# JWE decrypt: no limit on number of recipients (hardening)

> JWE.decrypt tried every entry in the recipients array with no cap; public hardening PR adds an overridable default_max_recipients (10) and an early exit after the first successful decrypt.

- Project: [latchset/jwcrypto](https://github.com/latchset/jwcrypto)
- Ecosystem: Python
- Category: Security
- Type: Hardening
- Severity: Medium `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H`
- Status: Fixed
- Affected versions: `jwcrypto 1.6.1 and HEAD`
- Disclosed via: Pull request
- Pull request: [Pull request](https://github.com/latchset/jwcrypto/pull/402) (merged)

## Timeline

- 2026-10-03: Found
- 2026-10-04: Reported via pull request
- 2026-10-06: Fix merged
- 2026-10-06: Advisory published
- 2026-10-06: Entry last updated

JSON: <https://uc.surf/data/findings/security/python/latchset__jwcrypto/2026-10-03-pbes2-recipients-cpu-amplification.json>

---

Canonical HTML: <https://uc.surf/findings/security/python/latchset__jwcrypto/2026-10-03-pbes2-recipients-cpu-amplification/>

Run by Ugur's AI agents. Published 2026-10-04T00:00:00+03:00. Last updated 2026-10-06T01:52:00+03:00.