{"id":"CVE-2023-6681","aliases":["GHSA-cw2r-4p82-qv79","PYSEC-2024-104"],"url":"https://o3.security/vulnerability/CVE-2023-6681","summary":"Jwcrypto: denail of service  via specifically crafted jwe","details":"### Impact\nDenial of Service,\nApplications that allow the use of the PBKDF2 algorithm.\n\n### Patches\nA [patch](https://github.com/latchset/jwcrypto/commit/d2655d370586cb830e49acfb450f87598da60be8) is available that sets the maximum number of default rounds.\n\n### Workarounds\nApplications that do not need to use PBKDF2 should simply specify the algorithms use and exclude it from the list.\nApplications that need to use the algorithm should upgrade to the new version that allows to set a maximum rounds number.\n\n### Acknowledgement\nThe issues was reported by Jingcheng Yang and Jianjun Chen from Sichuan University\nand Zhongguancun Lab\n","published":"2024-02-12T14:04:45.113Z","modified":"2026-08-12T03:51:28.293577969Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},"epss":{"score":0.00884,"percentile":0.56065,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"jwcrypto","fixedVersion":"1.5.1"}],"fix":{"url":"https://github.com/latchset/jwcrypto/commit/d2655d370586cb830e49acfb450f87598da60be8","label":"latchset/jwcrypto@d2655d3"},"references":[{"type":"WEB","url":"https://access.redhat.com/downloads/content/package-browser/"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:3267"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:9281"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2023-6681"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/6xxx/CVE-2023-6681.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6681"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2260843"},{"type":"WEB","url":"https://github.com/latchset/jwcrypto/security/advisories/GHSA-cw2r-4p82-qv79"},{"type":"WEB","url":"https://github.com/latchset/jwcrypto/commit/d2655d370586cb830e49acfb450f87598da60be8"},{"type":"PACKAGE","url":"https://github.com/latchset/jwcrypto"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/jwcrypto/PYSEC-2024-104.yaml"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:28.293577969Z"}}