PT-2026-53178

Impact When a JWE uses a password-based key-encryption algorithm PBES2-HS256+A128KW, PBES2-HS384+A192KW, PBES2-HS512+A256KW, PBES2AESKW::unwrapKey reads the p2c PBKDF2 iteration count parameter directly from the attacker-controlled JOSE header and passes it to hash pbkdf2 with no upper bound. The...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded processing of the p2c parameter in PBES2 JWE decryption. An attacker can cause denial of service by supplying a crafted JWE containing an excessively large p2c value in...

CVE-2026-27932

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. In 1.6.2 and earlier, a resource exhaustion vulnerability in joserfc allows an unauthenticated attacker to cause a Denial of Service DoS via CPU exhaustion. When the library...

EUVD-2023-3143

Malicious code in bioql PyPI...

jose4j: denial of service via specially crafted JWE

A flaw was found in the jose.4.j jose4j library. The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c PBES2 Count. This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its primary purpose is to intentionally slow down...

GHSA-6PFF-FMH2-4MMF Apache CXF Denial of Service vulnerability in JOSE

An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token...

CVE-2024-32007

An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token...

CVE-2024-32007: Uncontrolled Resource Consumption

An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token...

PT-2024-5228 · Atlassian +1 · Bitbucket Data Center/Server +2

Name of the Vulnerable Software and Affected Versions: Apache CXF versions prior to 3.5.9 Apache CXF versions prior to 3.6.4 Apache CXF versions prior to 4.0.5 Bitbucket Data Center and Server versions 8.9.0 through 8.9.18 Bitbucket Data Center and Server versions 8.18.0 Bitbucket Data Center and...

The vulnerability of the Jose4j JWT library, related to the incorrect implementation of the PBES2 algorithm when processing the p2c parameter, allows a violator to trigger a service failure.

The vulnerability of the Jose4j JWT library is related to the incorrect implementation of the PBES2 algorithm when processing the p2c parameter. Exploiting this vulnerability can allow an attacker who operates remotely to cause a service failure...

Denial Of Service (DoS)

jose2go is vulnerable to Denial of Service DoS. The vulnerability is caused due to a lack of input validation and handling for the "p2c" PBES2 Count parameter. This allows an attacker to provide a large "p2c" value, leading to a Denial of Service DoS CPU consumption vulnerability...

CVE-2023-49290: Uncontrolled Resource Consumption

lestrrat-go/jwx is a Go module implementing various JWx JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE technologies. A p2c parameter set too high in JWE's algorithm PBES2- could lead to a denial of service. The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c...

PT-2023-7638 · Unknown · Lestrrat-Go/Jwx

Name of the Vulnerable Software and Affected Versions: lestrrat-go/jwx versions prior to 1.2.27 lestrrat-go/jwx versions prior to 2.0.18 Description: The issue is related to the JWE key management algorithms based on PBKDF2, which require a JOSE Header Parameter called p2c PBES2 Count. This...

PT-2023-8747

Name of the Vulnerable Software and Affected Versions jose4j versions prior to 0.9.4 Description The issue is related to the improper implementation of the PBES2 algorithm in the jose4j component when handling the p2c parameter. This can allow a remote attacker to cause a denial of service due to...