The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption     (JOSE) standards. In versions from 1.3.3 to before 1.3.5 and from 1.4.0 to before 1.4.2, the     ExceededSizeError exception messages are embedded with non-decoded JWT token parts and may cause Python     logging to record an arbitrarily large, forged JWT payload. In situations where a misconfigured  or     entirely absent  production-grade web server sits in front of a Python web application, an attacker may     be able to send arbitrarily large bearer tokens in the HTTP request headers. When this occurs, Python     logging or diagnostic tools (e.g., Sentry) may end up processing extremely large log messages containing     the full JWT header during the joserfc.jwt.decode() operation. The same behavior also appears when     validating claims and signature payload sizes, as the library raises joserfc.errors.ExceededSizeError()     with the full payload embedded in the exception message. Since the payload is already fully loaded into     memory at this stage, the library cannot prevent or reject it. This issue has been patched in versions     1.3.5 and 1.4.2. (CVE-2025-65015)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-65015

critical Nessus Plugin ID 275773

Version 1.8