CVE-2026-48990
Description
A flaw was found in joserfc, a Python library for JSON Object Signing and Encryption (JOSE). This vulnerability allows a remote attacker to cause resource exhaustion, leading to a Denial of Service (DoS), by sending oversized JSON Web Signature (JWS) payloads. The library fails to apply size limits, specifically JWSRegistry.max_payload_length, when processing RFC7797 b64=false JWS payloads.
Statement
A flaw was found in the joserfc Python library, which implements the JSON Object Signing and Encryption (JOSE) standards and is bundled by several Red Hat managed-service offerings. joserfc fails to apply its configured payload-size limit (JWSRegistry.max_payload_length) when processing RFC 7797 unencoded (b64=false) JSON Web Signature (JWS) payloads, although it does enforce that limit for normal compact and flattened JSON JWS inputs. A remote, unauthenticated attacker who can submit JWS tokens to an application that accepts lower-trust token values can therefore supply a valid b64=false JWS carrying an oversized payload that the application will deserialize, exhausting memory or CPU resources and causing a denial of service. Only availability is impacted; confidentiality and integrity are not affected. Red Hat Product Security rated this flaw Moderate severity (CVSS 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), consistent with the upstream CVE record. Based on the current affects, products found to be affected include Red Hat Ansible Automation Platform 2.6 and 2.7, Migration Toolkit for Applications 8.1, Hosted OpenShift Clusters, and Red Hat Hardened Images, and fixes for those products are being pursued with the responsible product teams. Other offerings that were evaluated, including Red Hat Satellite and several cloud.redhat.com and Insights components, do not contain the vulnerable code and are therefore not affected.
Mitigation
The risk can be mitigated by rejecting oversized serialized JWS inputs before they reach joserfc and enforcing strict request/body size limits at the application or reverse-proxy layer.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | 5.3 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | Low | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
