Resource exhaustion in lua-resty-jwt - #VU163202
Published: November 9, 2026
Vulnerability identifier: #VU163202
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to exhaust nginx worker CPU resources and deny service to affected applications.
The vulnerability exists due to unbounded PBKDF2 iteration counts during JWE parsing in lua-resty-jwt before authentication, with no algorithm whitelist enforcement for JWE tokens. An unauthenticated remote attacker can submit a JWE using PBES2-HS512+A256KW with an arbitrarily large p2c header to trigger expensive key derivation even when decryption ultimately fails.
Affected software
lua-resty-jwt
Remediation
Install security update from vendor's website.
lua-resty-jwt - update to 0.4.0