Repository navigation
chore(deps): update dependency joserfc to v1.7.6 [security] - #14776
Open
renovate-bot wants to merge 1 commit into
Open
renovate-bot wants to merge 1 commit into
renovate-bot wants to merge 1 commit into
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.7.5→1.7.6joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection
CVE-2026-119284 / GHSA-9pg5-8c7x-5hfx
More information
Details
Summary
joserfc 1.7.4 defines compact-JWS header, payload, and signature limits, but
calls
value.split(b".")before validating them. Pythonbytes.split()copiesthe attacker-controlled segments, so the current guard allocates roughly one
complete payload before rejecting it.
Reproduction
The input is resident before a fork-isolated verifier runs, and every signature
is invalid.
The unconstrained profile is the primary evidence: joserfc allocates an
additional attacker-sized object before producing its intended
ExceededSizeError. A separate baseline-plus-headroom stress test raisesMemoryErrorwhen that copy cannot fit, but this report does not characterizean absolute
RLIMIT_ASvalue as a realistic worker memory budget.Security Argument
The issue is not that joserfc can prevent the transport layer from receiving a
large header. The issue is narrower: once bytes reach
deserialize_compact(),the library's existing size guard cannot fulfill its allocation-limiting purpose
because attacker-controlled segment copies are created first.
This differs from
GHSA-frfh-8v73-gjg4,
which concerned embedding already-loaded oversized segments in exception and log
messages. Here, the current implementation itself creates an additional
payload-sized allocation before its fixed size exception.
Recommended Fix
Check
len(value)against a maximum compact-serialization size beforesplit(). If per-segment diagnostics are needed, locate delimiters with boundedfind()operations or memory views, validate offsets and lengths, and only thenmaterialize acceptable segments.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
authlib/joserfc (joserfc)
v1.7.6Compare Source
🐞 Bug Fixes
View changes on GitHub
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Never, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.