Critical CVE-2025-65015 Vulnerability in joserfc Could Let Attackers Exhaust Server Resources via Oversized JWT Tokens

A critical vulnerability in the Python library joserfc, tracked as CVE-2025-65015 with a CVSS of 9.2, can let attackers exhaust server resources by logging extremely large JWT payloads. The issue centres on how the library embeds parts of JWT tokens in exception messages, which can trigger massive log entries when oversized tokens pass through decoding or validation routines.

According to the advisory, the problem occurs because the ExceededSizeError messages include non-decoded JWT parts, potentially causing Python logging to record arbitrarily large forged payloads. This can overwhelm CPU, memory and I/O, affecting application servers and log pipelines, and it requires no authentication to exploit.

The joserfc authors have released patches in versions 1.3.5 and 1.4.2, and users running affected versions >=1.3.3 and <=1.4.1 are urged to upgrade immediately; the fix stops including the raw JWT payload in the exception messages. The advisory also recommends deploying behind proper reverse proxies such as nginx to enforce strict header size limits.