CRITICALPyPI
GHSA-frfh-8v73-gjg4· CVE-2025-65015, PYSEC-2026-361joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads
Modified: 9/10/2026
package
PyPI/joserfc
pkg:pypi/joserfc
HIGHPyPI
GHSA-gg9x-qcx2-xmrh· CVE-2026-49852, PYSEC-2026-2528joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-w5r5-m38g-f9f9· CVE-2026-27932, PYSEC-2026-2529joserfc's PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS)
Modified: 9/10/2026
MEDIUM5.3PyPI
GHSA-wphv-vfrh-23q5· CVE-2026-48990, PYSEC-2026-2530joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization
Modified: 9/10/2026
—PyPI
PYSEC-2026-2528· CVE-2026-49852, GHSA-gg9x-qcx2-xmrhjoserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)
Modified: 7/13/2026
HIGH7.5PyPI
PYSEC-2026-2529· CVE-2026-27932, GHSA-w5r5-m38g-f9f9joserfc's PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS)
Modified: 7/13/2026
MEDIUM5.3PyPI
PYSEC-2026-2530· CVE-2026-48990, GHSA-wphv-vfrh-23q5joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization
Modified: 7/13/2026
—PyPI
PYSEC-2026-361· CVE-2025-65015, GHSA-frfh-8v73-gjg4joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads
Modified: 7/2/2026