Secuno
ENNL
Book demo

CVE-2025-65015

Hsiaoming Joserfc denial of service

7.5 HIGHPublic exploitEPSS 0.41%
  1. Published18 Nov 2025

Description

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions from 1.3.3 to before 1.3.5 and from 1.4.0 to before 1.4.2, the ExceededSizeError exception messages are embedded with non-decoded JWT token parts and may cause Python logging to record an arbitrarily large, forged JWT payload. In situations where a misconfigured — or entirely absent — production-grade web server sits in front of a Python web application, an attacker may be able to send arbitrarily large bearer tokens in the HTTP request headers. When this occurs, Python logging or diagnostic tools (e.g., Sentry) may end up processing extremely large log messages containing the full JWT header during the joserfc.jwt.decode() operation. The same behavior also appears when validating claims and signature payload sizes, as the library raises joserfc.errors.ExceededSizeError() with the full payload embedded in the exception message. Since the payload is already fully loaded into memory at this stage, the library cannot prevent or reject it. This issue has been patched in versions 1.3.5 and 1.4.2.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityNone
IntegrityNone
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Hsiaoming Joserfc≥ 1.3.3 < 1.3.5 · ≥ 1.4.0 < 1.4.2

Remediation

Fixed in
Hsiaoming Joserfc≥ 1.3.5

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-1031028.6
Pexip Infinity before 41.0 is affected by improper input validation in the signaling…
CVE-2026-1031018.6
Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation…
CVE-2026-824399.8
Description The DRPC server kept a map from function name to request queue and created…
CVE-2026-478919.8
A Spring WebFlux application that relies on the Aalto XML processor to parse XML input…
CVE-2026-735418.2
Allocation of Resources Without Limits or Throttling in ZenHive mpp allows an…
CVE-2026-748789.8
openssl_encrypt versions before 1.4.0 use an in-memory rate limiter for TOTP…

Frequently asked

Is CVE-2025-65015 being actively exploited?

CVE-2025-65015 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.41%.

How severe is CVE-2025-65015?

CVE-2025-65015 has a CVSS 3.1 base score of 7.5, rated high. EPSS estimates a 0.41% probability of exploitation.

Which products are affected by CVE-2025-65015?

Affected products include Hsiaoming Joserfc.

How do I fix CVE-2025-65015?

Upgrade affected software to a fixed version, for example Hsiaoming Joserfc 1.3.5 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-65015 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.