CVE-2025-65015

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-65015", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-11-13T15:36:51.680Z", "datePublished": "2025-11-18T23:07:44.328Z", "dateUpdated": "2025-11-19T17:12:04.336Z"}, "containers": {"cna": {"title": "joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "HIGH", "baseScore": 9.2, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H", "version": "4.0"}}], "references": [{"name": "https://github.com/authlib/joserfc/security/advisories/GHSA-frfh-8v73-gjg4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/authlib/joserfc/security/advisories/GHSA-frfh-8v73-gjg4"}, {"name": "https://github.com/authlib/joserfc/commit/63932f169d924caffafa761af2122b82059017f7", "tags": ["x_refsource_MISC"], "url": "https://github.com/authlib/joserfc/commit/63932f169d924caffafa761af2122b82059017f7"}, {"name": "https://github.com/authlib/joserfc/commit/673c8743fd0605b0e1de6452be6cba75f44e466b", "tags": ["x_refsource_MISC"], "url": "https://github.com/authlib/joserfc/commit/673c8743fd0605b0e1de6452be6cba75f44e466b"}, {"name": "https://github.com/authlib/joserfc/releases/tag/1.3.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/authlib/joserfc/releases/tag/1.3.5"}, {"name": "https://github.com/authlib/joserfc/releases/tag/1.4.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/authlib/joserfc/releases/tag/1.4.2"}], "affected": [{"vendor": "authlib", "product": "joserfc", "versions": [{"version": ">= 1.3.3, < 1.3.5", "status": "affected"}, {"version": ">= 1.4.0, < 1.4.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-11-18T23:07:44.328Z"}, "descriptions": [{"lang": "en", "value": "joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions from 1.3.3 to before 1.3.5 and from 1.4.0 to before 1.4.2, the ExceededSizeError exception messages are embedded with non-decoded JWT token parts and may cause Python logging to record an arbitrarily large, forged JWT payload. In situations where a misconfigured \u2014 or entirely absent \u2014 production-grade web server sits in front of a Python web application, an attacker may be able to send arbitrarily large bearer tokens in the HTTP request headers. When this occurs, Python logging or diagnostic tools (e.g., Sentry) may end up processing extremely large log messages containing the full JWT header during the joserfc.jwt.decode() operation. The same behavior also appears when validating claims and signature payload sizes, as the library raises joserfc.errors.ExceededSizeError() with the full payload embedded in the exception message. Since the payload is already fully loaded into memory at this stage, the library cannot prevent or reject it. This issue has been patched in versions 1.3.5 and 1.4.2."}], "source": {"advisory": "GHSA-frfh-8v73-gjg4", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/authlib/joserfc/security/advisories/GHSA-frfh-8v73-gjg4", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-19T17:11:59.909842Z", "id": "CVE-2025-65015", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-19T17:12:04.336Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads", "source": {"advisory": "GHSA-frfh-8v73-gjg4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.2, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "authlib", "product": "joserfc", "versions": [{"status": "affected", "version": ">= 1.3.3, < 1.3.5"}, {"status": "affected", "version": ">= 1.4.0, < 1.4.2"}]}], "references": [{"url": "https://github.com/authlib/joserfc/security/advisories/GHSA-frfh-8v73-gjg4", "name": "https://github.com/authlib/joserfc/security/advisories/GHSA-frfh-8v73-gjg4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/authlib/joserfc/commit/63932f169d924caffafa761af2122b82059017f7", "name": "https://github.com/authlib/joserfc/commit/63932f169d924caffafa761af2122b82059017f7", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/authlib/joserfc/commit/673c8743fd0605b0e1de6452be6cba75f44e466b", "name": "https://github.com/authlib/joserfc/commit/673c8743fd0605b0e1de6452be6cba75f44e466b", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/authlib/joserfc/releases/tag/1.3.5", "name": "https://github.com/authlib/joserfc/releases/tag/1.3.5", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/authlib/joserfc/releases/tag/1.4.2", "name": "https://github.com/authlib/joserfc/releases/tag/1.4.