{"record":{"id":"a10dde38a6a97654","repo":"jwtk/jjwt","slug":"jwe-header-param-value-iterations-exceeds","errorCode":null,"errorMessage":"JWE Header ${param} value ${iterations} exceeds ${getId()} maximum allowed value ${MAX_ITERATIONS}. The larger value is rejected to help mitigate potential Denial of Service attacks.","messagePattern":"JWE Header (.+?) value (.+?) exceeds (.+?) maximum allowed value (.+?)\\. The larger value is rejected to help mitigate potential Denial of Service attacks\\.","errorType":"exception","errorClass":"UnsupportedJwtException","httpStatus":null,"severity":"warning","filePath":"impl/src/main/java/io/jsonwebtoken/impl/security/Pbes2HsAkwAlgorithm.java","lineNumber":205,"sourceCode":"\n        return result;\n    }\n\n    @Override\n    public SecretKey getDecryptionKey(DecryptionKeyRequest<Password> request) throws SecurityException {\n\n        JweHeader header = Assert.notNull(request.getHeader(), \"Request JweHeader cannot be null.\");\n        final Password key = Assert.notNull(request.getKey(), \"Decryption Password cannot be null.\");\n        ParameterReadable reader = new RequiredParameterReader(header);\n        final byte[] inputSalt = reader.get(DefaultJweHeader.P2S);\n\n        Parameter<Integer> param = DefaultJweHeader.P2C;\n        final int iterations = reader.get(param);\n        if (iterations > MAX_ITERATIONS) {\n            String msg = \"JWE Header \" + param + \" value \" + iterations + \" exceeds \" + getId() + \" maximum \" +\n                    \"allowed value \" + MAX_ITERATIONS + \". The larger value is rejected to help mitigate \" +\n                    \"potential Denial of Service attacks.\";\n            throw new UnsupportedJwtException(msg);\n        }\n\n        final byte[] rfcSalt = Bytes.concat(SALT_PREFIX, inputSalt);\n        final char[] password = key.toCharArray(); // password will be safely cleaned/zeroed in deriveKey next:\n        final SecretKey derivedKek = deriveKey(request, password, rfcSalt, iterations);\n\n        DecryptionKeyRequest<SecretKey> unwrapReq =\n                new DefaultDecryptionKeyRequest<>(request.getPayload(), request.getProvider(),\n                        request.getSecureRandom(), header, request.getEncryptionAlgorithm(), derivedKek);\n\n        return wrapAlg.getDecryptionKey(unwrapReq);\n    }\n}\n","sourceCodeStart":187,"sourceCodeEnd":219,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/impl/src/main/java/io/jsonwebtoken/impl/security/Pbes2HsAkwAlgorithm.java#L187-L219","documentation":"To mitigate DoS attacks, decryption rejects JWE headers whose 'p2c' (PBES2 iteration count) exceeds MAX_ITERATIONS, throwing UnsupportedJwtException. An attacker could otherwise force expensive PBKDF2 computations with a huge iteration count.","triggerScenarios":"Parsing/decrypting a JWE token whose header contains p2c greater than Pbes2HsAkwAlgorithm.MAX_ITERATIONS, or programmatically setting such a value in a DefaultJweHeader used for decryption.","commonSituations":"Receiving tokens from third parties or attackers with crafted p2c headers; tokens generated by another library without an iteration cap.","solutions":["Have the token issuer lower p2c to an allowed value (<= MAX_ITERATIONS, still >= 1000).","Catch UnsupportedJwtException during decryption and reject the token as untrusted.","If the library's cap is too low for your policy, configure/upgrade to a version with the desired cap rather than bypassing validation."],"exampleFix":"// before\ntry { jwe = Jwts.parser().decryptWith(password).build().parseEncryptedClaims(token); }\ncatch (UnsupportedJwtException e) { audit(\"oversized p2c\", e); }\n// after (issuer side)\nheaderBuilder.p2c(100000); // within [1000, MAX_ITERATIONS]","handlingStrategy":"try-catch","validationCode":"Integer p2c = header.get(\"p2c\", Integer.class);\nif (p2c != null && p2c > Pbes2HsAkwAlgorithm.MAX_ITERATIONS) {\n    throw new UnsupportedJwtException(\"p2c exceeds allowed maximum\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    Jwe<Claims> jwe = Jwts.parser().decryptWith(password).build().parseEncryptedClaims(token);\n} catch (UnsupportedJwtException e) {\n    // reject token: p2c too large (possible DoS attempt)\n}","preventionTips":["Always treat incoming p2c values as untrusted input","Log and reject oversized p2c tokens","Keep JJWT updated for DoS mitigations"],"tags":["jwt","jwe","dos","pbes2"],"backgroundTag":"value-out-of-range","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}