# CVE-2026-119284: joserfc memory exhaustion in compact JWS deserialization

Source: https://junglewise.ai/threats/cve-2026-119284-joserfc-is-a-python-library-that-provides-an-implementation-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-119284 · Severity: medium · CVSS 4 · Published 2026-10-29

joserfc is a Python library that implements JSON Object Signing and Encryption (JOSE) standards for secure token handling. An attacker can send a specially crafted token that causes the library to allocate excessive memory before validation, potentially exhausting available resources and causing the application to crash or become unavailable.

Technologies: [Authlib Joserfc](https://junglewise.ai/threats/technologies/joserfc), [joserfc (PyPI)](https://junglewise.ai/threats/technologies/pypi-joserfc). Vendors: [Authlib](https://junglewise.ai/threats/vendors/authlib), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-119284 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119284 being exploited in the wild.

**How severe is CVE-2026-119284?** Medium severity, with a CVSS score of 4, published 29 October 2026.

**Which products and versions are affected?** Authlib Joserfc before 1.7.6; joserfc (PyPI) < 1.7.6, ECOSYSTEM:introduced=0,fixed=1.7.6.

**Is there a fix for CVE-2026-119284?** Yes. joserfc (PyPI): upgrade to 1.7.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119284 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-119284?** Check whether you run Authlib Joserfc or joserfc (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- joserfc (PyPI): upgrade to 1.7.6 or later

  ```sh
  pip install "joserfc>=1.7.6"
  ```


## Technical details

The vulnerability exists in compact JWS deserialization, where bytes.split() is called before aggregate segment-size validation. An attacker-controlled compact serialization token causes memory allocation proportional to token size before ExceededSizeError is raised, enabling a denial-of-service attack through process memory exhaustion.

## Affected products

- authlib joserfc before 1.7.6

## Identifiers

- CVE-2026-119284
- GHSA-9pg5-8c7x-5hfx

## Timeline

- 2026-10-29: disclosed
- 2026-10-18: patched

## References

- [https://github.com/authlib/joserfc/commit/397e04f4bbce0b94d86e31c1c003f4640af8fb39](https://github.com/authlib/joserfc/commit/397e04f4bbce0b94d86e31c1c003f4640af8fb39)
- [https://github.com/authlib/joserfc/releases/tag/1.7.6](https://github.com/authlib/joserfc/releases/tag/1.7.6)

## Related threats

- [joserfc JWE denial of service via unlimited recipients](https://junglewise.ai/threats/cve-2026-119283-joserfc-is-a-python-library-that-provides-an-implementation-of)
- [authlib joserfc issuer validation bypass in JWT claims](https://junglewise.ai/threats/cve-2026-75509-authlib-joserfc-issuer-validation-bypass-in-jwt-claims)
- [authlib joserfc token malleability via trailing padding](https://junglewise.ai/threats/cve-2026-62995-authlib-joserfc-token-malleability-via-trailing-padding)
- [authlib joserfc authentication bypass via empty HMAC key](https://junglewise.ai/threats/cve-2026-49852-authlib-joserfc-authentication-bypass-via-empty-hmac-key)
- [PYSEC-2026-2529 - joserfc's PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS)](https://junglewise.ai/threats/cve-2026-27932-joserfc-s-pbes2-p2c-unbounded-iteration-count-enables-denial-of)