SD-JWT: DisclosureProcessor has no depth bound, and chained Disclosures make memory grow quadratically

Open
  • Is something wrong?
#773 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
68/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
php
Domain
backend, security

Research direction

Start by reading DisclosureProcessor::processValue() and the existing SD-JWT tests. Trace how disclosed values and claim paths are processed recursively, then add a depth bound that rejects excessive nesting with InvalidTokenException. Run the SD-JWT tests and confirm a deeply chained payload is rejected while existing valid cases still pass.

Written by the indexing model from the issue text.

Description

bug
Version(s) affected

4.3.x and 5.0.x branches (SD-JWT is not in any release yet).

Description

DisclosureProcessor follows the digests found in disclosed values recursively, as SD-JWT allows, but nothing bounds how deep Disclosures may reference one another. Every level copies the claim path twice: once into the recorded paths, once as the argument of the pending recursive call. Memory therefore grows with the square of the length of a chain of Disclosures. The JSON depth limit does not help, because each Disclosure is a separate JSON document.

On 4.3.x, 1,000 chained Disclosures (117 kB) peak at 30 MB, and 4,000 (465 kB) at 370 MB, against 7.3 MB for 4,000 Disclosures side by side. Under memory_limit=128M, about 2,400 chained Disclosures end the request with a fatal error instead of the InvalidTokenException the class documents. The same code runs in verifyWithKeyBinding() before the Key Binding JWT is checked, and in SDJWT::select(), which verifies no signature.

The chain has to start from a digest covered by the Issuer signature. #772 is one way for a holder to obtain one.

Possible Solution

Bound the depth of the processed payload, disclosed values included, in DisclosureProcessor::processValue(), and reject deeper payloads with InvalidTokenException. A bound of 64 levels rejects the 4,000-Disclosure chain at 5 MB, and the existing SD-JWT tests still pass.

Additional Context

Found by the Anthropic OSS Scanner (ANT-2026-1MJ6B2EH).

Dominant language
PHP
Stars
954
Forks
119
Avg merge
48m
Merged PRs (30d)
17

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from web-token/jwt-framework

All issues in web-token/jwt-framework

Similar issues

More PHP issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.