Skip to content
Threat Feed
Subscribe

Tag

Joserfc

1 brief RSS
medium advisory

joserfc: CPU exhaustion via unbounded JWE recipients array

An unauthenticated remote attacker can cause a denial-of-service by submitting a specially crafted JWE General JSON object containing an unbounded number of recipients, forcing the server to perform an excessive number of expensive RSA private-key decryption operations.

joserfc denial-of-service cwe-400 python cryptography
1t