CVE-2026-33996
- Source
- https://cve.org/CVERecord?id=CVE-2026-33996
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33996.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-33996
- Aliases
-
- GHSA-ph96-hqpc-9f66
- Downstream
- Published
- 2026-03-27T22:21:21.465Z
- Modified
- 2026-07-15T19:06:42.191869Z
- Severity
-
- 5.8 (Medium) CVSS_V4 - CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:A/VC:L/VI:L/VA:H/SC:L/SI:L/SA:L CVSS Calculator
- Summary
- LibJWT has NULL/bounds validation in JWK octet and RSA PSS parsing
- Details
-
LibJWT is a C JSON Web Token Library. Starting in version 3.0.0 and prior to version 3.3.0, the JWK parsing for RSA-PSS did not protect against a NULL value when expecting to parse JSON string values. A specially crafted JWK file could exploit this behavior by using integers in places where the code expected a string. This was fixed in v3.3.0. A workaround is available. Users importing keys through a JWK file should not do so from untrusted sources. Use the
jwk2keytool to check for validity of a JWK file. Likewise, if possible, do not use JWK files with RSA-PSS keys. - Database specific
{ "cwe_ids": [ "CWE-476" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33996.json", "cna_assigner": "GitHub_M" }- References
Affected packages
Git / github.com/benmcollins/libjwt
Database specific
vanir_signatures_modified
"2026-07-15T19:06:42Z"
vanir_signatures
[
{
"signature_type": "Function",
"target": {
"file": "libjwt/jwks.c",
"function": "jwks_item_get"
},
"deprecated": false,
"source": "https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c",
"id": "CVE-2026-33996-003faaf6",
"signature_version": "v1",
"digest": {
"function_hash": "5391596667705380513248801862472656674",
"length": 214.0
}
},
{
"signature_type": "Line",
"target": {
"file": "libjwt/jwks.c"
},
"deprecated": false,
"source": "https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c",
"id": "CVE-2026-33996-0480bbcf",
"signature_version": "v1",
"digest": {
"line_hashes": [
"42702164764448493326096071204173415543",
"129132828142138473758844614288794015760",
"252599046355731948269015259589024726117",
"121532944504936564385788376844750013147",
"23308057570715050932708724073108034012",
"233135759793949198716715776696422594666",
"22788586691853301213719656366003534688",
"211951182821997560589736898471960545226",
"293006935076376959230356199134611288046",
"155348313649437155776143776646135030062",
"327200506776464646678218183747648961586",
"322117469322124009600696392743534663430",
"247798644351125404816609938121698662517",
"239800854428085153307985474247765089186",
"331832810668433059176425847648740439128",
"327025928787359115359151393244762472330",
"99750133802327970266892344672317493926",
"32084748256310327708658168492292531199",
"217562765697535533478340954279467353099",
"190398803903493988376482363240131099117",
"290522599340554080517671203209520727205",
"311899011134163428879796160649359806774",
"207495588434074307057945903446356899778",
"89356888518387548925215008546838812303",
"273412628146012828597361057463699950268",
"155349990576997206369002410458079362409",
"328769538195402953943267455724157673849",
"122987476617488602717244781921148375435",
"202237921810025309111461500747845960690",
"91540420712904778012178926582363040022",
"279218787302309477237239329349039492530",
"304149008436951427125518773032857217506",
"168991508070229615494748468674747675166",
"284957376814172337612457618301272531107",
"294601264610128883124864611766944752078"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"target": {
"file": "libjwt/jwt-crypto-ops.c"
},
"deprecated": false,
"source": "https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c",
"id": "CVE-2026-33996-07a2b7da",
"signature_version": "v1",
"digest": {
"line_hashes": [
"151557008000357795123006737716416714421",
"215856378755494676703970351063897884016",
"78253320427248270396081608403476265600",
"133558862692256288603803118803467003598",
"252510108830046776911110705713947156947"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "libjwt/jwks.c",
"function": "jwks_error"
},
"deprecated": false,
"source": "https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c",
"id": "CVE-2026-33996-0aa771bf",
"signature_version": "v1",
"digest": {
"function_hash": "111475424054000014929993873162704636997",
"length": 74.0
}
},
{
"signature_type": "Line",
"target": {
"file": "libjwt/openssl/jwk-parse.c"
},
"deprecated": false,
"source": "https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c",
"id": "CVE-2026-33996-0d07c258",
"signature_version": "v1",
"digest": {
"line_hashes": [
"290470594171577539091756943560635980121",
"139830738504132632914310263193520357453",
"158668324035785781373771821693910805259",
"86661630643466871906259963211225739374",
"151643672476457694618101172538725685177",
"13257394165916420291368991159294657418",
"80966008736274286216265408808912855604",
"122971835283354894543322417178818047156",
"117473220083768649029359878752865892375",
"78911202202396758821113569300949228982",
"210757961009458850430288996305417882284",
"90090551131569524780328514529010281052",
"250178072504312421451365239033392372193",
"148006528730208591497999665050137739038",
"257604002108277655194626424358851808622",
"173516421158283102330555031911886671866"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "tools/key2jwk.c",
"function": "parse_one_file"
},
