Threats tagged 'ghsa-jpxq-7h8p-2q76'

The joserfc library's decrypt_json() function for JWE General JSON Serialization accepts an unbounded recipients array, performing an RSA private-key decryption for each recipient without limit. This allows an unauthenticated attacker to cause CPU exhaustion (Denial of Service) by sending a single JWE with many recipients. The library caps other JWE structural elements but does not limit recipient count. The documented mitigation option verify_all_recipients=False does not reduce CPU usage, as all recipients are decrypted regardless. This vulnerability is fixed in joserfc version 1.7.5.