Authlib joserfc

• CVE-2026-119284 Medium 6.9 joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection 0.2%
• CVE-2026-119283 High 7.5 joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption 0.2%
• CVE-2026-102946 Critical 9.1 joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json 0.1%
• CVE-2026-75509 Medium 6.5 joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti) 0.1%
• CVE-2026-62995 Low 2.3 joserfc accepts JWT with padding, leading to JWT malleability 0.1%
• CVE-2026-49852 High 8.7 joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363) 0.2%
• CVE-2026-48990 Medium 5.3 joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization 0.2%
• CVE-2026-27932 High 7.5 joserfc PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS) 0.5%
• CVE-2025-65015 Critical 9.2 joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads 0.4%