A vulnerability in the SimpleJWT PHP library allows an unauthenticated attacker to trigger a Denial of Service condition on applications processing maliciously crafted JWE headers.

This is an uncontrolled resource consumption flaw (CWE-400) occurring when the library calls JWE::decrypt() on attacker-controlled JWEs. An unauthenticated attacker can exploit this by providing a crafted JWE header using PBES2 algorithms to exhaust system resources.

The ability for an unauthenticated remote attacker to crash an application leads to significant service unavailability, potentially impacting business operations that rely on token-based authentication or data exchange. With a CVSS score of 7.5, this high-severity flaw represents a notable risk to system uptime and stability, as it does not require prior knowledge of user credentials to execute.

Immediate Action: Update the SimpleJWT library to version 1.1.1 or later via your package manager (Packagist).

Proactive Monitoring: Monitor server logs for unexpected spikes in CPU or memory usage associated with token decryption routines or high volumes of malformed JWE requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect and filter incoming traffic for suspicious JWE header patterns, though patching remains the only definitive remediation.

Public Exploit Available: Unknown

Given the ease of exploitation and the potential for service disruption, organizations using the SimpleJWT library must prioritize upgrading to version 1.1.1. Failure to apply this patch leaves your application vulnerable to trivial Denial of Service attacks that could bypass standard security perimeters.