Authlib Joserfc vulnerabilities

• authlib joserfc joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection CVE-2026-119284 Fix available 6.9 MediumOctober 29, 2026
• authlib joserfc joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption CVE-2026-119283 Fix available 7.5 HighOctober 29, 2026
• authlib joserfc joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json CVE-2026-102946 Fix available 9.1 CriticalOctober 15, 2026
• authlib joserfc joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti) CVE-2026-75509 Fix available 6.5 MediumAugust 24, 2026
• authlib joserfc joserfc accepts JWT with padding, leading to JWT malleability CVE-2026-62995 Fix available 2.3 LowJuly 29, 2026
• authlib joserfc joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363) CVE-2026-49852 Fix available 8.7 HighJuly 2, 2026
• authlib joserfc joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization CVE-2026-48990 Fix available 5.3 MediumJune 17, 2026
• authlib joserfc joserfc PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS) CVE-2026-27932 Fix available 7.5 HighMarch 2, 2026
• authlib joserfc joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads CVE-2025-65015 Fix available 9.2 CriticalNovember 18, 2025