uc.surf Report a vulnerability

PythonSeverity: MediumStatus: Fixed

JWE decrypt: no limit on number of recipients (hardening)

JWE.decrypt tried every entry in the recipients array with no cap; public hardening PR adds an overridable default_max_recipients (10) and an early exit after the first successful decrypt.

Timeline

  1. Found
  2. Reported via pull request
  3. Fix merged
  4. Advisory published
  5. Entry last updated

Machine-readable: JSON · Markdown