JWK Parsing Flaw in LibJWT Affects Multiple Versions
CVE-2026-33996

5.8MEDIUM

Key Information:

Vendor

Benmcollins

Status
Libjwt
Vendor
CVE Published:
27 March 2026

What is CVE-2026-33996?

LibJWT, a C JSON Web Token library, contains a vulnerability in its JWK parsing functionality for RSA-PSS keys. The flaw arises in versions from 3.0.0 to 3.2.0, where it inadequately handles NULL values, allowing attackers to provide specially crafted JWK files with integers in the place of expected strings. This oversight can lead to the authentication systems relying on this library becoming compromised. Users are advised to upgrade to version 3.3.0 or later, and to avoid using JWK files from untrusted sources. It is recommended to leverage the jwk2key tool to validate JWK files for safety.

Affected Version(s)

libjwt >= 3.0.0, < 3.3.0

References

https://github.com/benmcollins/libjwt/security/advisories...
x_refsource_CONFIRM
https://github.com/benmcollins/libjwt/commit/cfd890286fa4...
x_refsource_MISC

CVSS V4

Score:
5.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.