CVE-2026-27932: Hsiaoming Joserfc DoS Vulnerability

CVE-2026-27932 Overview

CVE-2026-27932 is a resource exhaustion vulnerability affecting the joserfc Python library, which provides implementations of JSON Object Signing and Encryption (JOSE) standards. The vulnerability allows an unauthenticated attacker to cause a Denial of Service (DoS) via CPU exhaustion when the library processes maliciously crafted JSON Web Encryption (JWE) tokens using Password-Based Encryption (PBES2) algorithms.

The flaw exists because joserfc reads the p2c (PBES2 Count) parameter directly from the token's protected header without proper validation or bounds checking. This parameter controls the number of iterations for the PBKDF2 key derivation function. By specifying an extremely large iteration count (e.g., 2^31 - 1), an attacker can force the server to expend massive CPU resources processing a single malicious token.

Critical Impact
Unauthenticated attackers can exhaust server CPU resources with a single malicious JWE token, causing service disruption for applications using PBES2 algorithms.

Affected Products

hsiaoming joserfc versions 1.6.2 and earlier
All applications using joserfc for JWE/JWT decryption with PBES2 algorithms enabled

Discovery Timeline

2026-03-03 - CVE-2026-27932 published to NVD
2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-27932

Vulnerability Analysis

This vulnerability exists at the JWA (JSON Web Algorithms) layer within the joserfc library and impacts all high-level JWE and JWT decryption interfaces when PBES2 algorithms are permitted by the application's policy. The core issue stems from improper resource allocation without limits, categorized under CWE-770 (Allocation of Resources Without Limits or Throttling).

When processing JWE tokens encrypted with PBES2 algorithms (such as PBES2-HS256+A128KW, PBES2-HS384+A192KW, or PBES2-HS512+A256KW), the library must derive an encryption key using PBKDF2. The p2c parameter in the JWE protected header specifies how many iterations PBKDF2 should perform during key derivation. This parameter is intended to make brute-force attacks computationally expensive, but when left unbounded, it becomes an attack vector.

Root Cause

The root cause is the absence of input validation on the p2c parameter before it is used in the PBKDF2 key derivation process. The library trusts the attacker-controlled value from the JWE header without enforcing a reasonable upper limit. This allows malicious actors to specify arbitrarily high iteration counts that were never intended by the application developer.

Attack Vector

The attack can be executed remotely over the network without authentication. An attacker crafts a malicious JWE token with an extremely high p2c value in the protected header and submits it to any endpoint that processes JWE tokens using joserfc with PBES2 algorithms enabled.

The attack is particularly effective because:

No authentication required - The malicious token is processed before any authentication checks occur
Single request impact - A single HTTP request containing the malicious token can consume significant CPU resources
Amplification effect - The computational cost scales linearly with the p2c value, allowing massive amplification
Blocking nature - PBKDF2 operations are CPU-bound and can block application threads during processing

The vulnerability manifests when the library decrypts JWE tokens using PBES2 algorithms. An attacker can craft a JWE token with an excessively large p2c value (e.g., 2147483647) in the protected header. When the server attempts to decrypt this token, it will perform billions of PBKDF2 iterations, consuming CPU resources for an extended period. See the GitHub Security Advisory for additional technical details.

Detection Methods for CVE-2026-27932

Indicators of Compromise

Sudden CPU spikes on servers processing JWT/JWE tokens
Increased response times or timeouts for authentication endpoints
Presence of JWE tokens with unusually high p2c values in request logs
Thread pool exhaustion or worker process hangs during token processing

Detection Strategies

Monitor application endpoints that accept JWE tokens for requests containing abnormally high p2c parameter values
Implement request logging that captures JWE protected header parameters for forensic analysis
Configure web application firewalls (WAF) to inspect and flag JWE tokens with suspicious p2c values exceeding reasonable thresholds
Deploy application performance monitoring (APM) to detect CPU anomalies correlated with JWT/JWE processing functions

Monitoring Recommendations

Set up CPU utilization alerts with thresholds appropriate for your baseline, investigating spikes that coincide with token processing activity
Monitor PBKDF2 function execution times and alert on operations exceeding expected durations
Track concurrent JWE decryption operations to identify potential DoS attempts
Implement rate limiting on endpoints that process JWE tokens to reduce the impact of sustained attacks

How to Mitigate CVE-2026-27932

Immediate Actions Required

Upgrade joserfc to a patched version that includes validation of the p2c parameter
If upgrade is not immediately possible, consider disabling PBES2 algorithms in your application's JWE policy
Implement application-level validation of p2c values before token processing
Review and restrict which encryption algorithms are accepted by your application

Patch Information

The vulnerability has been addressed in the joserfc repository. The fix is available in commit 696a9611ab982c45ee2190ed79ca8e1d8e09398f, which introduces proper bounds checking for the p2c parameter. Organizations should upgrade to a version containing this fix.

Refer to the GitHub Commit Update for the specific code changes, and the GitHub Security Advisory for complete remediation guidance.

Workarounds

Disable PBES2 algorithms entirely if they are not required by your application by configuring your JWE policy to only accept non-password-based key encryption algorithms
Implement a pre-processing validation layer that rejects JWE tokens with p2c values exceeding a reasonable threshold (e.g., 310,000 iterations as recommended by OWASP for PBKDF2-SHA256)
Deploy rate limiting on authentication endpoints to reduce the impact of potential DoS attempts
Consider using alternative key encryption algorithms such as RSA-OAEP or ECDH-ES that do not rely on password-based key derivation

bash

# Example: Upgrade joserfc using pip
pip install --upgrade joserfc

# Verify the installed version
pip show joserfc | grep Version