[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-48990":6},{"stargazers_count":4,"fetched_at":5},7,"2026-08-01T00:21:03.480Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":449,"aliases":450,"duplicate_of":9,"upstream":453,"downstream":454,"duplicates":463,"related":464,"reserved_at":9,"published_at":468,"modified_at":469,"state":470,"summary":471,"references_raw":480,"kevs":511,"epss":512,"epss_history":515,"metrics":568,"affected":576},"CVE-2026-48990","joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions 1.3.4 through 1.6.5, joserfc accepts oversized RFC7797 b64=false JWS payloads without applying JWSRegistry.max_payload_length, which can lead to resource exhaustion. The normal JWS compact and flattened JSON paths reject payloads above the configured payload-size limit with ExceededSizeError. The RFC7797 unencoded payload paths do not make the same check. A valid b64=false compact or flattened JSON JWS can therefore deserialize successfully with a payload larger than JWSRegistry.max_payload_length. Applications that accept lower-trust JWS values and rely on joserfc to reject oversized token content during verification have a moderate availability risk. This issue has been fixed in version 1.6.7.",null,[11,86],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-400","Uncontrolled Resource Consumption","The product does not properly control the allocation and maintenance of a limited resource.","weakness","Draft","Class","High",[20,24,82],{"id":21,"name":22,"techniques":23},"CAPEC-147","XML Ping of the Death",[],{"id":25,"name":26,"techniques":27},"CAPEC-227","Sustained Client Engagement",[28],{"id":29,"name":30,"tactics":31,"countermeasures":35},"T1499","Endpoint Denial of Service",[32],{"id":33,"name":34},"TA0105","Impact",[36,41,45,49,53,57,61,65,69,73,78],{"id":37,"name":38,"tactic":39},"D3-UGLPA","User Geolocation Logon Pattern Analysis",{"name":40},"Detect",{"id":42,"name":43,"tactic":44},"D3-PMAD","Protocol Metadata Anomaly Detection",{"name":40},{"id":46,"name":47,"tactic":48},"D3-CSPP","Client-server Payload Profiling",{"name":40},{"id":50,"name":51,"tactic":52},"D3-PHDURA","Per Host Download-Upload Ratio Analysis",{"name":40},{"id":54,"name":55,"tactic":56},"D3-NTSA","Network Traffic Signature Analysis",{"name":40},{"id":58,"name":59,"tactic":60},"D3-APCA","Application Protocol Command Analysis",{"name":40},{"id":62,"name":63,"tactic":64},"D3-NTCD","Network Traffic Community Deviation",{"name":40},{"id":66,"name":67,"tactic":68},"D3-RTSD","Remote Terminal Session Detection",{"name":40},{"id":70,"name":71,"tactic":72},"D3-ISVA","Inbound Session Volume Analysis",{"name":40},{"id":74,"name":75,"tactic":76},"D3-NTF","Network Traffic Filtering",{"name":77},"Isolate",{"id":79,"name":80,"tactic":81},"D3-ITF","Inbound Traffic Filtering",{"name":77},{"id":83,"name":84,"techniques":85},"CAPEC-492","Regular Expression Exponential Blowup",[],{"_key":87,"id":87,"name":88,"description":89,"type":15,"status":90,"abstraction":91,"likelihood_of_exploit":18,"capec":92},"CWE-770","Allocation of Resources Without Limits or Throttling","The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.","Incomplete","Base",[93,151,161,163,167,171,175,179,211,273,277,281,311,341,373,377,381,385,389,393],{"id":94,"name":95,"techniques":96},"CAPEC-125","Flooding",[97,125],{"id":98,"name":99,"tactics":100,"countermeasures":102},"T1498.001","Direct Network