CVE-2026-33996

Name	CVE-2026-33996
Description	LibJWT is a C JSON Web Token Library. Starting in version 3.0.0 and prior to version 3.3.0, the JWK parsing for RSA-PSS did not protect against a NULL value when expecting to parse JSON string values. A specially crafted JWK file could exploit this behavior by using integers in places where the code expected a string. This was fixed in v3.3.0. A workaround is available. Users importing keys through a JWK file should not do so from untrusted sources. Use the `jwk2key` tool to check for validity of a JWK file. Likewise, if possible, do not use JWK files with RSA-PSS keys.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1132165

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libjwt (PTS)	bullseye	1.10.2-1+deb11u1	fixed
	bookworm	1.10.2-1+deb12u1	fixed
	forky, sid, trixie	1.17.2-1	fixed
libjwt3 (PTS)	forky, sid	3.2.3-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libjwt	source	(unstable)	(not affected)
libjwt3	source	(unstable)	(unfixed)			1132165

Notes

- libjwt <not-affected> (Only affects the 3.x series)
https://github.com/benmcollins/libjwt/security/advisories/GHSA-ph96-hqpc-9f66
Fixed by: https://github.com/benmcollins/libjwt/commit/cfd890286fa49ae61b534c937c9f0428b5c6034c (v3.3.0)