Vulnerability · Published Mar 27, 2026 · Assigned by GitHub_M
CVE-2026-33996LibJWT has NULL/bounds validation in JWK octet and RSA PSS parsing
Medium 5.8
In plain English
A medium-severity null pointer dereference in libjwt from benmcollins. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
LibJWT is a C JSON Web Token Library. Starting in version 3.0.0 and prior to version 3.3.0, the JWK parsing for RSA-PSS did not protect against a NULL value when expecting to parse JSON string values. A specially crafted JWK file could exploit this behavior by using integers in places where the code expected a string. This was fixed in v3.3.0. A workaround is available. Users importing keys through a JWK file should not do so from untrusted sources. Use the `jwk2key` tool to check for validity of a JWK file. Likewise, if possible, do not use JWK files with RSA-PSS keys.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:14 | libjwt3 | 3.3.2-1 | DEBIAN-CVE-2026-33996 |
| Ubuntu:22.04:LTS | libjwt | no fix listed | UBUNTU-CVE-2026-33996 |
| Ubuntu:24.04:LTS | libjwt | no fix listed | UBUNTU-CVE-2026-33996 |
| Ubuntu:25.10 | libjwt | no fix listed | UBUNTU-CVE-2026-33996 |
| Ubuntu:26.04:LTS | libjwt | no fix listed | UBUNTU-CVE-2026-33996 |
| Ubuntu:26.10 | libjwt | no fix listed | UBUNTU-CVE-2026-33996 |
| Ubuntu:26.04:LTS | libjwt3 | no fix listed | UBUNTU-CVE-2026-33996 |
| Ubuntu:26.10 | libjwt3 | no fix listed | UBUNTU-CVE-2026-33996 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| benmcollins | libjwt | >= 3.0.0, < 3.3.0 |
Weakness: CWE-476 · Vector: CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:A/VC:L/VI:L/VA:H/SC:L/SI:L/SA:L