CVE-2026-33204
SimpleJWT has an Unauthenticated Denial of Service via JWE header tampering
Résumé
SimpleJWT has an Unauthenticated Denial of Service via JWE header tampering
Description d'origine
La description telle que publiée par la source (souvent en anglais).
SimpleJWT is a simple JSON web token library written in PHP. Prior to version 1.1.1, an unauthenticated attacker can perform a Denial of Service via JWE header tampering when PBES2 algorithms are used. Applications that call JWE::decrypt() on attacker-controlled JWEs using PBES2 algorithms are affected. This issue has been patched in version 1.1.1.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web github.com