CVE-2025-65015

{"id": "CVE-2025-65015", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-65015", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-19T17:11:59.909842Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "authlib", "product": "joserfc", "versions": [{"status": "affected", "version": ">= 1.3.3, < 1.3.5"}, {"status": "affected", "version": ">= 1.4.0, < 1.4.2"}]}]}], "published": "2025-11-18T23:15:56.513", "references": [{"url": "https://github.com/authlib/joserfc/commit/63932f169d924caffafa761af2122b82059017f7", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/authlib/joserfc/commit/673c8743fd0605b0e1de6452be6cba75f44e466b", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/authlib/joserfc/releases/tag/1.3.5", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/authlib/joserfc/releases/tag/1.4.2", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/authlib/joserfc/security/advisories/GHSA-frfh-8v73-gjg4", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/authlib/joserfc/security/advisories/GHSA-frfh-8v73-gjg4", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions from 1.3.3 to before 1.3.5 and from 1.4.0 to before 1.4.2, the ExceededSizeError exception messages are embedded with non-decoded JWT token parts and may cause Python logging to record an arbitrarily large, forged JWT payload. In situations where a misconfigured \u2014 or entirely absent \u2014 production-grade web server sits in front of a Python web application, an attacker may be able to send arbitrarily large bearer tokens in the HTTP request headers. When this occurs, Python logging or diagnostic tools (e.g., Sentry) may end up processing extremely large log messages containing the full JWT header during the joserfc.jwt.decode() operation. The same behavior also appears when validating claims and signature payload sizes, as the library raises joserfc.errors.ExceededSizeError() with the full payload embedded in the exception message. Since the payload is already fully loaded into memory at this stage, the library cannot prevent or reject it. This issue has been patched in versions 1.3.5 and 1.4.2."}, {"lang": "es", "value": "joserfc es una biblioteca de Python que proporciona una implementaci\u00f3n de varios est\u00e1ndares de Firma y Cifrado de Objetos JSON (JOSE). En las versiones desde la 1.3.3 hasta la 1.3.5 y desde la 1.4.0 hasta la 1.4.2, los mensajes de excepci\u00f3n 'ExceededSizeError' incrustan partes de tokens JWT no decodificadas y pueden causar que el registro de Python grabe una carga \u00fatil JWT falsificada y arbitrariamente grande. En situaciones donde un servidor web de grado de producci\u00f3n mal configurado - o completamente ausente - se encuentra frente a una aplicaci\u00f3n web de Python, un atacante podr\u00eda enviar tokens portadores arbitrariamente grandes en los encabezados de solicitud HTTP. Cuando esto ocurre, el registro de Python o las herramientas de diagn\u00f3stico (p. ej., Sentry) pueden terminar procesando mensajes de registro extremadamente grandes que contienen el encabezado JWT completo durante la operaci\u00f3n 'joserfc.jwt.decode()'. El mismo comportamiento tambi\u00e9n aparece al validar las reclamaciones y los tama\u00f1os de la carga \u00fatil de la firma, ya que la biblioteca lanza 'joserfc.errors.ExceededSizeError()' con la carga \u00fatil completa incrustada en el mensaje de excepci\u00f3n. Dado que la carga \u00fatil ya est\u00e1 completamente cargada en la memoria en esta etapa, la biblioteca no puede prevenirla ni rechazarla. Este problema ha sido parcheado en las versiones 1.3.5 y 1.4.2."}], "lastModified": "2026-10-18T20:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hsiaoming:joserfc:*:*:*:*:*:python:*:*", "vulnerable": true, "matchCriteriaId": "B00A046D-0ED8-4DBA-9CB9-FBD848071D8A", "versionEndExcluding": "1.3.5", "versionStartIncluding": "1.3.3"}, {"criteria": "cpe:2.3:a:hsiaoming:joserfc:*:*:*:*:*:python:*:*", "vulnerable": true, "matchCriteriaId": "25663E58-FE1C-44E1-9051-A2A388EB2595", "versionEndExcluding": "1.4.2", "versionStartIncluding": "1.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}