Vulnerability · Published Mar 20, 2026 · Assigned by GitHub_M

CVE-2026-33204SimpleJWT has an Unauthenticated Denial of Service via JWE header tampering

High 7.5

In plain English

A high-severity uncontrolled resource consumption in simplejwt from kelvinmo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 57.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

SimpleJWT is a simple JSON web token library written in PHP. Prior to version 1.1.1, an unauthenticated attacker can perform a Denial of Service via JWE header tampering when PBES2 algorithms are used. Applications that call JWE::decrypt() on attacker-controlled JWEs using PBES2 algorithms are affected. This issue has been patched in version 1.1.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	kelvinmo/simplejwt	1.1.1	GHSA-xw36-67f8-339x

Affected products (as reported)

Vendor	Product	Versions
kelvinmo	simplejwt	< 1.1.1

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/kelvinmo/simplejwt/security/advisories/GHSA-xw36-67f8-339x x_refsource_CONFIRM
https://github.com/kelvinmo/simplejwt/releases/tag/v1.1.1 x_refsource_MISC