Untriaged
Permalink
CVE-2026-33204
7.5 HIGH
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): NONE
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): NONE
- Integrity impact (I): NONE
- Availability impact (A): HIGH
SimpleJWT has an Unauthenticated Denial of Service via JWE header tampering
SimpleJWT is a simple JSON web token library written in PHP. Prior to version 1.1.1, an unauthenticated attacker can perform a Denial of Service via JWE header tampering when PBES2 algorithms are used. Applications that call JWE::decrypt() on attacker-controlled JWEs using PBES2 algorithms are affected. This issue has been patched in version 1.1.1.
References
- https://github.com/kelvinmo/simplejwt/security/advisories/GHSA-xw36-67f8-339x x_refsource_CONFIRM
- https://github.com/kelvinmo/simplejwt/releases/tag/v1.1.1 x_refsource_MISC
Affected products
simplejwt
- ==< 1.1.1
Matching in nixpkgs
pkgs.python312Packages.djangorestframework-simplejwt
JSON Web Token authentication plugin for Django REST Framework
pkgs.python313Packages.djangorestframework-simplejwt
JSON Web Token authentication plugin for Django REST Framework
pkgs.python314Packages.djangorestframework-simplejwt
JSON Web Token authentication plugin for Django REST Framework
Package maintainers
-
@arnoldfarkas Arnold Farkas <arnold.farkas@gmail.com>