JSON Object Signing and Encryption Library Vulnerability in joserfc

CVE-2026-119284

What is CVE-2026-119284?

The joserfc library, which implements JSON Object Signing and Encryption standards, contains a vulnerability in its compact JWS deserialization routine prior to version 1.7.6. When attacker-controlled serialization bytes are processed, memory exhaustion can occur due to the library's handling of segment sizes. Specifically, the bytes.split() function executes before enforcing size limits, allowing for the possibility of creating excessive data allocations. While signature verification may fail, the resulting memory consumption can trigger availability issues by exhausting the process memory. This vulnerability highlights the need for secure coding practices and proper validation in libraries dealing with serialized data.

References