Allocation of Resources Without Limits or Throttling Affecting web-token/jwt-library package, versions <3.4.10>=4.0.0, <4.0.7>=4.1.0, <4.1.7
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Allocation of Resources Without Limits or Throttling vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-PHP-WEBTOKENJWTLIBRARY-17420446
- published23 Jun 2026
- disclosed17 Jun 2026
- creditUnknown
Introduced: 17 Jun 2026
CVE NOT AVAILABLE CWE-770 (opens in a new tab)How to fix?
Upgrade web-token/jwt-library to version 3.4.10, 4.0.7, 4.1.7 or higher.
Overview
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded processing of the p2c parameter in PBES2 JWE decryption. An attacker can cause denial of service by supplying a crafted JWE containing an excessively large p2c value in the JOSE header.
Note: This is only exploitable if the application supports one of the PBES2 key-encryption algorithms (PBES2-HS256+A128KW, PBES2-HS384+A192KW, or PBES2-HS512+A256KW) for JWE decryption.