Flood",[101],{"id":33,"name":34},[103,105,107,109,111,113,115,117,119,121,123],{"id":37,"name":38,"tactic":104},{"name":40},{"id":42,"name":43,"tactic":106},{"name":40},{"id":46,"name":47,"tactic":108},{"name":40},{"id":50,"name":51,"tactic":110},{"name":40},{"id":54,"name":55,"tactic":112},{"name":40},{"id":58,"name":59,"tactic":114},{"name":40},{"id":62,"name":63,"tactic":116},{"name":40},{"id":66,"name":67,"tactic":118},{"name":40},{"id":70,"name":71,"tactic":120},{"name":40},{"id":74,"name":75,"tactic":122},{"name":77},{"id":79,"name":80,"tactic":124},{"name":77},{"id":29,"name":30,"tactics":126,"countermeasures":128},[127],{"id":33,"name":34},[129,131,133,135,137,139,141,143,145,147,149],{"id":37,"name":38,"tactic":130},{"name":40},{"id":42,"name":43,"tactic":132},{"name":40},{"id":46,"name":47,"tactic":134},{"name":40},{"id":50,"name":51,"tactic":136},{"name":40},{"id":54,"name":55,"tactic":138},{"name":40},{"id":58,"name":59,"tactic":140},{"name":40},{"id":62,"name":63,"tactic":142},{"name":40},{"id":66,"name":67,"tactic":144},{"name":40},{"id":70,"name":71,"tactic":146},{"name":40},{"id":74,"name":75,"tactic":148},{"name":77},{"id":79,"name":80,"tactic":150},{"name":77},{"id":152,"name":153,"techniques":154},"CAPEC-130","Excessive Allocation",[155],{"id":156,"name":157,"tactics":158,"countermeasures":160},"T1499.003","Application Exhaustion Flood",[159],{"id":33,"name":34},[],{"id":21,"name":22,"techniques":162},[],{"id":164,"name":165,"techniques":166},"CAPEC-197","Exponential Data Expansion",[],{"id":168,"name":169,"techniques":170},"CAPEC-229","Serialized Data Parameter Blowup",[],{"id":172,"name":173,"techniques":174},"CAPEC-230","Serialized Data with Nested Payloads",[],{"id":176,"name":177,"techniques":178},"CAPEC-231","Oversized Serialized Data Payloads",[],{"id":180,"name":181,"techniques":182},"CAPEC-469","HTTP DoS",[183],{"id":184,"name":185,"tactics":186,"countermeasures":188},"T1499.002","Service Exhaustion Flood",[187],{"id":33,"name":34},[189,191,193,195,197,199,201,203,205,207,209],{"id":37,"name":38,"tactic":190},{"name":40},{"id":42,"name":43,"tactic":192},{"name":40},{"id":46,"name":47,"tactic":194},{"name":40},{"id":50,"name":51,"tactic":196},{"name":40},{"id":54,"name":55,"tactic":198},{"name":40},{"id":58,"name":59,"tactic":200},{"name":40},{"id":62,"name":63,"tactic":202},{"name":40},{"id":66,"name":67,"tactic":204},{"name":40},{"id":70,"name":71,"tactic":206},{"name":40},{"id":74,"name":75,"tactic":208},{"name":77},{"id":79,"name":80,"tactic":210},{"name":77},{"id":212,"name":213,"techniques":214},"CAPEC-482","TCP Flood",[215,241,247],{"id":98,"name":99,"tactics":216,"countermeasures":218},[217],{"id":33,"name":34},[219,221,223,225,227,229,231,233,235,237,239],{"id":37,"name":38,"tactic":220},{"name":40},{"id":42,"name":43,"tactic":222},{"name":40},{"id":46,"name":47,"tactic":224},{"name":40},{"id":50,"name":51,"tactic":226},{"name":40},{"id":54,"name":55,"tactic":228},{"name":40},{"id":58,"name":59,"tactic":230},{"name":40},{"id":62,"name":63,"tactic":232},{"name":40},{"id":66,"name":67,"tactic":234},{"name":40},{"id":70,"name":71,"tactic":236},{"name":40},{"id":74,"name":75,"tactic":238},{"name":77},{"id":79,"name":80,"tactic":240},{"name":77},{"id":242,"name":243,"tactics":244,"countermeasures":246},"T1499.001","OS Exhaustion Flood",[245],{"id":33,"name":34},[],{"id":184,"name":185,"tactics":248,"countermeasures":250},[249],{"id":33,"name":34},[251,253,255,257,259,261,263,265,267,269,271],{"id":37,"name":38,"tactic":252},{"name":40},{"id":42,"name":43,"tactic":254},{"name":40},{"id":46,"name":47,"tactic":256},{"name":40},{"id":50,"name":51,"tactic":258},{"name":40},{"id":54,"name":55,"tactic":260},{"name":40},{"id":58,"name":59,"tactic":262},{"name":40},{"id":62,"name":63,"tactic":264},{"name":40},{"id":66,"name":67,"tactic":266},{"name":40},{"id":70,"name":71,"tactic":268},{"name":40},{"id":74,"name":75,"tactic":270},{"name":77},{"id":79,"name":80,"tactic":272},{"name":77},{"id":274,"name":275,"techniques":276},"CAPEC-486","UDP Flood",[],{"id":278,"name":279,"techniques":280},"CAPEC-487","ICMP