joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions from 1.3.3 to before 1.3.5 and from 1.4.0 to before 1.4.2, the ExceededSizeError exception messages are embedded with non-decoded JWT token parts and may cause Python logging to record an arbitrarily large, forged JWT payload. In situations where a misconfigured — or entirely absent — production-grade web server sits in front of a Python web application, an attacker may be able to send arbitrarily large bearer tokens in the HTTP request headers. When this occurs, Python logging or diagnostic tools (e.g., Sentry) may end up processing extremely large log messages containing the full JWT header during the joserfc.jwt.decode() operation. The same behavior also appears when validating claims and signature payload sizes, as the library raises joserfc.errors.ExceededSizeError() with the full payload embedded in the exception message. Since the payload is already fully loaded into memory at this stage, the library cannot prevent or reject it. This issue has been patched in versions 1.3.5 and 1.4.2.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption     (JOSE) standards. In versions from 1.3.3 to before 1.3.5 and from 1.4.0 to before 1.4.2, the     ExceededSizeError exception messages are embedded with non-decoded JWT token parts and may cause Python     logging to record an arbitrarily large, forged JWT payload. In situations where a misconfigured  or     entirely absent  production-grade web server sits in front of a Python web application, an attacker may     be able to send arbitrarily large bearer tokens in the HTTP request headers. When this occurs, Python     logging or diagnostic tools (e.g., Sentry) may end up processing extremely large log messages containing     the full JWT header during the joserfc.jwt.decode() operation. The same behavior also appears when     validating claims and signature payload sizes, as the library raises joserfc.errors.ExceededSizeError()     with the full payload embedded in the exception message. Since the payload is already fully loaded into     memory at this stage, the library cannot prevent or reject it. This issue has been patched in versions     1.3.5 and 1.4.2. (CVE-2025-65015)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption
    (JOSE) standards. In versions from 1.3.3 to before 1.3.5 and from 1.4.0 to before 1.4.2, the
    ExceededSizeError exception messages are embedded with non-decoded JWT token parts and may cause Python
    logging to record an arbitrarily large, forged JWT payload. In situations where a misconfigured — or
    entirely absent — production-grade web server sits in front of a Python web application, an attacker may
    be able to send arbitrarily large bearer tokens in the HTTP request headers. When this occurs, Python
    logging or diagnostic tools (e.g., Sentry) may end up processing extremely large log messages containing
    the full JWT header during the joserfc.jwt.decode() operation. The same behavior also appears when
    validating claims and signature payload sizes, as the library raises joserfc.errors.ExceededSizeError()
    with the full payload embedded in the exception message. Since the payload is already fully loaded into
    memory at this stage, the library cannot prevent or reject it. This issue has been patched in versions
    1.3.5 and 1.4.2. (CVE-2025-65015)

ID	Name	Product	Family	Severity
275773	Linux Distros Unpatched Vulnerability : CVE-2025-65015	Nessus	Misc.	critical
436091	SCA: security update for joserfc (GHSA-frfh-8v73-gjg4)	Tenable Cloud Security	SCA Checks	critical
436091	SCA: security update for joserfc (GHSA-frfh-8v73-gjg4)	Tenable Self-Hosted Container Security	SCA Checks	critical

Detections

Analytics

CVE-2025-65015

critical

Tenable Plugins

critical

critical

critical