ZeroDay Findings
Sign inSign up

Findings

CVE-2026-33996

LibJWT is a C JSON Web Token Library.

Published Mar 27, 2026 · updated Jun 17, 2026 · libjwt libjwt

LibJWT is a C JSON Web Token Library. Starting in version 3.0.0 and prior to version 3.3.0, the JWK parsing for RSA-PSS did not protect against a NULL value when expecting to parse JSON string values. A specially crafted JWK file could exploit this behavior by using integers in places where the code expected a string. This was fixed in v3.3.0. A workaround is available. Users importing keys through a JWK file should not do so from untrusted sources. Use the tool to check for validity of a JWK file. Likewise, if possible, do not use JWK files with RSA-PSS keys.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 27, 2026 · NIST NVD

    Detected

    LibJWT is a C JSON Web Token Library. Starting in version 3.0.0 and prior to version 3.3.0, the JWK parsing for RSA-PSS did not protect against a NULL value when expecting to parse JSON string values. A specially crafted JWK file could exploit this behavior by using integers in places where the code expected a string. This was fixed in v3.3.0. A workaround is available. Users importing keys throug

  2. Jun 17, 2026 · NIST NVD

    Updated

    LibJWT is a C JSON Web Token Library. Starting in version 3.0.0 and prior to version 3.3.0, the JWK parsing for RSA-PSS did not protect against a NULL value when expecting to parse JSON string values. A specially crafted JWK file could exploit this behavior by using integers in places where the code expected a string. This was fixed in v3.3.0. A workaround is available. Users importing keys throug

Affected

  • cpe libjwt/libjwtversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-33996

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-33996

    LibJWT is a C JSON Web Token Library. Starting in version 3.0.0 and prior to version 3.3.0, the JWK parsing for RSA-PSS did not protect against a NULL value when expecting to parse JSON string values. A specially crafted JWK file could exploit this behavior by using integers in p

    nvd.nist.gov

References