The compact JWS and JWE serializers split the whole input on every "."
before checking the segment count, so a delimiter-heavy string was first
expanded into one array entry per delimiter. That costs about 25 times
the size of the input in memory: a 2 MB token allocates ~48 MB before it
is rejected as malformed.

The split is now bounded to one more segment than a valid token has,
which is enough to detect and reject longer input while keeping the
allocation proportional to the token itself. The accepted and rejected
inputs are unchanged.

Reported by Team Atlanta.

The compact JWS and JWE serializers split the whole input on every "."
before checking the segment count, so a delimiter-heavy string was first
expanded into one array entry per delimiter. That costs about 25 times
the size of the input in memory: a 2 MB token allocates ~48 MB before it
is rejected as malformed.

The split is now bounded to one more segment than a valid token has,
which is enough to detect and reject longer input while keeping the
allocation proportional to the token itself. The accepted and rejected
inputs are unchanged.

Reported by Team Atlanta.

Merge branch '4.0.x' into 4.1.x

Mise à jour de la contrainte de version de brick/math pour inclure le…

Fix PHP 8.5 deprecation (#648)

Fix PHP 8.5 deprecation (#648)

Fix PHP 8.5 deprecation (#648)

Add GitHub Action to auto-switch default branch on new tags

Refactor command help text definitions for Symfony Console compatibil…

• 3.4.x:
  Update signature tests for the protected-header "alg" requirement (#651)
  Merge commit from fork
  Merge commit from fork
  Merge commit from fork
  Merge commit from fork
  Add sodium support for Base64 URL safe encoding/decoding (#644)
  Allow psr/cache v2 (#620)
  Fix call function on null (#596)
  Add RangeException to Base64UrlSafe (#577)
  Add Base64UrlSafe utility and refactor code references (#576)

Conflicts:

composer.json

phpstan-baseline.neon

src/Bundle/DataCollector/JWECollector.php

src/Experimental/KeyEncryption/AESCTR.php

src/Experimental/KeyEncryption/Chacha20Poly1305.php

src/Experimental/Signature/Blake2b.php

src/Library/Console/GeneratorCommand.php

src/Library/Core/JWK.php

src/Library/Core/Util/Base64UrlSafe.php

src/Library/Encryption/Algorithm/ContentEncryption/AESCBCHS.php

src/Library/Encryption/Algorithm/ContentEncryption/AESGCM.php

src/Library/Encryption/Algorithm/KeyEncryption/AESGCMKW.php

src/Library/Encryption/Algorithm/KeyEncryption/AESKW.php

src/Library/Encryption/Algorithm/KeyEncryption/AbstractECDH.php

src/Library/Encryption/Algorithm/KeyEncryption/Dir.php

src/Library/Encryption/Algorithm/KeyEncryption/PBES2AESKW.php

src/Library/Encryption/Algorithm/KeyEncryption/RSA15.php

src/Library/Encryption/Algorithm/KeyEncryption/Util/ConcatKDF.php

src/Library/Encryption/Algorithm/KeyEncryption/Util/RSACrypt.php

src/Library/Encryption/Serializer/CompactSerializer.php

src/Library/Encryption/Serializer/JSONFlattenedSerializer.php

src/Library/Encryption/Serializer/JSONGeneralSerializer.php

src/Library/KeyManagement/Analyzer/ESKeyAnalyzer.php

src/Library/KeyManagement/Analyzer/HSKeyAnalyzer.php

src/Library/KeyManagement/Analyzer/OctAnalyzer.php

src/Library/KeyManagement/Analyzer/RsaAnalyzer.php

src/Library/KeyManagement/Analyzer/ZxcvbnKeyAnalyzer.php

src/Library/Signature/Algorithm/EdDSA.php

src/Library/Signature/Algorithm/HMAC.php

src/Library/Signature/Serializer/CompactSerializer.php

src/Library/Signature/Serializer/JSONFlattenedSerializer.php

src/Library/Signature/Serializer/JSONGeneralSerializer.php

src/Library/composer.json

tests/Bundle/JoseFramework/Functional/Encryption/JWECollectorTest.php

tests/Bundle/JoseFramework/Functional/KeyManagement/JWKLoaderTest.php

tests/Component/Encryption/RFC7520/A128KWAndA128GCMEncryptionWithCompressionTest.php

tests/Component/KeyManagement/JWKFactoryTest.php

JWSVerifier::getAlgorithm() merged the protected and unprotected headers
with [...$protected, ...$unprotected]; with duplicate keys PHP keeps the
LAST value, so the attacker-controlled unprotected header could override
the integrity-protected "alg". Combined with HeaderCheckerManager (which
validates "alg" from the protected header), this is a TOCTOU
algorithm-confusion / downgrade vector (e.g. forcing HS256 against an RSA
public key, or HS512 -> HS256), and "alg" placed only in the unprotected
header bypassed the duplicate-parameter check entirely.

Per RFC 7515 §4.1.1 "alg" MUST be integrity protected. getAlgorithm() now
reads "alg" exclusively from the protected header and rejects a JWS whose
"alg" is absent from (or present only outside) the protected header.

Co-authored-by: Claude Opus 4.8 (1M context) noreply@anthropic.com

Add sodium support for Base64 URL safe encoding/decoding (#644)