CVE-2026-48990

{
  "id": "CVE-2026-48990",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-17T22:16:23.270",
  "lastModified": "2026-10-26T12:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions 1.3.4 through 1.6.5, joserfc accepts oversized RFC7797 b64=false JWS payloads without applying JWSRegistry.max_payload_length, which can lead to resource exhaustion. The normal JWS compact and flattened JSON paths reject payloads above the configured payload-size limit with ExceededSizeError. The RFC7797 unencoded payload paths do not make the same check. A valid b64=false compact or flattened JSON JWS can therefore deserialize successfully with a payload larger than JWSRegistry.max_payload_length. Applications that accept lower-trust JWS values and rely on joserfc to reject oversized token content during verification have a moderate availability risk. This issue has been fixed in version 1.6.7."
    },
    {
      "lang": "es",
      "value": "joserfc es una biblioteca de Python que proporciona una implementación de varios estándares de Firma y Cifrado de Objetos JSON (JOSE). En las versiones 1.3.4 a 1.6.5, joserfc acepta cargas útiles JWS RFC7797 b64=false de tamaño excesivo sin aplicar JWSRegistry.max_payload_length, lo que puede llevar al agotamiento de recursos. Las rutas JSON JWS compactas y aplanadas normales rechazan las cargas útiles que superan el límite de tamaño de carga útil configurado con ExceededSizeError. Las rutas de carga útil sin codificar RFC7797 no realizan la misma comprobación. Un JWS JSON compacto o aplanado b64=false válido puede, por lo tanto, deserializarse correctamente con una carga útil mayor que JWSRegistry.max_payload_length. Las aplicaciones que aceptan valores JWS de menor confianza y dependen de joserfc para rechazar contenido de token de tamaño excesivo durante la verificación tienen un riesgo de disponibilidad moderado. Este problema ha sido solucionado en la versión 1.6.7."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "authlib",
          "product": "joserfc",
          "versions": [
            {
              "version": "< 1.6.7",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-18T12:51:44.745917Z",
          "id": "CVE-2026-48990",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        },
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/authlib/joserfc/releases/tag/1.6.7",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/authlib/joserfc/security/advisories/GHSA-wphv-vfrh-23q5",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/authlib/joserfc/security/advisories/GHSA-wphv-vfrh-23q5",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}