An issue exists in the Oauth extension for MediaWiki up to and including 1.35.2. It did not validate the oarc_version (aka oauth_registered_consumer.oarc_version) parameter's length.