joserfc is a Python library that implements JOSE standards. In versions prior to 1.7.6, its compact JWS deserialization performs a bytes.split() before checking aggregate segment-size limits. If an attacker supplies a large compact serialization, the split creates copies of the header, payload, and signature segments before the library throws an ExceededSizeError, allocating memory proportional to the token size. This additional allocation can exhaust process memory and cause an availability failure even though signature verification ultimately fails. The flaw is a classic resource exhaustion vulnerability (CWE-400).

The vulnerable product is authlib's joserfc library, versions earlier than 1.7.6. Any application that incorporates joserfc—including web services, authentication engines, or third‑party libraries—must verify whether it uses a version before this release.

The CVSS base score is 6.9, reflecting a moderate severity. No EPSS score is available, but the exploit requires only that an attacker can supply a JWS token to the parsing code, which is a common scenario for services accepting JWTs. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw by sending oversized tokens over the network to the parsing endpoint, making the attack feasible and potentially impactful if memory limits are reached.