Bug 2563708 (CVE-2026-119284)

Summary:	CVE-2026-119284 joserfc: joserfc: Denial of Service via excessive memory allocation during JWS deserialization
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	anpicker, anthomas, dfreiber, dkeler, doconnor, drow, dschmidt, ebourniv, ehelms, ggainey, hasun, ilpinto, jburrell, jfula, jlanda, jowilson, jpasqual, juwatts, kaycoth, kshier, lblicha, ltomasbo, mdellweg, mhayden, mhulan, nmoumoul, nyancey, ogajduse, ometelka, osousa, pcreech, ptisnovs, rbobbitt, rchan, rjohnson, sbunciak, sdoran, simaishi, smallamp, stcannon, suppawar, syedriko, thason, tmalecek, vkumar, xdharmai, yguenane, ykashtan, zhunting
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in joserfc. A remote attacker can trigger a Denial of Service (DoS) by submitting specially crafted compact JSON Web Signature (JWS) tokens that exhaust process memory. The library parses and splits input bytes into individual segments before enforcing aggregate size limits, causing excessive memory allocation before rejecting oversized data.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-29 21:58:27 UTC

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.6, joserfc compact JWS deserialization calls bytes.split() before enforcing the existing aggregate segment-size limits. When attacker-controlled compact serialization bytes reach deserialize_compact(), the split creates copies of the header, payload, and signature segments before ExceededSizeError rejects them, causing an additional allocation approximately proportional to the supplied token. Requests that exhaust available process memory can therefore cause an availability failure even though signature verification fails. This issue is fixed in version 1.7.6.