Skip to content
Threat Feed
Subscribe

Tag

Jwe

1 brief RSS
medium advisory

PHP JWT Library PBES2-HS*+A*KW Unbounded p2c Iteration Count Leads to DoS

An unauthenticated attacker can exploit a vulnerability in the PHP JWT Library's PBES2AESKW::unwrapKey() function when processing JWE tokens that use PBES2-HS*+A*KW algorithms by crafting a JWE with an excessively large 'p2c' (PBKDF2 iteration count) parameter in the JOSE header, forcing the server to perform an unbounded and CPU-intensive PBKDF2 computation, resulting in a CPU-amplification denial of service.

jwt-library +3 denial-of-service web php jwt jwe cwe-400
2r 1t