Flood",[],{"id":282,"name":283,"techniques":284},"CAPEC-488","HTTP Flood",[285],{"id":184,"name":185,"tactics":286,"countermeasures":288},[287],{"id":33,"name":34},[289,291,293,295,297,299,301,303,305,307,309],{"id":37,"name":38,"tactic":290},{"name":40},{"id":42,"name":43,"tactic":292},{"name":40},{"id":46,"name":47,"tactic":294},{"name":40},{"id":50,"name":51,"tactic":296},{"name":40},{"id":54,"name":55,"tactic":298},{"name":40},{"id":58,"name":59,"tactic":300},{"name":40},{"id":62,"name":63,"tactic":302},{"name":40},{"id":66,"name":67,"tactic":304},{"name":40},{"id":70,"name":71,"tactic":306},{"name":40},{"id":74,"name":75,"tactic":308},{"name":77},{"id":79,"name":80,"tactic":310},{"name":77},{"id":312,"name":313,"techniques":314},"CAPEC-489","SSL Flood",[315],{"id":184,"name":185,"tactics":316,"countermeasures":318},[317],{"id":33,"name":34},[319,321,323,325,327,329,331,333,335,337,339],{"id":37,"name":38,"tactic":320},{"name":40},{"id":42,"name":43,"tactic":322},{"name":40},{"id":46,"name":47,"tactic":324},{"name":40},{"id":50,"name":51,"tactic":326},{"name":40},{"id":54,"name":55,"tactic":328},{"name":40},{"id":58,"name":59,"tactic":330},{"name":40},{"id":62,"name":63,"tactic":332},{"name":40},{"id":66,"name":67,"tactic":334},{"name":40},{"id":70,"name":71,"tactic":336},{"name":40},{"id":74,"name":75,"tactic":338},{"name":77},{"id":79,"name":80,"tactic":340},{"name":77},{"id":342,"name":343,"techniques":344},"CAPEC-490","Amplification",[345],{"id":346,"name":347,"tactics":348,"countermeasures":350},"T1498.002","Reflection Amplification",[349],{"id":33,"name":34},[351,353,355,357,359,361,363,365,367,369,371],{"id":37,"name":38,"tactic":352},{"name":40},{"id":42,"name":43,"tactic":354},{"name":40},{"id":46,"name":47,"tactic":356},{"name":40},{"id":50,"name":51,"tactic":358},{"name":40},{"id":54,"name":55,"tactic":360},{"name":40},{"id":58,"name":59,"tactic":362},{"name":40},{"id":62,"name":63,"tactic":364},{"name":40},{"id":66,"name":67,"tactic":366},{"name":40},{"id":70,"name":71,"tactic":368},{"name":40},{"id":74,"name":75,"tactic":370},{"name":77},{"id":79,"name":80,"tactic":372},{"name":77},{"id":374,"name":375,"techniques":376},"CAPEC-491","Quadratic Data Expansion",[],{"id":378,"name":379,"techniques":380},"CAPEC-493","SOAP Array Blowup",[],{"id":382,"name":383,"techniques":384},"CAPEC-494","TCP Fragmentation",[],{"id":386,"name":387,"techniques":388},"CAPEC-495","UDP Fragmentation",[],{"id":390,"name":391,"techniques":392},"CAPEC-496","ICMP Fragmentation",[],{"id":394,"name":395,"techniques":396},"CAPEC-528","XML Flood",[397,423],{"id":184,"name":185,"tactics":398,"countermeasures":400},[399],{"id":33,"name":34},[401,403,405,407,409,411,413,415,417,419,421],{"id":37,"name":38,"tactic":402},{"name":40},{"id":42,"name":43,"tactic":404},{"name":40},{"id":46,"name":47,"tactic":406},{"name":40},{"id":50,"name":51,"tactic":408},{"name":40},{"id":54,"name":55,"tactic":410},{"name":40},{"id":58,"name":59,"tactic":412},{"name":40},{"id":62,"name":63,"tactic":414},{"name":40},{"id":66,"name":67,"tactic":416},{"name":40},{"id":70,"name":71,"tactic":418},{"name":40},{"id":74,"name":75,"tactic":420},{"name":77},{"id":79,"name":80,"tactic":422},{"name":77},{"id":98,"name":99,"tactics":424,"countermeasures":426},[425],{"id":33,"name":34},[427,429,431,433,435,437,439,441,443,445,447],{"id":37,"name":38,"tactic":428},{"name":40},{"id":42,"name":43,"tactic":430},{"name":40},{"id":46,"name":47,"tactic":432},{"name":40},{"id":50,"name":51,"tactic":434},{"name":40},{"id":54,"name":55,"tactic":436},{"name":40},{"id":58,"name":59,"tactic":438},{"name":40},{"id":62,"name":63,"tactic":440},{"name":40},{"id":66,"name":67,"tactic":442},{"name":40},{"id":70,"name":71,"tactic":444},{"name":40},{"id":74,"name":75,"tactic":446},{"name":77},{"id":79,"name