VDB
CVE-2023-52428
CVE-2023-52428
PUBLISHED
CVSS 9.300000190734863 CRITICAL
Denial of Service in Connect2id Nimbus JOSE+JWT
Reported by mitre · Published February 11, 2024
nimbus-jose-jwt is fixed in 9.37.2 (Maven Central)
In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| com.nimbusds:nimbus-jose-jwt | Maven Central | 9.37.2 |
| celeborn-0.6 | Wolfi | 0.6.3-r7 |
| sonarqube-10 | Wolfi | 25.1.0.102122-r0 |
| thingsboard | Wolfi | 3.7-r2 |
| tez | Wolfi | 0.10.4-r6 |
| celeborn-0.5 | Chainguard | 0.5.4-r26 |
| dependency-track | Chainguard | 4.10.1-r3 |
| sonarqube-10 | Chainguard | 25.1.0.102122-r0 |
| thingsboard | Chainguard | 3.7-r2 |
| druid | Chainguard | 37.0.0-r56, 37.0.0-r14 |
| dependency-track | Wolfi | 4.10.1-r3 |
| stargate | Chainguard | 1.0.79-r2 |
1 more packages have a fixed version. See every fix in Lookup.
Risk scores
CVSS 4.0
9.300000190734863
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| wolfi | celeborn-0.6 | 0 |
| wolfi | sonarqube-10 | 0 |
| wolfi | thingsboard | 0 |
| wolfi | tez | 0 |
| chainguard | celeborn-0.5 | 0 |
| chainguard | dependency-track | 0 |
| chainguard | sonarqube-10 | 0 |
| chainguard | thingsboard | 0 |
| chainguard | druid | 0, 0 |
| wolfi | dependency-track | 0 |
| Maven | com.nimbusds:nimbus-jose-jwt | 0 |
| chainguard | stargate | 0 |
| wolfi | celeborn-0.5 | 0 |
| n/a | n/a | * |
| chainguard | tez | 0 |
| chainguard | celeborn-0.6 | 0 |
| chainguard | elasticsearch-8 | 0 |
| wolfi | druid | 0, 0 |
| chainguard | hadoop-client-modules | 0 |
…and 2 more
Timeline
- Feb 11, 2024 CVE Published
- Feb 11, 2024 EPSS Score (30 in total, the first dated here)
- Oct 5, 2024 Coalition ESS Score (14 in total, the first dated here)
- Mar 17, 2026 Security Advisory (13 in total, the first dated here)
- Mar 17, 2026 CVE Updated
- Aug 10, 2026 Distribution Patch (9 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2023-52428
vulnetix vdb fixes CVE-2023-52428Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2023-52428/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart