CVE-2026-33204
SimpleJWT has an Unauthenticated Denial of Service via JWE header tampering
Summary
SimpleJWT has an Unauthenticated Denial of Service via JWE header tampering
Original description
The description as published by the source.
SimpleJWT is a simple JSON web token library written in PHP. Prior to version 1.1.1, an unauthenticated attacker can perform a Denial of Service via JWE header tampering when PBES2 algorithms are used. Applications that call JWE::decrypt() on attacker-controlled JWEs using PBES2 algorithms are affected. This issue has been patched in version 1.1.1.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web github.com