High
Security advisory
In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2023-52428
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 08:19 UTC · Revision 1
Source evidence
In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.
osv:CVE-2023-52428
Complete source record
{
"id": "533b65645dcc8c267c7cbe613addbd4955883e5a9430a777ded29d71a507a8b1",
"url": "https://osv.dev/vulnerability/CVE-2023-52428",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2023-52428",
"summary": "In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.",
"evidence": "osv:CVE-2023-52428",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2023-52428",
"aliases": [
"CVE-2023-52428",
"GHSA-gvpg-vgmx-xg6w"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://bitbucket.org/connect2id/nimbus-jose-jwt",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "e283ea02909e00645a622f16977659f8a7ba5b00"
},
{
"fixed": "3b3b77e"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "9.37.2"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "3b3b77e"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"9.37.1",
"9.37",
"9.36",
"9.35",
"9.34",
"9.33",
"9.32",
"9.31",
"9.30.2",
"9.30.1",
"9.30",
"9.29",
"9.28",
"9.27",
"9.26",
"9.25.6",
"9.25.5",
"9.25.4",
"9.25.3",
"9.25.2",
"9.25.1",
"9.25",
"9.24.4",
"9.24.3",
"9.24.2",
"9.24.1",
"9.24",
"9.23",
"9.22",
"9.21.1",
"9.21",
"9.20",
"9.19",
"9.18",
"9.16.1",
"9.16",
"9.16-preview.1",
"9.15.2",
"9.15.1",
"9.15",
"9.14",
"9.13",
"9.12.1",
"9.12",
"9.11.3",
"9.11.2",
"9.11.1",
"9.11",
"9.10.1",
"9.10",
"9.9.3",
"9.9.2",
"9.9.1",
"9.9",
"9.8.1",
"9.8",
"9.7",
"9.6.1",
"9.6",
"9.5",
"9.4.2",
"9.4.1",
"9.4",
"9.3",
"9.2",
"9.1.5",
"9.1.4",
"9.1.3",
"9.1.2",
"9.1.1",
"9.1",
"9.0.1",
"9.0",
"8.20",
"8.19",
"8.18.1",
"8.18",
"8.17.1",
"8.17",
"8.16",
"8.15",
"8.14.1",
"8.14",
"8.13",
"8.12",
"8.11",
"8.10",
"8.9",
"8.8",
"8.7",
"8.6",
"8.5.1",
"8.5",
"8.4.1",
"8.4",
"8.3",
"8.2.1",
"8.2",
"8.1",
"8.0",
"7.9",
"7.8",
"7.7",
"7.6",
"7.5.1",
"7.5",
"7.4",
"7.3.1",
"7.3",
"7.2.1",
"7.1",
"7.0.1",
"7.0",
"6.8",
"6.7",
"6.6",
"6.5.1",
"6.5",
"6.4.2",
"6.4.1",
"6.4",
"6.3.1",
"6.3",
"6.2",
"6.1.1",
"6.1",
"6.0.2",
"6.0.1",
"6.0",
"5.14",
"5.13",
"5.12",
"5.11",
"5.10",
"5.9",
"5.8",
"5.7",
"5.6",
"5.5",
"5.4",
"5.3",
"5.2",
"5.1",
"5.0",
"4.41.2",
"4.41.1",
"4.41",
"4.40",
"4.39.2",
"4.39.1",
"4.39",
"4.38",
"4.37.1",
"4.37",
"4.36",
"4.35",
"4.34.2",
"4.34.1",
"4.34",
"4.33",
"4.32",
"4.31.1",
"4.30",
"4.29",
"4.28",
"4.27.1",
"4.27",
"4.26.1",
"4.26",
"4.25",
"4.24",
"4.23",
"4.22",
"4.21",
"4.20",
"4.19",
"4.18",
"4.17",
"4.16.2",
"4.16.1",
"4.16",
"4.15.1",
"4.15",
"4.14",
"4.13.1",
"4.12",
"4.11.2",
"4.11.1",
"4.11",
"4.10",
"4.9",
"4.8",
"4.7",
"4.6",
"4.5",
"4.4",
"4.3.1",
"4.3",
"4.2",
"4.1.1",
"4.1",
"4.0.1",
"4.0",
"4.0-rc4",
"4.0-rc3",
"4.0-rc2",
"4.0-rc1",
"3.10",
"3.9.2",
"3.9.1",
"3.9",
"3.8.2",
"3.8.1",
"3.8",
"3.7",
"3.6",
"3.5",
"3.4",
"3.3",
"3.2.2",
"3.2.1",
"3.2",
"3.1.2",
"3.1.1",
"3.1",
"3.0",
"2.26.1",
"2.26",
"2.25",
"2.24",
"2.23",
"2.22.1",
"2.22",
"2.21",
"2.20",
"2.19.1",
"2.19",
"2.18.2",
"2.18.1",
"2.18",
"2.17.2",
"2.17.1",
"2.17",
"2.16",
"2.15.2",
"2.15.1",
"2.15.0",
"2.14.0",
"2.13.1",
"2.13.0",
"2.12.0",
"2.11.0",
"2.10.1",
"2.10",
"2.9",
"2.8",
"2.7",
"2.6",
"2.5",
"2.4",
"2.3",
"2.2",
"2.1.1",
"2.1",
"2.0.1",
"2.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-52428.json"
}
}
],
"modified": "2026-10-28T02:30:27.276209972Z",
"provider": "osv",
"references": [
"https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/526/",
"https://connect2id.com/products/nimbus-jose-jwt",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52428.json",
"https://nvd.nist.gov/vuln/detail/CVE-2023-52428",
"https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e"
],
"provider_metadata": {
"cna_assigner": "mitre",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52428.json"
}
},
"related_cves": [
{
"value": "CVE-2023-52428",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 493730,
"published_at": "2024-02-11T00:00:00+00:00"
}