CVE-2025-65015: JWT Information Disclosure in joserfc

The core of the vulnerability lies in how joserfc handles ExceededSizeError exceptions during JWT decoding. When a malformed or excessively large JWT is received, the error message includes parts of the token itself. If a web server isn't properly configured to sanitize or limit the size of incoming requests, an attacker can craft a JWT that's large enough to overwhelm logging systems. This injected data, containing potentially sensitive information like user identifiers, roles, or claims, is then recorded in the logs, making it accessible to anyone with access to those logs. The impact is particularly severe in environments where logging is centralized or used for security monitoring, as the attacker can effectively poison the monitoring data.

1. Reserved2025-11-13
2. Published2025-11-18
3. Modified2026-02-04
4. EPSS updated2026-03-23

The primary mitigation is to upgrade to joserfc version 1.3.5 or later, which addresses the vulnerability. If upgrading immediately isn't feasible, consider implementing temporary workarounds. First, ensure your web server (e.g., Nginx, Apache) is configured to limit the size of incoming request headers and bodies. This can prevent excessively large JWTs from reaching the Python application. Second, review your logging configuration to ensure that sensitive data is not being logged unnecessarily. Consider using secure logging practices, such as redacting or masking sensitive information before it's written to disk. Finally, implement input validation to reject JWTs that exceed a reasonable size limit.