Denial of Service Vulnerability in JOSE for Erlang and Elixir by Potatosalad

CVE-2023-50966

What is CVE-2023-50966?

The JOSE library for Erlang and Elixir, maintained by Potatosalad, is susceptible to a denial of service attack. By manipulating a JOSE header with an excessively large p2c (PBES2 Count) value, attackers can induce significant CPU consumption. This could lead to performance degradation or complete service disruption. It is crucial for users of the JOSE library to assess their exposure to this vulnerability and implement mitigating strategies to prevent potential exploitation.

References