{"id":"CVE-2026-33996","summary":"LibJWT has NULL/bounds validation in JWK octet and RSA PSS parsing","details":"LibJWT is a C JSON Web Token Library. Starting in version 3.0.0 and prior to version 3.3.0, the JWK parsing for RSA-PSS did not protect against a NULL value when expecting to parse JSON string values. A specially crafted JWK file could exploit this behavior by using integers in places where the code expected a string. This was fixed in v3.3.0. A workaround is available. Users importing keys through a JWK file should not do so from untrusted sources. Use the `jwk2key` tool to check for validity of a JWK file. Likewise, if possible, do not use JWK files with RSA-PSS keys.","aliases":["GHSA-ph96-hqpc-9f66"],"modified":"2026-08-12T15:33:32.662684Z","published":"2026-03-27T22:21:21.465Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-476"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33996.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33996.json"},{"type":"ADVISORY","url":"https://github.com/benmcollins/libjwt/security/advisories/GHSA-ph96-hqpc-9f66"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33996"},{"type":"FIX","url":"https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/benmcollins/libjwt","events":[{"introduced":"97bb1e5cdd0c47e3d60eb7c44c7214ff4ad7b4c4"},{"fixed":"aca2229ecf56f6f64a1a2d505f48aaca15907628"},{"fixed":"cfd890286fa49ae61b534c937c9f0428b5c6034c"}],"database_specific":{"cpe":"cpe:2.3:a:libjwt:libjwt:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"3.0.0"},{"fixed":"3.3.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v3.2.3","v3.2.2","v3.2.1","v3.2.0","v3.1.0","v3.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33996.json","vanir_signatures_modified":"2026-08-12T15:33:32Z","vanir_signatures":[{"id":"CVE-2026-33996-003faaf6","signature_type":"Function","signature_version":"v1","source":"https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c","target":{"file":"libjwt/jwks.c","function":"jwks_item_get"},"deprecated":false,"digest":{"function_hash":"5391596667705380513248801862472656674","length":214}},{"target":{"file":"libjwt/jwks.c"},"deprecated":false,"digest":{"line_hashes":["42702164764448493326096071204173415543","129132828142138473758844614288794015760","252599046355731948269015259589024726117","121532944504936564385788376844750013147","23308057570715050932708724073108034012","233135759793949198716715776696422594666","22788586691853301213719656366003534688","211951182821997560589736898471960545226","293006935076376959230356199134611288046","155348313649437155776143776646135030062","327200506776464646678218183747648961586","322117469322124009600696392743534663430","247798644351125404816609938121698662517","239800854428085153307985474247765089186","331832810668433059176425847648740439128","327025928787359115359151393244762472330","99750133802327970266892344672317493926","32084748256310327708658168492292531199","217562765697535533478340954279467353099","190398803903493988376482363240131099117","290522599340554080517671203209520727205","311899011134163428879796160649359806774","207495588434074307057945903446356899778","89356888518387548925215008546838812303","273412628146012828597361057463699950268","155349990576997206369002410458079362409","328769538195402953943267455724157673849","122987476617488602717244781921148375435","202237921810025309111461500747845960690","91540420712904778012178926582363040022","279218787302309477237239329349039492530","304149008436951427125518773032857217506","168991508070229615494748468674747675166","284957376814172337612457618301272531107","294601264610128883124864611766944752078"],"threshold":0.9},"id":"CVE-2026-33996-0480bbcf","signature_type":"Line","signature_version":"v1","source":"https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c"},{"id":"CVE-2026-33996-07a2b7da","signature_type":"Line","signature_version":"v1","source":"https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c","target":{"file":"libjwt/jwt-crypto-ops.c"},"deprecated":false,"digest":{"line_hashes":["151557008000357795123006737716416714421","215856378755494676703970351063897884016","78253320427248270396081608403476265600","133558862692256288603803118803467003598","252510108830046776911110705713947156947"],"threshold":0.9}},{"source":"https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c","target":{"file":"libjwt/jwks.c","function":"jwks_error"},"deprecated":false,"digest":{"function_hash":"111475424054000014929993873162704636997","length":74},"id":"CVE-2026-33996-0aa771bf","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["290470594171577539091756943560635980121","139830738504132632914310263193520357453","158668324035785781373771821693910805259","86661630643466871906259963211225739374","151643672476457694618101172538725685177","13257394165916420291368991159294657418","80966008736274286216265408808912855604","122971835283354894543322417178818047156","117473220083768649029359878752865892375","78911202202396758821113569300949228982","210757961009458850430288996305417882284","90090551131569524780328514529010281052","250178072504312421451365239033392372193","148006528730208591497