CVE-2025-65015
Description
A flaw was found in joserfc. This vulnerability allows an attacker to cause Python logging or diagnostic tools to process and record arbitrarily large, forged JSON Web Token (JWT) payloads. This occurs when non-decoded JWT token parts are embedded in ExceededSizeError exception messages, triggered by an attacker sending arbitrarily large bearer tokens in HTTP (Hypertext Transfer Protocol) request headers.
Statement
THe impact of this vulnerability has been downgraded from CRITICAL to MODERATE because of the following reasons:
- successful exploitation requires a misconfigured or absent production-grade web server that lacks proper request size limits which is not an attribute of Red Hat's SSDC practice and so limits the exploitability of the affected product.
- The vulnerability only affects availability through resource exhaustion without enabling remote code execution, privilege escalation, or data compromise.
This issue arises because joserfc embeds full, non-decoded JWT token parts directly into ExceededSizeError exception messages when validating token sizes during the jwt.decode() operation. When an attacker sends an arbitrarily large bearer token in HTTP request headers, the library loads the entire payload into memory before raising the exception, and the exception message containing the full payload is then passed to Python logging. This can result in excessive consumption of memory.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
