# web-token jwt-library denial of service via unbounded PBKDF2 iterations

Source: https://junglewise.ai/threats/web-token-jwt-library-denial-of-service-via-unbounded-pbkdf2-iterations-26ced229  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-18. Updated: 2026-06-18  
License: CC BY 4.0 with a link back

Severity: high · CVSS 8.7 · Published 2026-06-18

A vulnerability in the web-token PHP JWT library allows an attacker to crash or slow down a server by sending a specially crafted encrypted token. The library fails to limit the number of mathematical iterations used during decryption, allowing a single request to consume excessive CPU resources. This can lead to a denial-of-service (DoS) condition where the server becomes unresponsive to legitimate users.

Technologies: [Web-Token JWT Framework](https://junglewise.ai/threats/technologies/jwt-framework), [Web-Token JWT Library](https://junglewise.ai/threats/technologies/jwt-library). Vendors: [Web-Token](https://junglewise.ai/threats/vendors/web-token).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, with a CVSS score of 8.7, published 18 June 2026.

**Which products and versions are affected?** Web-Token JWT Framework <= 4.1.6; Web-Token JWT Library < 3.4.10, >= 4.0.0, < 4.0.7, >= 4.1.0, < 4.1.7.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run Web-Token JWT Framework or Web-Token JWT Library at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the PBES2AESKW::unwrapKey() method of the web-token/jwt-library. When processing JSON Web Encryption (JWE) tokens using password-based algorithms (PBES2-HS*+A*KW), the library reads the 'p2c' (iteration count) parameter directly from the JOSE header without an upper bound. An unauthenticated remote attacker can provide a very large iteration count (e.g., PHP_INT_MAX), forcing the server to perform intensive PBKDF2 computations before authentication or decryption fails. This results in uncontrolled resource consumption (CWE-400). Patches introduce a DEFAULT_MAX_COUNT of 1,000,000 iterations to mitigate the risk.

## Affected products

- web-token jwt-library < 3.4.10, >= 4.0.0, < 4.0.7, >= 4.1.0, < 4.1.7
- web-token jwt-framework <= 4.1.6

## Timeline

- 2026-06-06: disclosed
- 2026-06-18: advisory

## References

- [https://github.com/web-token/jwt-framework/security/advisories/GHSA-3prj-6hqw-cm82](https://github.com/web-token/jwt-framework/security/advisories/GHSA-3prj-6hqw-cm82)
- [https://github.com/FriendsOfPHP/security-advisories/blob/master/web-token/jwt-library/GHSA-3prj-6hqw-cm82.yaml](https://github.com/FriendsOfPHP/security-advisories/blob/master/web-token/jwt-library/GHSA-3prj-6hqw-cm82.yaml)
- [https://api.github.com/repos/web-token/jwt-framework/security-advisories/GHSA-3prj-6hqw-cm82](https://api.github.com/repos/web-token/jwt-framework/security-advisories/GHSA-3prj-6hqw-cm82)

## Related threats

- [web-token PHP JWT Library padding oracle in RSA1_5 decryption](https://junglewise.ai/threats/web-token-php-jwt-library-padding-oracle-in-rsa1-5-decryption-d6582319)
- [web-token PHP JWT Framework algorithm confusion in JWSVerifier](https://junglewise.ai/threats/web-token-php-jwt-framework-algorithm-confusion-in-jwsverifier-6c60a50e)
- [PHP JWT Framework missing integrity check in Chacha20Poly1305](https://junglewise.ai/threats/php-jwt-framework-missing-integrity-check-in-chacha20poly1305-7ee741c5)