Threats tagged 'brew-moto-cve-2026-27932'

A resource exhaustion vulnerability in the joserfc library allows an unauthenticated attacker to cause a Denial of Service (DoS) by specifying an unbounded iteration count (p2c) in PBES2 password-based encryption during JSON Web Encryption (JWE) token decryption. The p2c parameter controls the number of iterations for the PBKDF2 key derivation function and is not validated or bounded, enabling attackers to force excessive CPU usage. This affects all high-level JWE and JWT decryption interfaces that allow PBES2 algorithms. The vulnerability is fixed in joserfc version 5.1.21_2.