CVE-2026-33996
Null Pointer Dereference in LibJWT JWK Parsing (RSA-PSS
Publication date: 2026-03-27
Last updated on: 2026-03-31
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| libjwt | libjwt | From 3.0.0 (inc) to 3.3.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in LibJWT, a C JSON Web Token Library, specifically in versions starting from 3.0.0 up to but not including 3.3.0. The issue is in the JWK parsing for RSA-PSS keys, where the code did not properly handle NULL values when it expected JSON string values. An attacker could exploit this by crafting a JWK file that uses integers where strings are expected, potentially causing unexpected behavior.
This flaw was fixed in version 3.3.0. A workaround involves avoiding importing keys from untrusted JWK files and using the `jwk2key` tool to validate JWK files. It is also recommended to avoid using JWK files with RSA-PSS keys if possible.
How can this vulnerability impact me? :
Exploiting this vulnerability could lead to improper parsing of JWK files, which might allow an attacker to bypass expected validation or cause the application to behave incorrectly when handling RSA-PSS keys. This could potentially compromise the security of token verification or key handling processes.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking the validity of JWK files used for importing keys, especially those involving RSA-PSS keys. The recommended method is to use the `jwk2key` tool to verify the validity of a JWK file.
Users should look for JWK files that contain integers where strings are expected, as this is the core issue exploited by the vulnerability.
No specific network or system commands are provided in the available information.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading LibJWT to version 3.3.0 or later, where the vulnerability has been fixed.
As a workaround, avoid importing keys through JWK files from untrusted sources.
If possible, avoid using JWK files with RSA-PSS keys until the library is updated.
Use the `jwk2key` tool to check the validity of JWK files before importing them.