CVE-2025-65015
High · 8.6joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads
CVSS
8.6
EPSS
0.4%
Published
Nov 18, 2025
CISA due date
—
The record
The `ExceededSizeError` exception messages are embedded with non-decoded JWT token parts and may cause Python logging to record an arbitrarily large, forged JWT payload.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | joserfc | 1.3.3 | 1.3.5 |
| PyPI | joserfc | 1.4.0 | 1.4.2 |
| Chainguard | localstack | 0 | 4.10.0-r1 |
| Chainguard | localstack-compat | 0 | 4.10.0-r1 |
| pypi | joserfc | 1.3.3 | No fix |
| pypi | joserfc | 1.4.0 | No fix |
Related vulnerabilities
- GHSA-frfh-8v73-gjg4 joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging… Same vulnerability
- CVE-2026-27932 joserfc is a Python library that provides an implementation of several JSON Object… Also affects joserfc
- GHSA-w5r5-m38g-f9f9 joserfc's PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS) Also affects joserfc
- CVE-2026-34073 cryptography is a package designed to expose cryptographic primitives and recipes to… Also affects localstack
- CVE-2026-30922 pyasn1 is a generic ASN.1 library for Python. Also affects localstack
- CVE-2026-27448 pyOpenSSL is a Python wrapper around the OpenSSL library. Also affects localstack
- CVE-2026-27459 pyOpenSSL is a Python wrapper around the OpenSSL library. Also affects localstack
- CVE-2026-27199 Werkzeug is a comprehensive WSGI web application library. Also affects localstack