Authlib is vulnerable to Denial of Service via Oversized JOSE Segments

@@ -34,6 +34,8 @@ class JsonWebSignature:
         ]
     )
 
+    MAX_CONTENT_LENGTH: int = 256000
+
     #: Defined available JWS algorithms in the registry
     ALGORITHMS_REGISTRY = {}
 
@@ -89,6 +91,9 @@ def deserialize_compact(self, s, key, decode=None):
 
         .. _`Section 7.1`: https://tools.ietf.org/html/rfc7515#section-7.1
         """
+        if len(s) > self.MAX_CONTENT_LENGTH:
+            raise ValueError("Serialization is too long.")
+
         try:
             s = to_bytes(s)
             signing_input, signature_segment = s.rsplit(b".", 1)

@@ -7,6 +7,9 @@
 
 
 def extract_header(header_segment, error_cls):
+    if len(header_segment) > 256000:
+        raise ValueError("Value of header is too long")
+
     header_data = extract_segment(header_segment, error_cls, "header")
 
     try:
@@ -20,6 +23,9 @@ def extract_header(header_segment, error_cls):
 
 
 def extract_segment(segment, error_cls, name="payload"):
+    if len(segment) > 256000:
+        raise ValueError(f"Value of {name} is too long")
+
     try:
         return urlsafe_b64decode(segment)
     except (TypeError, binascii.Error) as exc:

@@ -297,3 +297,20 @@ def test_ES256K_alg():
     header, payload = data["header"], data["payload"]
     assert payload == b"hello"
     assert header["alg"] == "ES256K"
+
+
+def test_deserialize_exceeds_length():
+    jws = JsonWebSignature()
+    value = "aa" * 256000
+
+    # header exceeds length
+    with pytest.raises(ValueError):
+        jws.deserialize(value + "." + value + "." + value, "")
+
+    # payload exceeds length
+    with pytest.raises(ValueError):
+        jws.deserialize("eyJhbGciOiJIUzI1NiJ9." + value + "." + value, "")
+
+    # signature exceeds length
+    with pytest.raises(ValueError):
+        jws.deserialize("eyJhbGciOiJIUzI1NiJ9.YQ." + value, "")