Allocation of Resources Without Limits or Throttling Affecting joserfc package, versions [,1.7.6)
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Allocation of Resources Without Limits or Throttling vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-PYTHON-JOSERFC-22132198
- published2 Nov 2026
- disclosed30 Oct 2026
- creditze3tar
Introduced: 30 Oct 2026
NewCVE-2026-119284 (opens in a new tab)How to fix?
Upgrade joserfc to version 1.7.6 or higher.
Overview
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via extract_compact and extract_rfc7515_compact in the JWE and JWS compact deserialization paths, which split the raw input bytes before validating the overall value size. An attacker can submit an arbitrarily large compact serialization, causing the library to allocate an attacker-sized object in memory before raising ExceededSizeError, leading to excessive memory consumption and a potential crash of the worker process.
PoC
.venv-research/bin/python 06-practical-testing/preauth-memory-profile.py
The input is resident before a fork-isolated verifier runs, and every signature is invalid.
| Input | Peak RSS delta | Amplification | Result |
|---|---|---|---|
| 1 MiB | 1.11 MiB | 1.11× | size rejected |
| 4 MiB | 4.04 MiB | 1.01× | size rejected |
| 8 MiB | 8.04 MiB | 1.01× | size rejected |
| 16 MiB | 16.04 MiB | 1.00× | size rejected |
| 32 MiB | 31.74 MiB | 0.99× | size rejected |
| 64 MiB | 63.80 MiB | 1.00× | size rejected |
The unconstrained profile is the primary evidence: joserfc allocates an
additional attacker-sized object before producing its intended
ExceededSizeError. A separate baseline-plus-headroom stress test raises
MemoryError when that copy cannot fit, but this report does not characterize
an absolute RLIMIT_AS value as a realistic worker memory budget.
Note: The PoC states no specific environment, runtime version, operating system, or non-default configuration.