Skip to content

Denial of Service in Connect2id Nimbus JOSE+JWT

Moderate severity GitHub Reviewed Published Feb 11, 2024 to the GitHub Advisory Database • Updated Mar 15, 2024

Package

maven com.nimbusds:nimbus-jose-jwt (Maven)

Affected versions

< 9.37.2

Patched versions

9.37.2

Description

In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.

References

Published by the National Vulnerability Database Feb 11, 2024
Published to the GitHub Advisory Database Feb 11, 2024
Last updated Mar 15, 2024
Reviewed Mar 15, 2024

Severity

Moderate

EPSS score

0.045%
(16th percentile)

Weaknesses

CVE ID

CVE-2023-52428

GHSA ID

GHSA-gvpg-vgmx-xg6w

Source code

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.