The PHP JWT Library contains a vulnerability in its PBES2-HS*+A*KW key unwrapping implementation where the iteration count parameter (p2c) from the attacker-controlled JOSE header is not properly bounded. This allows an unauthenticated attacker to specify an extremely large iteration count, causing excessive CPU consumption during PBKDF2 computation and resulting in a denial of service. The vulnerability affects applications that enable PBES2 algorithms for decryption. A patch has been introduced that enforces a configurable maximum iteration count to prevent CPU amplification attacks.