joserfc: CPU exhaustion via unbounded JWE recipients array

The joserfc library version 1.7.4 and earlier is vulnerable to a CPU exhaustion Denial of Service (DoS) attack. The library's decrypt_json() function parses JWE General JSON Serialization objects without enforcing an upper bound on the number of entries in the recipients array. An attacker can craft a JWE payload with a large number of RSA-OAEP recipients, forcing the vulnerable application to perform an RSA private-key decryption operation for every recipient present. This behavior occurs unconditionally, even if verify_all_recipients=False is set, leading to high CPU usage relative to the size of the submitted request.

Attack Chain

1. Attacker generates a valid JWE General JSON object using the victim's public RSA key.
2. Attacker adds an arbitrary, large number of recipients to the JWE recipients array.
3. Attacker sends the crafted JSON object to a target endpoint that uses joserfc.jwe.decrypt_json().
4. joserfc parser iterates through the full recipients array without checking the count.
5. The library unconditionally invokes decrypt_recipient() for each entry in the list.
6. For each recipient, the library performs a computationally expensive RSA private-key decryption operation.
7. High CPU usage is sustained for the duration of these operations, resulting in service degradation or availability loss.

Impact

Successful exploitation results in a Denial of Service (DoS) via resource exhaustion. The vulnerability is highly asymmetric, where relatively small malicious HTTP requests induce disproportionately high CPU load on the victim's server. No confidentiality or integrity impact was observed.

Recommendation

Upgrade joserfc to version 1.7.5 or later. If upgrading is not immediately possible, implement a request-size limit at the Web Application Firewall (WAF) or application gateway level that corresponds to a reasonable number of recipients to mitigate the attack surface until the library is patched.