CVE-2026-33204
SimpleJWT has an Unauthenticated Denial of Service via JWE header tampering
概要
SimpleJWT has an Unauthenticated Denial of Service via JWE header tampering
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
SimpleJWT is a simple JSON web token library written in PHP. Prior to version 1.1.1, an unauthenticated attacker can perform a Denial of Service via JWE header tampering when PBES2 algorithms are used. Applications that call JWE::decrypt() on attacker-controlled JWEs using PBES2 algorithms are affected. This issue has been patched in version 1.1.1.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web github.com