AIKIDO-2026-11098

TL;DR

When System.IdentityModel.Tokens.Jwt validates or creates JWTs, large claim sets rent oversized buffers from the shared ArrayPool and previously decoded beyond the written payload, so stale pool bytes could be parsed as claims. Token encoding and utility paths also returned pooled arrays without clearing them, leaving header, payload, and signing bytes in the shared pool for later operations in the same process. An attacker who can submit JWTs to a shared host may influence pool reuse timing and recover residual sensitive bytes from prior token handling. Version 8.19.0 slices rented buffers to the decoded size and clears pooled arrays on return across the affected JWT paths.