Medium [CVE-2026-48990] Resource exhaustion via oversized JSON Web Signature (JWS) payloads
This medium-severity Red Hat Linux advisory covers CVE-2026-48990 affecting Red Hat Ansible Automation Platform 2.6, Red Hat Ansible Automation Platform 2.7, Red Hat Hardened Images.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions 1.3.4 through 1.6.5, joserfc accepts oversized RFC7797 b64=false JWS payloads without applying JWSRegistry.max_payload_length, which can lead to resource exhaustion.
The normal JWS compact and flattened JSON paths reject payloads above the configured payload-size limit with ExceededSizeError. The RFC7797 unencoded payload paths do not make the same check.
A valid b64=false compact or flattened JSON JWS can therefore deserialize successfully with a payload larger than JWSRegistry.max_payload_length. Applications that accept lower-trust JWS values and rely on joserfc to reject oversized token content during verification have a moderate availability risk.
This issue has been fixed in version 1.6.7. This vulnerability allows a remote attacker to cause resource exhaustion, leading to a Denial of Service (DoS), by sending oversized JSON Web Signature (JWS) payloads.
The library fails to apply size limits, specifically JWSRegistry.max_payload_length, when processing RFC7797 b64=false JWS payloads. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
Weakness: CWE-770.
- 1.3.4
- 1.6.5
Official advisory · high-confidence parse· fetched 17 days ago·verify at source
- 1.6.7
- ansible-automation-platform-26/lightspeed-chatbot-rhel9:1785646188
- ansible-automation-platform-27/lightspeed-chatbot-rhel9:1785426734
- jaeger-main-2.19.0-1.hum1
- mta/mta-solution-server-rhel9:1784109883
- RHSA-2026:50479
- RHSA-2026:50340
- RHSA-2026:25039
- RHSA-2026:43038
Official advisory · high-confidence parse· fetched 17 days ago·verify at source
Mitigation checklist
- The risk can be mitigated by rejecting oversized serialized JWS inputs before they reach joserfc and enforcing strict request/body size limits at the application or reverse-proxy layer.
Official advisory · high-confidence parse· fetched 17 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.