CVE-2026-33996 — NULL Pointer Dereference in Libjwt

CWE-476 — NULL Pointer Dereference5 documents5 sources
Severity
5.8MEDIUMNVD
EPSS
0.0%
top 95.83%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
LibjwtDebian LibjwtDebian Libjwt3+1 more
Timeline
PublishedMar 27

Description

LibJWT is a C JSON Web Token Library. Starting in version 3.0.0 and prior to version 3.3.0, the JWK parsing for RSA-PSS did not protect against a NULL value when expecting to parse JSON string values. A specially crafted JWK file could exploit this behavior by using integers in places where the code expected a string. This was fixed in v3.3.0. A workaround is available. Users importing keys through a JWK file should not do so from untrusted sources. Use the `jwk2key` tool to check for validity o…

CVSS vector

CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:A/VC:L/VI:L/VA:H/SC:L/SI:L/SA:L

Affected Packages4 packages

▶NVDlibjwt/libjwt3.0.0 — 3.3.0
▶debiandebian/libjwt< libjwt3 3.3.2-1 (forky)
▶debiandebian/libjwt3< libjwt3 3.3.2-1 (forky)
▶CVEListV5benmcollins/libjwt>= 3.0.0, < 3.3.0

Patches

Patch: github.com ↗

🔴Vulnerability Details

1
OSV
CVE-2026-33996: LibJWT is a C JSON Web Token Library↗2026-03-27
▶

📋Vendor Advisories

2
Red Hat
LibJWT: LibJWT: Denial of Service via crafted JSON Web Key (JWK) files↗2026-03-27
▶
Debian
CVE-2026-33996: libjwt - LibJWT is a C JSON Web Token Library. Starting in version 3.0.0 and prior to ver...↗2026
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-33996 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2026-33996 — NULL Pointer Dereference in Libjwt | cvebase