A critical resource exhaustion vulnerability in the joserfc library allows unauthenticated remote attackers to cause a Denial of Service by forcing excessive CPU consumption.

This vulnerability occurs because the library fails to bound the p2c (PBES2 Count) parameter in JSON Web Encryption tokens. An unauthenticated attacker can supply a malicious token with an extremely high iteration count, forcing the server to exhaust CPU resources during key derivation.

Successful exploitation of this vulnerability results in a Denial of Service, rendering applications using the affected library unavailable to legitimate users. Given the high CVSS score of 7.5, this represents a significant risk to service availability and system stability. Organizations relying on joserfc for token decryption may face operational disruption and potential cascading failures in downstream services.

Immediate Action: Update the joserfc library to version 1.6.3 or later via your package manager, such as pip, to implement the necessary bounds checking on the PBES2 iteration parameter.

Proactive Monitoring: Monitor server CPU utilization metrics and application logs for frequent, unusually high processing times during token decryption or authentication flows.

Compensating Controls: If immediate patching is not feasible, restrict the use of PBES2 algorithms within your application policy to prevent the processing of untrusted JWE tokens.

Public Exploit Available: Unknown.

This vulnerability presents a clear and actionable risk to system availability. Administrators should prioritize upgrading to version 1.6.3 immediately to secure the library against resource exhaustion attacks. Failure to patch leaves the application susceptible to trivial, unauthenticated Denial of Service attempts that could severely impact business operations.