CVE-2026-27932: joserfc Denial of Service via Unbounded PBES2 Iteration Count
Summary
CVE-2026-27932: joserfc's PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS). Affects joserfc versions < 1.6.3. Fixed in 1.6.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
joserfc is a Python library designed for handling JSON Web Encryption (JWE) and JSON Web Tokens (JWT). It provides functionalities for encrypting and decrypting tokens using various algorithms, including Password-Based Encryption (PBES2). The library is widely used in applications that require secure transmission of data. However, it has a vulnerability that allows attackers to exploit the PBES2 iteration count parameter, leading to potential Denial of Service (DoS) attacks.
Vulnerability Detail
The vulnerability arises from an unbounded iteration count (p2c) in the PBES2 decryption process. When joserfc decrypts a JWE token, it reads the p2c parameter directly from the token's protected header without validating its value. An attacker can specify an extremely high p2c value, causing the server to consume excessive CPU resources during the decryption process. This can lead to a Denial of Service, as legitimate users may be unable to access the service while the server is overwhelmed by the resource-intensive operation.
How To Fix
Minimum fixed version
1.6.3
This is the first release that contains the fix.
pip install --upgrade "joserfc==1.6.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the allowed PBES2 algorithms in your JWT policies to prevent the use of PBES2 key management algorithms. This can be done by enforcing a strict allowlist of algorithms in your application settings. Here is an example of how to implement a check for the p2c parameter:
MAX_P2C = 300000 # Example security bound
if not isinstance(p2c, int) or p2c > MAX_P2C: raise DecodeError(f"p2c iteration count too high (max {MAX_P2C})")
Conclusion
The joserfc library has a critical vulnerability that can lead to Denial of Service attacks due to an unbounded PBES2 iteration count. It is essential to update to the patched version and implement additional checks to secure your application against potential attacks.
See every vulnerability recorded for joserfc →
FAQ
CVE-2026-27932 is a vulnerability in the joserfc library that allows an attacker to cause a Denial of Service by exploiting an unbounded PBES2 iteration count.
If your application uses the joserfc library for JWT or JWE decryption and allows PBES2 algorithms, it may be vulnerable to DoS attacks, potentially rendering your service unavailable.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If you cannot update the package, enforce a strict algorithm allowlist in your JWT policies and implement checks for the p2c parameter to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for joserfc.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
