Crypto.JOSE

aeson supports multiple map implementations. The implementation using Data.HashMap from *unordered-containers* is vulnerable to hash-flooding DoS attacks. If your program processes JOSE objects from untrusted sources, you can check this value to find out if the *aeson* build uses a secure map implementation, or not.