"deprecated": false,
"source": "https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c",
"id": "CVE-2026-33996-279dbf23",
"signature_version": "v1",
"digest": {
"function_hash": "249292142998146794046341746561912521373",
"length": 2066.0
}
},
{
"signature_type": "Function",
"target": {
"file": "tools/key2jwk.c",
"function": "get_one_octet"
},
"deprecated": false,
"source": "https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c",
"id": "CVE-2026-33996-2938b037",
"signature_version": "v1",
"digest": {
"function_hash": "213111863608874081896844933867204137360",
"length": 330.0
}
},
{
"signature_type": "Line",
"target": {
"file": "libjwt/jwt.c"
},
"deprecated": false,
"source": "https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c",
"id": "CVE-2026-33996-38d570cb",
"signature_version": "v1",
"digest": {
"line_hashes": [
"133892628675677332227137953238200919379",
"227588466462029496060127181366696428479",
"292284129147067845456079652374169845404",
"256412334486587725365770408192226464819"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"target": {
"file": "libjwt/gnutls/sign-verify.c"
},
"deprecated": false,
"source": "https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c",
"id": "CVE-2026-33996-43640a46",
"signature_version": "v1",
"digest": {
"line_hashes": [
"290532130435008441745808831190888268869",
"296023603020262783362053622624661134794",
"273958361772971042878448010386040514724",
"280279966665307871102186207347198061407",
"245960926834940080028280183609628737514",
"292746689357985153026640282258453018260",
"236907821043981202314589609992519564337",
"198985566369242020701223066073333755123",
"69837525156773411380553452915906284516",
"135127327154699416000452558507725617315",
"32017422900070149262962732135986872992"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "libjwt/openssl/jwk-parse.c",
"function": "openssl_process_item_free"
},
"deprecated": false,
"source": "https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c",
"id": "CVE-2026-33996-49e2a6fe",
"signature_version": "v1",
"digest": {
"function_hash": "325141128101457952218435552510196950847",
"length": 275.0
}
},
{
"signature_type": "Function",
"target": {
"file": "libjwt/jwks.c",
"function": "jwks_error_clear"
},
"deprecated": false,
"source": "https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c",
"id": "CVE-2026-33996-50292e8c",
"signature_version": "v1",
"digest": {
"function_hash": "179100793400790402617490266736219675023",
"length": 127.0
}
},
{
"signature_type": "Function",
"target": {
"file": "libjwt/gnutls/sign-verify.c",
"function": "gnutls_sign_sha_pem"
},
"deprecated": false,
"source": "https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c",
"id": "CVE-2026-33996-60546e5e",
"signature_version": "v1",
"digest": {
"function_hash": "237372074864291780791974462861931393535",
"length": 3433.0
}
},
{
"signature_type": "Function",
"target": {
"file": "libjwt/jwt-verify.c",
"function": "jwt_parse_head"
},
"deprecated": false,
"source": "https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c",
"id": "CVE-2026-33996-6874f413",
"signature_version": "v1",
"digest": {
"function_hash": "169119727621535003743055974522995194153",
"length": 569.0
}
},
{
"signature_type": "Function",
"target": {
"file": "libjwt/jwt-crypto-ops.c",
"function": "jwt_init"
},
"deprecated": false,
"source": "https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c",
"id": "CVE-2026-33996-76109026",
"signature_version": "v1",
"digest": {
"function_hash": "339674275041351037028775013517154826259",
"length": 329.0
}
},
{
"signature_type": "Line",
"target": {
"file": "libjwt/jwks-curl.c"
},
"deprecated": false,
"source": "https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c",
"id": "CVE-2026-33996-84b20a84",
"signature_version": "v1",
"digest": {
"line_hashes": [
"141073196111010996509071359038678259067",
"104570520370492240775734357726150505904",
"85053904632926621982591182139176105271",
"322208753579265431723519017112374578982",
"239491670713822625050637067294901397278",
"81035877316436374644123181856817268400",
"290059040552119753972717822950244704448",
"13395154105217267614636259467388414800",
"222600725769956552498459986651752181753",
"190516814982720146648329046204765066956"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "libjwt/jwks.c",
"function": "jwks_process"
},
"deprecated": false,
"source": "https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c",
"id": "CVE-2026-33996-9345362f",
"signature_version": "v1",
"digest": {
"function_hash": "299302431219777404771112340119141724225",
"length": 495.0
}
},
{
"signature_type": "Line",
"target": {
"file": "tools/key2jwk.c"
},
"deprecated": false,
"source": "https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c",
"id": "CVE-2026-33996-94c25a57",
"signature_version": "v1",
"digest": {
"line_hashes": [
"280625905642247532519778525219727039947",
"23299736378008860819171613132659437175",
"87142660046368107314347467488664014658",
"58996708831783248716307246563550313506",
"70417585158514966510246138935852197866",
"190413225741354465424386155187834397935",
"29750096419663578524793160173229978638",
"12075712489889557220607038856527302349",
"279802446938777279955653504168436115200",
"8713579353631963689664985875842589329",
"193132891158560969497659377412775421091",
"219491190908209244618236173539854306952",
"302362158904802480639935783528516346549",
