{"id":"GHSA-9pg5-8c7x-5hfx","summary":"joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection","details":"## Summary\n\njoserfc 1.7.4 defines compact-JWS header, payload, and signature limits, but\ncalls `value.split(b\".\")` before validating them. Python `bytes.split()` copies\nthe attacker-controlled segments, so the current guard allocates roughly one\ncomplete payload before rejecting it.\n\n## Reproduction\n\n```bash\n.venv-research/bin/python 06-practical-testing/preauth-memory-profile.py\n```\n\nThe input is resident before a fork-isolated verifier runs, and every signature\nis invalid.\n\n| Input | Peak RSS delta | Amplification | Result |\n|---:|---:|---:|---|\n| 1 MiB | 1.11 MiB | 1.11× | size rejected |\n| 4 MiB | 4.04 MiB | 1.01× | size rejected |\n| 8 MiB | 8.04 MiB | 1.01× | size rejected |\n| 16 MiB | 16.04 MiB | 1.00× | size rejected |\n| 32 MiB | 31.74 MiB | 0.99× | size rejected |\n| 64 MiB | 63.80 MiB | 1.00× | size rejected |\n\nThe unconstrained profile is the primary evidence: joserfc allocates an\nadditional attacker-sized object before producing its intended\n`ExceededSizeError`. A separate baseline-plus-headroom stress test raises\n`MemoryError` when that copy cannot fit, but this report does not characterize\nan absolute `RLIMIT_AS` value as a realistic worker memory budget.\n\n## Security Argument\n\nThe issue is not that joserfc can prevent the transport layer from receiving a\nlarge header. The issue is narrower: once bytes reach `deserialize_compact()`,\nthe library's existing size guard cannot fulfill its allocation-limiting purpose\nbecause attacker-controlled segment copies are created first.\n\nThis differs from\n[GHSA-frfh-8v73-gjg4](https://github.com/authlib/joserfc/security/advisories/GHSA-frfh-8v73-gjg4),\nwhich concerned embedding already-loaded oversized segments in exception and log\nmessages. Here, the current implementation itself creates an additional\npayload-sized allocation before its fixed size exception.\n\n## Recommended Fix\n\nCheck `len(value)` against a maximum compact-serialization size before\n`split()`. If per-segment diagnostics are needed, locate delimiters with bounded\n`find()` operations or memory views, validate offsets and lengths, and only then\nmaterialize acceptable segments.","aliases":["CVE-2026-119284"],"modified":"2026-10-30T15:15:03.588544987Z","published":"2026-10-30T14:54:25Z","database_specific":{"cwe_ids":["CWE-400"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-10-30T14:54:25Z","nvd_published_at":"2026-10-29T22:17:01Z"},"references":[{"type":"WEB","url":"https://github.com/authlib/joserfc/security/advisories/GHSA-9pg5-8c7x-5hfx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119284"},{"type":"WEB","url":"https://github.com/authlib/joserfc/commit/397e04f4bbce0b94d86e31c1c003f4640af8fb39"},{"type":"PACKAGE","url":"https://github.com/authlib/joserfc"},{"type":"WEB","url":"https://github.com/authlib/joserfc/releases/tag/1.7.6"}],"affected":[{"package":{"name":"joserfc","ecosystem":"PyPI","purl":"pkg:pypi/joserfc"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.6"}]}],"versions":["0.1.0","0.10.0","0.11.0","0.11.1","0.12.0","0.2.0","0.3.0","0.4.0","0.5.0","0.6.0","0.7.0","0.8.0","0.9.0","1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.1.0","1.2.0","1.2.1","1.2.2","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.4.0","1.4.1","1.4.2","1.4.3","1.5.0","1.6.0","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5","1.6.7","1.6.8","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-9pg5-8c7x-5hfx/GHSA-9pg5-8c7x-5hfx.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}