CVE-2026-33996: LibJWT has NULL/bounds validation in JWK octet and RSA PSS parsing
LibJWT is a C JSON Web Token Library. Starting in version 3.0.0 and prior to version 3.3.0, the JWK parsing for RSA-PSS did not protect against a NULL value when expecting to parse JSON string values. A specially crafted JWK file could exploit this behavior by using integers in places where the code expected a string. This was fixed in v3.3.0. A workaround is available. Users importing keys through a JWK file should not do so from untrusted sources. Use the jwk2key tool to check for validity of a JWK file. Likewise, if possible, do not use JWK files with RSA-PSS keys.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33996?
CVE-2026-33996 is classified as a high-severity vulnerability due to its potential to allow exploitation via NULL and bounds validation issues.
How do I fix CVE-2026-33996?
To fix CVE-2026-33996, upgrade LibJWT to version 3.3.0 or later to ensure proper handling of NULL values in JSON Web Key parsing.
What versions of LibJWT are affected by CVE-2026-33996?
LibJWT versions between 3.0.0 and 3.3.0 are affected by CVE-2026-33996.
What specific functionality is impacted by CVE-2026-33996 in LibJWT?
CVE-2026-33996 impacts the JWK (JSON Web Key) parsing functionality for RSA-PSS, leading to vulnerabilities when handling malformed input.
Is there a workaround for CVE-2026-33996 if immediate upgrade is not possible?
There is no documented workaround for CVE-2026-33996, and upgrading to the patched version is strongly recommended.