"290440999476770186912366904339161502016",
"176150468146611822334573790059180971449",
"145694420803845374810291935730583932254",
"118908571113766983855502853917357325029"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "libjwt/jwks.c",
"function": "__item_free"
},
"deprecated": false,
"source": "https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c",
"id": "CVE-2026-33996-94e78366",
"signature_version": "v1",
"digest": {
"function_hash": "61968203851876964041371821152693997010",
"length": 281.0
}
},
{
"signature_type": "Function",
"target": {
"file": "tools/jwk2key.c",
"function": "write_key_file"
},
"deprecated": false,
"source": "https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c",
"id": "CVE-2026-33996-97b01352",
"signature_version": "v1",
"digest": {
"function_hash": "54261442672179195674337117002722156886",
"length": 1699.0
}
},
{
"signature_type": "Line",
"target": {
"file": "libjwt/jwt-verify.c"
},
"deprecated": false,
"source": "https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c",
"id": "CVE-2026-33996-a5130ead",
"signature_version": "v1",
"digest": {
"line_hashes": [
"44949062416638654361193727164898402596",
"224738083693485546979487470058074563758",
"199868895539737566527471744721034799580"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"target": {
"file": "tools/jwk2key.c"
},
"deprecated": false,
"source": "https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c",
"id": "CVE-2026-33996-a6a31b20",
"signature_version": "v1",
"digest": {
"line_hashes": [
"285862318152619422226848012975655090820",
"166133928450411084812847618324827807119",
"59061241529418518779103503096981474856",
"114948537869769368297736401306725129679",
"67970831178727447054647249477777268261",
"15921616197607986915854501243250365913",
"21872704249296582621674054696809883336",
"327842980457959910618578697112087714109",
"250954586303368808241749990102896128043"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "libjwt/jwks-curl.c",
"function": "header_cb"
},
"deprecated": false,
"source": "https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c",
"id": "CVE-2026-33996-a7fcf290",
"signature_version": "v1",
"digest": {
"function_hash": "143059793989686572469377024325194206838",
"length": 402.0
}
},
{
"signature_type": "Function",
"target": {
"file": "libjwt/jwt.c",
"function": "_crypto_strcmp"
},
"deprecated": false,
"source": "https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c",
"id": "CVE-2026-33996-c624cac7",
"signature_version": "v1",
"digest": {
"function_hash": "280069279535833441381826098612823169692",
"length": 390.0
}
},
{
"signature_type": "Function",
"target": {
"file": "libjwt/openssl/jwk-parse.c",
"function": "set_one_octet"
},
"deprecated": false,
"source": "https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c",
"id": "CVE-2026-33996-d03177df",
"signature_version": "v1",
"digest": {
"function_hash": "170737186265205860609106447394632889326",
"length": 261.0
}
},
{
"signature_type": "Line",
"target": {
"file": "libjwt/jwt-private.h"
},
"deprecated": false,
"source": "https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c",
"id": "CVE-2026-33996-dad1c5b1",
"signature_version": "v1",
"digest": {
"line_hashes": [
"19544473172880325058229224695447442174",
"200274665386646535969394304918683141486",
"242647722272122961844843450432701400286",
"112361072486709855281879202042011311776",
"37887861759403381648590270309257537713",
"285730090237464861739224158995990835885",
"223241830528079326046526974681376550802",
"284256605744872102027691569520392531613",
"1844097088832066704723849708191193406",
"116244362985538396156415837518942179371",
"141322067226910476130653695418115965072",
"52240706290474654540214863630606916359",
"276365410759952464857767756906864912925"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"target": {
"file": "libjwt/jwt-common.c"
},
"deprecated": false,
"source": "https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c",
"id": "CVE-2026-33996-eabb8ba6",
"signature_version": "v1",
"digest": {
"line_hashes": [
"173511648677972544181337717846001426182",
"297112201602597922772476040158947123989",
"333744338299790472136549231161400657162",
"303774780965974855409716593428713338960",
"286547414523916073506620483113778689073"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "libjwt/jwks.c",
"function": "jwks_error_any"
},
"deprecated": false,
"source": "https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c",
"id": "CVE-2026-33996-f2b8fad9",
"signature_version": "v1",
"digest": {
"function_hash": "190205807891810776665604326868752855376",
"length": 191.0
}
},
{
"signature_type": "Function",
"target": {
"file": "libjwt/openssl/jwk-parse.c",
"function": "openssl_process_rsa"
},
"deprecated": false,
"source": "https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c",
"id": "CVE-2026-33996-f2ccffc1",
"signature_version": "v1",
"digest": {
"function_hash": "144832854147029923987008620697275268160",
"length": 2655.0
}
},
{
"signature_type": "Function",
"target": {
"file": "tools/key2jwk.c",
"function": "get_one_bn"
},
"deprecated": false,
"source": "https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c",
"id": "CVE-2026-33996-f4103003",
"signature_version": "v1",
"digest": {
"function_hash": "85319897450562939137578193446711725519",
"length": 423.0
}
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33996.json"