CVE-2026-33204 Details
Description
SimpleJWT is a simple JSON web token library written in PHP. Prior to version 1.1.1, an unauthenticated attacker can perform a Denial of Service via JWE header tampering when PBES2 algorithms are used. Applications that call JWE::decrypt() on attacker-controlled JWEs using PBES2 algorithms are affected. This issue has been patched in version 1.1.1.
A denial-of-service vulnerability has been identified in SimpleJWT, a JSON web token library for PHP, prior to version 1.1.1. The issue arises when PBES2 algorithms are used, allowing an unauthenticated attacker to manipulate JWE headers and cause CPU exhaustion. This vulnerability affects applications that decrypt attacker-controlled JWEs with PBES2 algorithms.
Users can upgrade to SimpleJWT version 1.1.1, which addresses the vulnerability by adding validation to the 'p2c' parameter in PBES2 algorithms.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/kelvinmo/simplejwt/releases/tag/v1.1.1 | [email protected] | ProductRelease Notes |
| https://github.com/kelvinmo/simplejwt/security/advisories/GHSA-xw36-67f8-339x | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| kelvinmo simplejwt | < 1.1.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 10, 2026 | Initial Analysis | [email protected] |
| Mar 20, 2026 | New CVE Received | [email protected] |