Information Disclosure in joserfc Python Library
CVE-2025-65015
What is CVE-2025-65015?
The joserfc Python library, which implements JSON Object Signing and Encryption (JOSE) standards, has a vulnerability that may allow attackers to exploit the ExceededSizeError exception. This occurs in specific versions where non-decoded JWT token segments are logged, enabling the possibility to generate excessively large log messages. If a susceptible Python web application is deployed without a properly configured web server, attackers can exploit this to send oversized bearer tokens in HTTP request headers. Consequently, logging tools such as Sentry can be overwhelmed with large JWT payload entries during the decoding process. This issue is resolved in the later versions 1.3.5 and 1.4.2.
Affected Version(s)
joserfc >= 1.3.3, < 1.3.5 < 1.3.3, 1.3.5
joserfc >= 1.4.0, < 1.4.2 < 1.4.0, 1.4.2