CVE-2026-33996 Details
Description
LibJWT is a C JSON Web Token Library. Starting in version 3.0.0 and prior to version 3.3.0, the JWK parsing for RSA-PSS did not protect against a NULL value when expecting to parse JSON string values. A specially crafted JWK file could exploit this behavior by using integers in places where the code expected a string. This was fixed in v3.3.0. A workaround is available. Users importing keys through a JWK file should not do so from untrusted sources. Use the `jwk2key` tool to check for validity of a JWK file. Likewise, if possible, do not use JWK files with RSA-PSS keys.
A vulnerability in LibJWT's JWK parsing for RSA-PSS and Octet (HS) algorithms, present in versions 3.0.0 prior to 3.3.0, allowed for type confusion by exploiting the parser's expectation of JSON string values. A crafted JWK file could substitute integers for strings, leading to potential misinterpretation of the data. This issue has been addressed in version 3.3.0. The 2.x series of LibJWT is not affected as it lacks JWK parsing functionality.
Users should update to LibJWT version 3.3.0 or later. For those who cannot update, it is recommended to avoid using JWK files from untrusted sources and to refrain from using JWK files with RSA-PSS or HS keys.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c | [email protected] | Patch |
| https://github.com/benmcollins/libjwt/security/advisories/GHSA-ph96-hqpc-9f66 | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libjwt libjwt | >= 3.0.0, < 3.3.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 31, 2026 | Initial Analysis | [email protected] |
| Mar 27, 2026 | New CVE Received | [email protected] |