Tag

Cwe-400

1 brief RSS

PHP JWT Library PBES2-HS+AKW Unbounded p2c Iteration Count Leads to DoS

An unauthenticated attacker can exploit a vulnerability in the PHP JWT Library's PBES2AESKW::unwrapKey() function when processing JWE tokens that use PBES2-HS*+A*KW algorithms by crafting a JWE with an excessively large 'p2c' (PBKDF2 iteration count) parameter in the JOSE header, forcing the server to perform an unbounded and CPU-intensive PBKDF2 computation, resulting in a CPU-amplification denial of service.

jwt-library +3 denial-of-service web php jwt jwe cwe-400

2r 1t 2d ago

Cwe-400

PHP JWT Library PBES2-HS*+A*KW Unbounded p2c Iteration Count Leads to DoS

PHP JWT Library PBES2-HS+AKW Unbounded p2c Iteration Count Leads to DoS