joserfc hat eine mögliche Schwachstelle bei der unkontrollierten Ressourcennutzung, die durch das Protokollieren von beliebig großen JWT-Token-Payloads ausgelöst wird

The core impact of CVE-2025-65015 lies in the potential for information disclosure. An attacker can craft a malicious JWT payload and inject it into an HTTP request. If the joserfc library encounters an error during decoding (e.g., due to an excessively large token), the un-decoded parts of the JWT, including the payload, are included in the ExceededSizeError exception message. This message is then logged by the Python application, potentially exposing the entire JWT payload to unauthorized parties. This could include user credentials, API keys, or other sensitive data. The risk is amplified when logging systems like Sentry are in place, as they aggregate and store these error messages, creating a persistent record of the exposed data. The lack of proper sanitization before logging makes this a particularly dangerous vulnerability.

Applications using joserfc for JWT handling, particularly those deployed behind web servers with inadequate input validation or those that log JWT data without proper sanitization, are at significant risk. Shared hosting environments where server configurations are less controllable are also particularly vulnerable.

• python / server:

  grep -r 'joserfc.jwt.decode' /path/to/your/python/project/
  journalctl -u your_app_name | grep 'ExceededSizeError'

• generic web:

  curl -I https://your-app.com/api/endpoint | grep 'Authorization:'

1. 2025-11-18Disclosure

   disclosure

1. Reserviert2025-11-13
2. Veröffentlicht2025-11-18
3. Geändert2026-02-04
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-65015 is to upgrade the joserfc library to version 1.3.5 or later. This version includes a fix that prevents the logging of un-decoded JWT payloads. If upgrading is not immediately feasible, consider implementing a temporary workaround by disabling or restricting the logging of exception messages related to JWT decoding. Additionally, review your logging configuration to ensure that sensitive data is not being inadvertently logged. Implement input validation to limit the size of JWT tokens accepted by your application. After upgrading, confirm the fix by attempting to decode a large, crafted JWT and verifying that the payload is not included in any error messages or logs.