PT-2025-47405 · Pypi+1 · Joserfc+1

Published 2025-11-18 · Updated 2025-11-20 · CVE-2025-65015

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Name of the Vulnerable Software and Affected Versions joserfc versions 1.3.3 through 1.3.4 joserfc versions 1.4.0 through 1.4.1

Description The joserfc library has an issue where excessively large JWT (JSON Web Token) payloads can be logged, potentially leading to resource exhaustion. Specifically, the ExceededSizeError exception messages embed the full, potentially forged JWT payload, which can be very large if a misconfigured or absent web server allows oversized requests. This can impact disk, memory, and CPU usage on the application host, as well as external logging and alerting services. The issue occurs during JWT decoding (joserfc.jwt.decode()) and claim/signature validation, where the library raises joserfc.errors.ExceededSizeError() with the full payload included in the exception message. The library cannot prevent the loading of the large payload into memory once it has been received. The issue is present in the joserfc/ rfc7515/registry.py and joserfc/ rfc7516/registry.py files.

Recommendations For versions 1.3.3 through 1.3.4, update to version 1.3.5 or later. For versions 1.4.0 through 1.4.1, update to version 1.4.2 or later.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2025-14672

CVE-2025-65015

GHSA-FRFH-8V73-GJG4

Affected Products

Debian

Joserfc

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65015.json · Exploit
• 🔥 https://github.com/authlib/joserfc/security/advisories/GHSA-frfh-8v73-gjg4 · Exploit
• https://github.com/authlib/joserfc/commit/673c8743fd0605b0e1de6452be6cba75f44e466b · Patch
• https://github.com/authlib/joserfc/commit/63932f169d924caffafa761af2122b82059017f7 · Patch
• https://bdu.fstec.ru/vul/2025-14672 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-65015 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-frfh-8v73-gjg4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65015 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-65015 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-65015 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-65015 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-65015 · Security Note
• https://osv.dev/vulnerability/CVE-2025-65015 · Vendor Advisory
• https://github.com/authlib/joserfc · Note
• https://github.com/authlib/joserfc/releases/tag/1.4.2 · Note