CVE-2025-65015: Large JWT Payload Logging Vulnerability in joserfc

Overview

CVE-2025-65015 describes a vulnerability found in the joserfc Python library, which is used for implementing JSON Object Signing and Encryption (JOSE) standards. Specifically, versions 1.3.3 to before 1.3.5 and from 1.4.0 to before 1.4.2 are affected. This vulnerability allows an attacker to potentially flood logs with large, forged JWT payloads, leading to resource exhaustion or exposing sensitive information present in the JWT to unintended recipients through log aggregation tools. The core issue lies in how the ExceededSizeError exception handles and logs excessively large JWTs during the decoding or validation process.

Technical Details

The vulnerability stems from the fact that the ExceededSizeError exception messages within the affected joserfc versions include the non-decoded parts of the JWT token. If a web application using joserfc sits behind a misconfigured web server (or one that lacks proper size limits), an attacker can send HTTP requests with extremely large bearer tokens in the headers. This triggers the joserfc.jwt.decode() operation, and if the JWT payload is excessively large, the ExceededSizeError exception is raised. Critically, the exception message itself contains the full, potentially very large, JWT payload. Consequently, Python logging mechanisms and diagnostic tools like Sentry will then attempt to process and log this oversized message. Since the payload is fully loaded into memory prior to this check, there is no ability to prevent the library from processing the oversized JWT.

The problem manifests during claims and signature payload size validation, where joserfc.errors.ExceededSizeError() is raised with the complete payload embedded in the error message.

CVSS Analysis

The provided information states that the CVSS score and severity are N/A. However, based on the description, a moderate severity score would be appropriate, likely in the 4.0-6.0 range. The vulnerability doesn’t directly allow for code execution or data breaches but can be leveraged for denial-of-service attacks (via log flooding) or information disclosure if sensitive data is included in JWTs and logs are not properly secured.

A more accurate CVSS score would depend on factors such as:

• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – potential for information disclosure via logs.
• Integrity Impact: None (I:N)
• Availability Impact: Low (A:L) – potential for denial-of-service due to log flooding.

Using a CVSS calculator with these assumptions would yield a score in the moderate range.

Possible Impact

The potential impact of CVE-2025-65015 includes:

• Denial of Service (DoS): By sending many requests with oversized JWTs, an attacker can flood the application logs, potentially exhausting disk space or overwhelming log processing services.
• Information Disclosure: If JWTs contain sensitive data, this data could be exposed in logs, leading to a potential breach of confidentiality.
• Increased Monitoring Costs: Processing and storing excessively large log files can lead to increased costs for log management and monitoring services.

Mitigation and Patch Steps

The vulnerability has been patched in joserfc versions 1.3.5 and 1.4.2. The recommended mitigation is to upgrade to one of these versions or a later, patched version. To mitigate without upgrading (less recommended), ensure you are properly sanitizing your logs, limiting request header sizes in your webserver configuration (e.g. Nginx, Apache), and properly configuring webserver to handle large requests. Web application firewalls (WAFs) can also be configured to reject requests with excessively large JWTs.

Specifically:

1. Upgrade joserfc: Upgrade to version 1.3.5 or 1.4.2 or later. Use pip: pip install joserfc==1.3.5 or pip install joserfc==1.4.2
2. Web Server Configuration: Configure your web server (e.g., Nginx, Apache) to limit the maximum size of request headers. This will prevent extremely large JWTs from even reaching the application.
3. Log Sanitization: Implement mechanisms to sanitize log messages, preventing the logging of full JWT payloads. This might involve truncating log messages or removing sensitive information.
4. Web Application Firewall (WAF): Use a WAF to detect and block requests containing excessively large JWTs.

References

• joserfc Commit – 63932f169d924caffafa761af2122b82059017f7
• joserfc Commit – 673c8743fd0605b0e1de6452be6cba75f44e466b
• joserfc Release Tag – 1.3.5
• joserfc Release Tag – 1.4.2
• joserfc Security Advisory – GHSA-frfh-8v73-gjg4