CVE-2026-33204: SimpleJWT has an Unauthenticated Denial of Service via JWE header tampering

March 18, 2026 (updated March 25, 2026)

An unauthenticated attacker can perform a Denial of Service via JWE header tampering when PBES2 algorithms are used. Applications that call JWE::decrypt() on attacker-controlled JWEs using PBES2 algorithms are affected.

References

github.com/advisories/GHSA-xw36-67f8-339x
github.com/kelvinmo/simplejwt
github.com/kelvinmo/simplejwt/releases/tag/v1.1.1
github.com/kelvinmo/simplejwt/security/advisories/GHSA-xw36-67f8-339x
nvd.nist.gov/vuln/detail/CVE-2026-33204

Code Behaviors & Features

Detect and mitigate CVE-2026-33204 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →