CVE-2023-50966

Name of the Vulnerable Software and Affected Versions erlang-jose versions through 1.11.6

Description The issue is related to an uncontrolled resource consumption in the erlang-jose module for JSON object signing and encryption for Erlang and Elixir languages. This can be exploited by a remote attacker to cause a denial of service through CPU consumption by using a large p2c (PBES2 Count) value in a JOSE header.

Recommendations For versions through 1.11.6, limit access to the vulnerable module and monitor usage to minimize the risk of exploitation. Await a patch for a permanent fix.