999665050137739038","257604002108277655194626424358851808622","173516421158283102330555031911886671866"],"threshold":0.9},"id":"CVE-2026-33996-0d07c258","signature_type":"Line","signature_version":"v1","source":"https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c","target":{"file":"libjwt/openssl/jwk-parse.c"}},{"source":"https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c","target":{"file":"tools/key2jwk.c","function":"parse_one_file"},"deprecated":false,"digest":{"function_hash":"249292142998146794046341746561912521373","length":2066},"id":"CVE-2026-33996-279dbf23","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"213111863608874081896844933867204137360","length":330},"id":"CVE-2026-33996-2938b037","signature_type":"Function","signature_version":"v1","source":"https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c","target":{"function":"get_one_octet","file":"tools/key2jwk.c"}},{"deprecated":false,"digest":{"line_hashes":["133892628675677332227137953238200919379","227588466462029496060127181366696428479","292284129147067845456079652374169845404","256412334486587725365770408192226464819"],"threshold":0.9},"id":"CVE-2026-33996-38d570cb","signature_type":"Line","signature_version":"v1","source":"https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c","target":{"file":"libjwt/jwt.c"}},{"deprecated":false,"digest":{"line_hashes":["290532130435008441745808831190888268869","296023603020262783362053622624661134794","273958361772971042878448010386040514724","280279966665307871102186207347198061407","245960926834940080028280183609628737514","292746689357985153026640282258453018260","236907821043981202314589609992519564337","198985566369242020701223066073333755123","69837525156773411380553452915906284516","135127327154699416000452558507725617315","32017422900070149262962732135986872992"],"threshold":0.9},"id":"CVE-2026-33996-43640a46","signature_type":"Line","signature_version":"v1","source":"https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c","target":{"file":"libjwt/gnutls/sign-verify.c"}},{"target":{"function":"openssl_process_item_free","file":"libjwt/openssl/jwk-parse.c"},"deprecated":false,"digest":{"function_hash":"325141128101457952218435552510196950847","length":275},"id":"CVE-2026-33996-49e2a6fe","signature_type":"Function","signature_version":"v1","source":"https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c"},{"id":"CVE-2026-33996-50292e8c","signature_type":"Function","signature_version":"v1","source":"https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c","target":{"file":"libjwt/jwks.c","function":"jwks_error_clear"},"deprecated":false,"digest":{"function_hash":"179100793400790402617490266736219675023","length":127}},{"deprecated":false,"digest":{"function_hash":"237372074864291780791974462861931393535","length":3433},"id":"CVE-2026-33996-60546e5e","signature_type":"Function","signature_version":"v1","source":"https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c","target":{"file":"libjwt/gnutls/sign-verify.c","function":"gnutls_sign_sha_pem"}},{"signature_version":"v1","source":"https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c","target":{"file":"libjwt/jwt-verify.c","function":"jwt_parse_head"},"deprecated":false,"digest":{"function_hash":"169119727621535003743055974522995194153","length":569},"id":"CVE-2026-33996-6874f413","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"339674275041351037028775013517154826259","length":329},"id":"CVE-2026-33996-76109026","signature_type":"Function","signature_version":"v1","source":"https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c","target":{"file":"libjwt/jwt-crypto-ops.c","function":"jwt_init"}},{"source":"https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c","target":{"file":"libjwt/jwks-curl.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["141073196111010996509071359038678259067","104570520370492240775734357726150505904","85053904632926621982591182139176105271","322208753579265431723519017112374578982","239491670713822625050637067294901397278","81035877316436374644123181856817268400","290059040552119753972717822950244704448","13395154105217267614636259467388414800","222600725769956552498459986651752181753","190516814982720146648329046204765066956"]},"id":"CVE-2026-33996-84b20a84","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"299302431219777404771112340119141724225","length":495},"id":"CVE-2026-33996-9345362f","signature_type":"Function","signature_version":"v1","source":"https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c","target":{"file":"libjwt/jwks.c","function":"jwks_process"}},{"digest":{"line_hashes":["280625905642247532519778525219727039947","23299736378008860819171613132659437175","87142660046368107314347467488664014658","58996708831783248716307246563550313506","70417585158514966510246138935852197866","190413225741354465424386155187834397935","29750096419663578524793160173229978638","12075712489889557220607038856527302349","279802446938777279955653504168436115200","8713579353631963689664985875842589329","193132891158560969497659377412775421091","219491190908209244618236173539854306952","302362158