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions from 1.3.3 to before 1.3.5 and from 1.4.0 to before 1.4.2, the ExceededSizeError exception messages are embedded with non-decoded JWT token parts and may cause Python logging to record an arbitrarily large, forged JWT payload. In situations where a misconfigured \u2014 or entirely absent \u2014 production-grade web server sits in front of a Python web application, an attacker may be able to send arbitrarily large bearer tokens in the HTTP request headers. When this occurs, Python logging or diagnostic tools (e.g., Sentry) may end up processing extremely large log messages containing the full JWT header during the joserfc.jwt.decode() operation. The same behavior also appears when validating claims and signature payload sizes, as the library raises joserfc.errors.ExceededSizeError() with the full payload embedded in the exception message. Since the payload is already fully loaded into memory at this stage, the library cannot prevent or reject it. This issue has been patched in versions 1.3.5 and 1.4.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-11-18T23:07:44.328Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-65015", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-19T17:11:59.909842Z"}}}], "references": [{"url": "https://github.com/authlib/joserfc/security/advisories/GHSA-frfh-8v73-gjg4", "tags": ["exploit"]}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2025-11-19T17:11:52.719Z"}}]}, "cveMetadata": {"cveId": "CVE-2025-65015", "state": "PUBLISHED", "dateUpdated": "2025-11-18T23:07:44.328Z", "dateReserved": "2025-11-13T15:36:51.680Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-11-18T23:07:44.328Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "joserfc", "vendor": "authlib", "versions": [{"status": "affected", "version": ">= 1.3.3, < 1.3.5"}, {"status": "affected", "version": ">= 1.4.0, < 1.4.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hsiaoming:joserfc:*:*:*:*:*:python:*:*", "matchCriteriaId": "B00A046D-0ED8-4DBA-9CB9-FBD848071D8A", "versionEndExcluding": "1.3.5", "versionStartIncluding": "1.3.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:hsiaoming:joserfc:*:*:*:*:*:python:*:*", "matchCriteriaId": "25663E58-FE1C-44E1-9051-A2A388EB2595", "versionEndExcluding": "1.4.2", "versionStartIncluding": "1.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions from 1.3.3 to before 1.3.5 and from 1.4.0 to before 1.4.2, the ExceededSizeError exception messages are embedded with non-decoded JWT token parts and may cause Python logging to record an arbitrarily large, forged JWT payload. In situations where a misconfigured \u2014 or entirely absent \u2014 production-grade web server sits in front of a Python web application, an attacker may be able to send arbitrarily large bearer tokens in the HTTP request headers. When this occurs, Python logging or diagnostic tools (e.g., Sentry) may end up processing extremely large log messages containing the full JWT header during the joserfc.jwt.decode() operation. The same behavior also appears when validating claims and signature payload sizes, as the library raises joserfc.errors.ExceededSizeError() with the full payload embedded in the exception message. Since the payload is already fully loaded into memory at this stage, the library cannot prevent or reject it. This issue has been patched in versions 1.3.5 and 1.4.2."}, {"lang": "es", "value": "joserfc es una biblioteca de Python que proporciona una implementaci\u00f3n de varios est\u00e1ndares de Firma y Cifrado de Objetos JSON (JOSE). En las versiones desde la 1.3.3 hasta la 1.3.5 y desde la 1.4.0 hasta la 1.4.2, los mensajes de excepci\u00f3n 'ExceededSizeError' incrustan partes de tokens JWT no decodificadas y pueden causar que el registro de Python grabe una carga \u00fatil JWT falsificada y arbitrariamente grande. En situaciones donde un servidor web de grado de producci\u00f3n mal configurado - o completamente ausente - se encuentra frente a una aplicaci\u00f3n web de Python, un atacante podr\u00eda enviar tokens portadores arbitrariamente grandes en los encabezados de solicitud HTTP. Cuando esto ocurre, el registro de Python o las herramientas de diagn\u00f3stico (p. ej., Sentry) pueden terminar procesando mensajes de registro extremadamente grandes que contienen el encabezado JWT completo durante la operaci\u00f3n 'joserfc.jwt.decode()'. El mismo comportamiento tambi\u00e9n aparece al validar las reclamaciones y los tama\u00f1os de la carga \u00fatil de la firma, ya que la biblioteca lanza 'joserfc.errors.ExceededSizeError()' con la carga \u00fatil completa incrustada en el mensaje de excepci\u00f3n. Dado que la carga \u00fatil ya est\u00e1 completamente cargada en la memoria en esta etapa, la biblioteca no puede prevenirla ni rechazarla. Este problema ha sido parcheado en las versiones 1.3.5 y 1.4.2."