USN-9075-1: libjwt vulnerability

Q: What must an attacker be able to do to exploit this issue?

An attacker must be able to remotely submit or cause verification of HMAC-signed JWTs and observe timing differences during signature validation. The issue could allow signature forgery through that timing side channel, potentially bypassing authentication.

Q: Which Ubuntu packages are identified as affected?

The advisory identifies ubuntu/libjwt0, ubuntu/libjwt, and ubuntu/libjwt-gnutls0 for Ubuntu.

Published Nov 12, 2026

Updated

It was discovered that libjwt did not use a constant-time comparison when verifying HMAC signatures. A remote attacker could possibly use this issue to forge signatures through a timing side-channel attack and bypass authentication.

Affected Software

13 affected componentsFixes available

All of the following

ubuntu/libjwt-gnutls0<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=22.04

All of the following

ubuntu/libjwt0<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=22.04

All of the following

ubuntu/libjwt-gnutls0<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=20.04

All of the following

ubuntu/libjwt0<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=20.04

All of the following

ubuntu/libjwt0<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=18.04

ubuntu/libjwt<1.9.0-1ubuntu0.1~esm1

1.9.0-1ubuntu0.1~esm1

ubuntu/libjwt<1.10.2-1ubuntu0.20.04.1~esm1

1.10.2-1ubuntu0.20.04.1~esm1

ubuntu/libjwt<1.10.2-1ubuntu0.22.04.1~esm1

1.10.2-1ubuntu0.22.04.1~esm1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/libjwt-gnutls0 to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/libjwt0 to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/libjwt to a version that resolves this vulnerability.
Fixed in 1.9.0-1ubuntu0.1~esm1
Upgrade
Upgrade ubuntu/libjwt to a version that resolves this vulnerability.
Fixed in 1.10.2-1ubuntu0.20.04.1~esm1
Upgrade
Upgrade ubuntu/libjwt to a version that resolves this vulnerability.
Fixed in 1.10.2-1ubuntu0.22.04.1~esm1

Event History

Nov 12, 2026

Advisory Published

via Ubuntu·12:00 AM

Data Sourced

via Ubuntu·12:00 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

An attacker must be able to remotely submit or cause verification of HMAC-signed JWTs and observe timing differences during signature validation. The issue could allow signature forgery through that timing side channel, potentially bypassing authentication.

Which Ubuntu packages are identified as affected?

The advisory identifies ubuntu/libjwt0, ubuntu/libjwt, and ubuntu/libjwt-gnutls0 for Ubuntu.

USN-9075-1: libjwt vulnerability

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

Which Ubuntu packages are identified as affected?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

Which Ubuntu packages are identified as affected?