904802480639935783528516346549","290440999476770186912366904339161502016","176150468146611822334573790059180971449","145694420803845374810291935730583932254","118908571113766983855502853917357325029"],"threshold":0.9},"id":"CVE-2026-33996-94c25a57","signature_type":"Line","signature_version":"v1","source":"https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c","target":{"file":"tools/key2jwk.c"},"deprecated":false},{"source":"https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c","target":{"file":"libjwt/jwks.c","function":"__item_free"},"deprecated":false,"digest":{"function_hash":"61968203851876964041371821152693997010","length":281},"id":"CVE-2026-33996-94e78366","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"54261442672179195674337117002722156886","length":1699},"id":"CVE-2026-33996-97b01352","signature_type":"Function","signature_version":"v1","source":"https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c","target":{"file":"tools/jwk2key.c","function":"write_key_file"}},{"id":"CVE-2026-33996-a5130ead","signature_type":"Line","signature_version":"v1","source":"https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c","target":{"file":"libjwt/jwt-verify.c"},"deprecated":false,"digest":{"line_hashes":["44949062416638654361193727164898402596","224738083693485546979487470058074563758","199868895539737566527471744721034799580"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["285862318152619422226848012975655090820","166133928450411084812847618324827807119","59061241529418518779103503096981474856","114948537869769368297736401306725129679","67970831178727447054647249477777268261","15921616197607986915854501243250365913","21872704249296582621674054696809883336","327842980457959910618578697112087714109","250954586303368808241749990102896128043"],"threshold":0.9},"id":"CVE-2026-33996-a6a31b20","signature_type":"Line","signature_version":"v1","source":"https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c","target":{"file":"tools/jwk2key.c"}},{"id":"CVE-2026-33996-a7fcf290","signature_type":"Function","signature_version":"v1","source":"https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c","target":{"file":"libjwt/jwks-curl.c","function":"header_cb"},"deprecated":false,"digest":{"length":402,"function_hash":"143059793989686572469377024325194206838"}},{"deprecated":false,"digest":{"function_hash":"280069279535833441381826098612823169692","length":390},"id":"CVE-2026-33996-c624cac7","signature_type":"Function","signature_version":"v1","source":"https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c","target":{"file":"libjwt/jwt.c","function":"_crypto_strcmp"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c","target":{"file":"libjwt/openssl/jwk-parse.c","function":"set_one_octet"},"deprecated":false,"digest":{"function_hash":"170737186265205860609106447394632889326","length":261},"id":"CVE-2026-33996-d03177df"},{"deprecated":false,"digest":{"line_hashes":["19544473172880325058229224695447442174","200274665386646535969394304918683141486","242647722272122961844843450432701400286","112361072486709855281879202042011311776","37887861759403381648590270309257537713","285730090237464861739224158995990835885","223241830528079326046526974681376550802","284256605744872102027691569520392531613","1844097088832066704723849708191193406","116244362985538396156415837518942179371","141322067226910476130653695418115965072","52240706290474654540214863630606916359","276365410759952464857767756906864912925"],"threshold":0.9},"id":"CVE-2026-33996-dad1c5b1","signature_type":"Line","signature_version":"v1","source":"https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c","target":{"file":"libjwt/jwt-private.h"}},{"digest":{"line_hashes":["173511648677972544181337717846001426182","297112201602597922772476040158947123989","333744338299790472136549231161400657162","303774780965974855409716593428713338960","286547414523916073506620483113778689073"],"threshold":0.9},"id":"CVE-2026-33996-eabb8ba6","signature_type":"Line","signature_version":"v1","source":"https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c","target":{"file":"libjwt/jwt-common.c"},"deprecated":false},{"target":{"function":"jwks_error_any","file":"libjwt/jwks.c"},"deprecated":false,"digest":{"function_hash":"190205807891810776665604326868752855376","length":191},"id":"CVE-2026-33996-f2b8fad9","signature_type":"Function","signature_version":"v1","source":"https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c"},{"id":"CVE-2026-33996-f2ccffc1","signature_type":"Function","signature_version":"v1","source":"https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c","target":{"file":"libjwt/openssl/jwk-parse.c","function":"openssl_process_rsa"},"deprecated":false,"digest":{"function_hash":"144832854147029923987008620697275268160","length":2655}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c","target":{"file":"tools/key2jwk.c","function":"get_one_bn"},"deprecated":false,"digest":{"length":423,"function_hash":"85319897450562939137578193446711725519"},"id":"CVE-2026-33996-f4103003"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:A/VC:L/VI:L/VA:H/SC:L/SI:L/SA:L"}]}