simplejwt vulnerabilities

1 known vulnerability in simplejwt from Kelvinmo. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  simplejwt: Uncontrolled Resource Consumption

  CVE-2026-33204Mar 20, 2026Kelvinmo

  SimpleJWT is a simple JSON web token library written in PHP. Prior to version 1.1.1, an unauthenticated attacker can perform a Denial of Service via JWE header tampering when PBES2 algorithms are used. Applications that call JWE::decrypt() on attacker-controll