CVE-2026-33996 LibJWT has NULL/bounds validation in JWK octet and RSA PSS parsing
A crafted JWK file with integer values instead of strings causes a null pointer dereference in LibJWT, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-33996?
CVE-2026-33996 is a medium-severity vulnerability in benmcollins libjwt, published on 27 Mar 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
LibJWT is a C JSON Web Token Library. Starting in version 3.0.0 and prior to version 3.3.0, the JWK parsing for RSA-PSS did not protect against a NULL value when expecting to parse JSON string values. A specially crafted JWK file could exploit this behavior by using integers in places where the code expected a string. This was fixed in v3.3.0. A workaround is available. Users importing keys through a JWK file should not do so from untrusted sources. Use the `jwk2key` tool to check for validity of a JWK file. Likewise, if possible, do not use JWK files with RSA-PSS keys.
Weakness: CWE-476
Which versions are affected by CVE-2026-33996?
It affects 1 product.
Products include Libjwt Libjwt.
How do I fix CVE-2026-33996?
Upgrade to a fixed version.
Is CVE-2026-33996 being exploited?
There is no known exploitation of CVE-2026-33996 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-33996, GHSA-ph96-hqpc-9f66, UBUNTU-CVE-2026-33996.