CVE-2026-33204
Published: 20 March 2026
Summary
CVE-2026-33204 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Kelvinmo Simplejwt. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).
Deeper analysis
CVE-2026-33204 is a denial-of-service vulnerability in the SimpleJWT PHP library for JSON web tokens, affecting versions prior to 1.1.1. It enables JWE header tampering when PBES2 algorithms are used, leading to uncontrolled resource consumption (CWE-400). Applications that invoke the JWE::decrypt() method on attacker-controlled JWEs configured with PBES2 algorithms are vulnerable. The issue carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and was published on 2026-03-20.
An unauthenticated attacker with network access can exploit this vulnerability by submitting a specially crafted JWE with tampered headers to a vulnerable application. Exploitation requires no privileges or user interaction and results in high-impact availability disruption through resource exhaustion, such as excessive CPU usage during decryption attempts, while confidentiality and integrity remain unaffected.
The vulnerability has been addressed in SimpleJWT version 1.1.1. Affected applications should upgrade to this version or later to mitigate the issue. Additional details are available in the GitHub security advisory (https://github.com/kelvinmo/simplejwt/security/advisories/GHSA-xw36-67f8-339x) and release notes (https://github.com/kelvinmo/simplejwt/releases/tag/v1.1.1).
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-13871
Vulnerability details
SimpleJWT is a simple JSON web token library written in PHP. Prior to version 1.1.1, an unauthenticated attacker can perform a Denial of Service via JWE header tampering when PBES2 algorithms are used. Applications that call JWE::decrypt() on attacker-controlled JWEs…
more
using PBES2 algorithms are affected. This issue has been patched in version 1.1.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in public-facing app/library allows unauthenticated network attacker to submit crafted JWE input, directly enabling T1190 (Exploit Public-Facing Application) for DoS and T1499.004 (Application or System Exploitation) via resource exhaustion in decryption.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Flaw remediation requires upgrading the vulnerable SimpleJWT library to version 1.1.1, directly eliminating the JWE header tampering DoS vulnerability.
Denial-of-service protection implements measures like rate limiting and traffic filtering to block or limit resource exhaustion from attacker-controlled JWEs.
Resource availability controls allocate and protect CPU resources from unauthorized exhaustion during PBES2 decryption of tampered JWE headers.