Resource Exhaustion Vulnerability in joserfc Python Library
CVE-2026-27932

7.5HIGH

Key Information:

Vendor

Authlib

Status
Joserfc
Vendor
CVE Published:
3 March 2026

What is CVE-2026-27932?

The joserfc Python library, which implements various JSON Object Signing and Encryption standards, is susceptible to a resource exhaustion vulnerability. In versions 1.6.2 and earlier, an unauthenticated attacker can exploit this issue by sending a specially crafted JSON Web Encryption (JWE) token that specifies a large PBES2 Count parameter. This unbounded value leads to excessive CPU resource usage, resulting in a Denial of Service (DoS) condition. The vulnerability affects all high-level JWE and JWT decryption interfaces within the library if the application's policy permits the use of PBES2 algorithms, making it essential for developers to implement proper validation and limits on input parameters.

Affected Version(s)

joserfc <= 1.6.2

References

https://github.com/authlib/joserfc/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/authlib/joserfc/commit/696a9611ab982c4...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.