Login Request a demo
JO
Product
joserfc
by authlib · last CVE Oct 29, 2026
9
CVEs
0
On KEV
9.1
Max CVSS
3
New 30D
Vulnerabilities9In the news0Timeline
Severity mix
Critical 1High 4Medium 3Low 1
Severity
All severities9Critical1High4Medium3Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add joserfc to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-49852
8.7
0%
Jul 17
joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)
Affected: < 1.6.8
CVE-2026-119283
New
7.5–Oct 29
joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption
Affected: < 1.7.5
CVE-2026-27932
7.5
0%
Mar 3
joserfc PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS)
Affected: <= 1.6.2
CVE-2025-65015
7.5
0%
Nov 18
joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads
Affected: >= 1.3.3, < 1.3.5; >= 1.4.0, < 1.4.2
Showing 4