Is CVE-2026-119284 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119284 being exploited in the wild.

How severe is CVE-2026-119284?

Medium severity, with a CVSS score of 4, published 29 October 2026.

Which products and versions are affected?

Authlib Joserfc before 1.7.6; joserfc (PyPI) < 1.7.6, ECOSYSTEM:introduced=0,fixed=1.7.6.

Is there a fix for CVE-2026-119284?

Yes. joserfc (PyPI): upgrade to 1.7.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-119284 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-119284?

Check whether you run Authlib Joserfc or joserfc (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119284: joserfc memory exhaustion in compact JWS deserialization

Q: Is there a fix for CVE-2026-119284?

Yes. joserfc (PyPI): upgrade to 1.7.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-119284 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-119284?

Check whether you run Authlib Joserfc or joserfc (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119284 · Severity: medium · CVSS 4 · Published 2026-10-29

joserfc is a Python library that implements JSON Object Signing and Encryption (JOSE) standards for secure token handling. An attacker can send a specially crafted token that causes the library to allocate excessive memory before validation, potentially exhausting available resources and causing the application to crash or become unavailable.

Technologies: Authlib Joserfc, joserfc (PyPI). Vendors: Authlib, PyPI.

Quick answers

Is CVE-2026-119284 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119284 being exploited in the wild.
How severe is CVE-2026-119284?: Medium severity, with a CVSS score of 4, published 29 October 2026.
Which products and versions are affected?: Authlib Joserfc before 1.7.6; joserfc (PyPI) < 1.7.6, ECOSYSTEM:introduced=0,fixed=1.7.6.
Is there a fix for CVE-2026-119284?: Yes. joserfc (PyPI): upgrade to 1.7.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-119284 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-119284?: Check whether you run Authlib Joserfc or joserfc (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

joserfc (PyPI): upgrade to 1.7.6 or later
```
pip install "joserfc>=1.7.6"
```

Technical details

The vulnerability exists in compact JWS deserialization, where bytes.split() is called before aggregate segment-size validation. An attacker-controlled compact serialization token causes memory allocation proportional to token size before ExceededSizeError is raised, enabling a denial-of-service attack through process memory exhaustion.

Affected products

authlib joserfc before 1.7.6

Identifiers

CVE-2026-119284
GHSA-9pg5-8c7x-5hfx

Timeline

2026-10-29: disclosed
2026-10-18: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.