability merits prompt but measured attention. The CVSS 5.3 MEDIUM score reflects limited scope (availability only, no confidentiality or integrity impact) and the requirement that an application must both accept untrusted JWS input and rely on joserfc for size enforcement. However, the ease of exploitation and the direct availability impact make it higher priority than the score alone suggests. Organizations should prioritize patching if they: (1) process JWS from external sources; (2) run joserfc in memory-constrained environments; (3) have documented availability or SLA commitments. Lower priority for applications that are air-gapped, process only trusted JWS, or already enforce upstream payload validation.

Risk score, explained

CVSS 5.3 (MEDIUM) reflects: low attack complexity (no special conditions required), network-based attack vector (any remote user can send a crafted JWS), no privileges or user interaction needed, and limited scope to the confidentiality, integrity, and availability of the affected service. The low-range MEDIUM score acknowledges that impact is availability-only and depends on application-specific reliance on joserfc's max_payload_length control. If an application has already implemented its own payload limits or uses joserfc in a memory-safe container, practical risk is reduced.

Frequently asked questions