}], "id": "CVE-2025-65015", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.2, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-65015", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-19T17:11:59.909842Z", "version": "2.0.3"}}]}, "published": "2025-11-18T23:15:56.513", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/authlib/joserfc/commit/63932f169d924caffafa761af2122b82059017f7"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/authlib/joserfc/commit/673c8743fd0605b0e1de6452be6cba75f44e466b"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/authlib/joserfc/releases/tag/1.3.5"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/authlib/joserfc/releases/tag/1.4.2"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/authlib/joserfc/security/advisories/GHSA-frfh-8v73-gjg4"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/authlib/joserfc/security/advisories/GHSA-frfh-8v73-gjg4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "joserfc: joserfc: Arbitrarily large JWT payloads in logs via exception messages", "id": "2415784", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2415784"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions from 1.3.3 to before 1.3.5 and from 1.4.0 to before 1.4.2, the ExceededSizeError exception messages are embedded with non-decoded JWT token parts and may cause Python logging to record an arbitrarily large, forged JWT payload. In situations where a misconfigured \u2014 or entirely absent \u2014 production-grade web server sits in front of a Python web application, an attacker may be able to send arbitrarily large bearer tokens in the HTTP request headers. When this occurs, Python logging or diagnostic tools (e.g., Sentry) may end up processing extremely large log messages containing the full JWT header during the joserfc.jwt.decode() operation. The same behavior also appears when validating claims and signature payload sizes, as the library raises joserfc.errors.ExceededSizeError() with the full payload embedded in the exception message. Since the payload is already fully loaded into memory at this stage, the library cannot prevent or reject it. This issue has been patched in versions 1.3.5 and 1.4.2."], "name": "CVE-2025-65015", "public_date": "2025-11-18T23:07:44Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-65015\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-65015\nhttps://github.com/authlib/joserfc/commit/63932f169d924caffafa761af2122b82059017f7\nhttps://github.com/authlib/joserfc/commit/673c8743fd0605b0e1de6452be6cba75f44e466b\nhttps://github.com/authlib/joserfc/releases/tag/1.3.5\nhttps://github.com/authlib/joserfc/releases/tag/1.4.2\nhttps://github.com/authlib/joserfc/security/advisories/GHSA-frfh-8v73-gjg4"], "statement": "THe impact of this vulnerability has been downgraded from CRITICAL to MODERATE because of the following reasons:\n1. successful exploitation requires a misconfigured or absent production-grade web server that lacks proper request size limits which is not an attribute of Red Hat's SSDC practice and so limits the exploitability of the affected product.\n2. The vulnerability only affects availability through resource exhaustion without enabling remote code execution, privilege escalation, or data compromise.\nThis issue arises because joserfc embeds full, non-decoded JWT token parts directly into ExceededSizeError exception messages when validating token sizes during the jwt.decode() operation. When an attacker sends an arbitrarily large bearer token in HTTP request headers, the library loads the entire payload into memory before raising the exception, and the exception message containing the full payload is then passed to Python logging. This can result in excessive consumption of memory.", "threat_severity": "Moderate"}

{"created": "2025-11-20T10:30:52.421478+00:00", "updated": "2025-11-20T10:30:52.421508+00:00", "vendors": ["authlib", "authlib$PRODUCT$joserfc"]}