← Packages
python-joserfc
The ultimate Python library for JOSE RFCs (JWS, JWE, JWK, JWA, JWT)
- Current
- 1.7.4
- Candidate
- 1.8.0
- License
- BSD-3-Clause
RuntimeDeps
| Dependency | Observed source | Current requirement | Candidate requirement |
|---|---|---|---|
50.0.2 | |||
3.14.9 |
Optional RuntimeDeps
| Dependency | Observed source | Current requirement | Candidate requirement |
|---|---|---|---|
3.23.0 |
Dependency conditions
- Applies when (any)
- extra == "drafts"
Advisory · 2
Provider matches do not establish RPM applicability. Local patches, bundled dependencies and binary artifacts are not evaluated.
- Summary
- joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key DecryptionOSV
- Fixed events
- 1.7.5OSV
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.229%FIRST
- Returned advisory
- GHSA-jpxq-7h8p-2q76OSV
- Aliases
- GHSA-jpxq-7h8p-2q76OSV
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HOSV
- Summary
- joserfc: Compact JWS size guard allocates attacker-controlled segments before rejectionOSV
- Fixed events
- 1.7.6OSV
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.192%FIRST
- Returned advisory
- GHSA-9pg5-8c7x-5hfxOSV
- Aliases
- GHSA-9pg5-8c7x-5hfxOSV
- KEV
- NoCISA
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NOSV
Description
A comprehensive Python implementation of several essential JSON Object Signing and Encryption (JOSE) standards, including JWS, JWE, JWK, JWA, and JWT.
Changelog
PR · 3
Checks
| Monitor | Observation | Last checked |
|---|---|---|
Checked | ||
Checked | ||
Checked | ||
Checked | ||
Not configured No reliable monitor identity/configuration. | — | |
Checked Compared same-provider, same-project SPDX metadata for this version pair. | Last attempted | |
Checked | Last attempted | |
Checked Current source component only; local patches, build options, bundled dependencies and binary artifacts are not evaluated. | Last attempted | |
Checked |