":80,"tactic":448},{"name":77},[],[451,452],"GHSA-wphv-vfrh-23q5","PYSEC-2026-2530",[],[455,457,459,461],{"_key":456},"DEBIAN-CVE-2026-48990",{"_key":458},"OPENSUSE-SU-2026:11067-1",{"_key":460},"UBUNTU-CVE-2026-48990",{"_key":462},"RHSA-2026:25039",[],[465,466],{"_key":458},{"_key":467},"CGA-G99C-9V78-PXX3","2026-06-17T21:08:10.534Z","2026-06-18T12:51:59.900Z","PUBLISHED",{"cisa_kev":472,"cisa_ransomware":472,"cisa_vendor":9,"epss_severity":473,"epss_score":474,"severity":475,"severity_score":476,"severity_version":477,"severity_source":478,"severity_vector":479,"severity_status":470},false,"low",0.00163,"medium",5.3,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",[481,488,493,498,503,507],{"url":482,"sources":483,"tags":485},"https://github.com/authlib/joserfc/security/advisories/GHSA-wphv-vfrh-23q5",[478,484],"osv_pypi",[486,487],"X Refsource CONFIRM","WEB",{"url":489,"sources":490,"tags":491},"https://github.com/authlib/joserfc/releases/tag/1.6.7",[478,484],[492,487],"X Refsource MISC",{"url":494,"sources":495,"tags":496},"https://nvd.nist.gov/vuln/detail/CVE-2026-48990",[484],[497],"Advisory",{"url":499,"sources":500,"tags":501},"https://github.com/authlib/joserfc",[484],[502],"PACKAGE",{"url":504,"sources":505,"tags":506},"https://pypi.org/project/joserfc",[484],[502],{"url":508,"sources":509,"tags":510},"https://github.com/advisories/GHSA-wphv-vfrh-23q5",[484],[497],[],{"date":513,"score":474,"percentile":514},"2026-07-05",0.05823,[516,519,522,525,528,531,534,537,540,543,546,549,552,555,558,561,564,567],{"date":517,"score":474,"percentile":518},"2026-06-18",0.05811,{"date":520,"score":474,"percentile":521},"2026-06-19",0.05802,{"date":523,"score":474,"percentile":524},"2026-06-20",0.05795,{"date":526,"score":474,"percentile":527},"2026-06-21",0.05783,{"date":529,"score":474,"percentile":530},"2026-06-22",0.05772,{"date":532,"score":474,"percentile":533},"2026-06-23",0.05779,{"date":535,"score":474,"percentile":536},"2026-06-24",0.05788,{"date":538,"score":474,"percentile":539},"2026-06-25",0.05812,{"date":541,"score":474,"percentile":542},"2026-06-26",0.05841,{"date":544,"score":474,"percentile":545},"2026-06-27",0.05856,{"date":547,"score":474,"percentile":548},"2026-06-28",0.05872,{"date":550,"score":474,"percentile":551},"2026-06-29",0.05863,{"date":553,"score":474,"percentile":554},"2026-06-30",0.0586,{"date":556,"score":474,"percentile":557},"2026-07-01",0.05846,{"date":559,"score":474,"percentile":560},"2026-07-02",0.05829,{"date":562,"score":474,"percentile":563},"2026-07-03",0.05819,{"date":565,"score":474,"percentile":566},"2026-07-04",0.05822,{"date":513,"score":474,"percentile":514},[569,574],{"source":478,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":570,"cvss_v4_0":9},{"baseScore":476,"baseSeverity":571,"vectorString":479,"impactScore":572,"exploitabilityScore":573},"MEDIUM",2.3,10,{"source":484,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":575,"cvss_v4_0":9},{"baseScore":476,"baseSeverity":9,"vectorString":479,"impactScore":572,"exploitabilityScore":573},[577,587],{"ecosystem":9,"name":578,"vendor":579,"product":578,"cpe_part":580,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":581},"joserfc","authlib","a",[582],{"version":583,"is_range":584,"range_type":478,"version_start":9,"version_start_type":9,"version_end":585,"version_end_type":586,"fixed_in":9},"\u003C 1.6.7",true,"1.6.7","excluding",{"ecosystem":588,"name":578,"vendor":588,"product":578,"cpe_part":9,"purl_type":589,"purl_namespace":9,"purl_name":578,"source":9,"versions":590},"PyPI","pypi",[591],{"version":592,"is_range":584,"range_type":593,"version_start":594,"version_start_type":595,"version_end":585,"version_end_type":586,"fixed_in":9},"gte1_3_4_lt1_6_7","ecosystem","1.3.4","including"]