Skip to content
VulniPulse
Sign in
Highest advisory severityMedium 1 vendor · 1 advisory

CVE-2026-48990

CVE-2026-48990: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

Red Hat

1 advisory
  • Advisory severityMedium5.3

    Medium [CVE-2026-48990] Resource exhaustion via oversized JSON Web Signature (JWS) payloads

    CVE-2026-48990Source published Source updated

    joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions 1.3.4 through 1.6.5, joserfc accepts oversized RFC7797 b64=false JWS payloads without applying JWSRegistry.max_payload_length, which can lead to resource exhaustion. The normal JWS compact and flattened JSON paths reject payloads above the configured payload-size limit with ExceededSizeError. The RFC7797 unencoded payload paths do not make the same check. A valid b64=false compact or flattened JSON JWS can therefore deserialize successfully with a payload larger than JWSRegistry.max_payload_length. Applications that accept lower-trust JWS values and rely on joserfc to reject oversized token content during verification have a moderate availability risk.…

    Affected products in this advisory
    • Red Hat Ansible Automation Platform 2.6
    • Red Hat Ansible Automation Platform 2.7
    • Red Hat Hardened Images
    • Red Hat Migration Toolkit for Applications 8.2
    Source-reported affected versions
    • 1.3.4
    • 1.6.5
    Source-reported fixed versions
    • 1.6.7
    • ansible-automation-platform-26/lightspeed-chatbot-rhel9:1785646188
    • ansible-automation-platform-27/lightspeed-chatbot-rhel9:1785426734
    • jaeger-main-2.19.0-1.hum1

    5 more entries in the full advisory.

    Mitigation guidance
    • The risk can be mitigated by rejecting oversized serialized JWS inputs before they reach joserfc and enforcing strict request/body size limits at the application or reverse-proxy layer.
    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Monitor future Red Hat CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features