Libjwt

libjwt

2 CVEs • 1 product

Products (1)

Click to collapse

Toggle

Libjwt

libjwt

2 CVEs

CVEs (2)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2026-33996 1Libjwt 1Libjwt Jun 17, 2026 Mar 27, 2026 5.8 MEDIUM· v4 5.5 MEDIUM· v3 N/A· v2 LibJWT is a C JSON Web Token Library. Starting in version 3.0.0 and prior to version 3.3.0, the JWK parsing for RSA-PSS did not protect against a NULL value when expecting to parse JSON string values. A specially crafted...Show more LibJWT is a C JSON Web Token Library. Starting in version 3.0.0 and prior to version 3.3.0, the JWK parsing for RSA-PSS did not protect against a NULL value when expecting to parse JSON string values. A specially crafted JWK file could exploit this behavior by using integers in places where the code expected a string. This was fixed in v3.3.0. A workaround is available. Users importing keys through a JWK file should not do so from untrusted sources. Use the `jwk2key` tool to check for validity of a JWK file. Likewise, if possible, do not use JWK files with RSA-PSS keys.Show less
CVE-2024-25189 2Debian Libjwt 2Debian Linux Libjwt Jun 17, 2026 Feb 8, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 libjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel.

CVE

VENDORS

PRODUCTS

UPDATED

PUBLISHED

CVSS

CVE-2026-33996

1Libjwt

Jun 17, 2026

Mar 27, 2026

5.8 MEDIUM· v4

5.5 MEDIUM· v3

N/A· v2

LibJWT is a C JSON Web Token Library. Starting in version 3.0.0 and prior to version 3.3.0, the JWK parsing for RSA-PSS did not protect against a NULL value when expecting to parse JSON string values. A specially crafted JWK file could exploit this behavior by using integers in places where the code expected a string. This was fixed in v3.3.0. A workaround is available. Users importing keys through a JWK file should not do so from untrusted sources. Use the `jwk2key` tool to check for validity of a JWK file. Likewise, if possible, do not use JWK files with RSA-PSS keys.Show less

CVE-2024-25189

2Debian

Libjwt

2Debian Linux

Libjwt

Jun 17, 2026

Feb 8, 2024

N/A· v4

9.8 CRITICAL· v3

N/A· v2

libjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel.