Skip to content
OpenAdvisories

Package · Debian

libjwt3

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Critical 9.1
    CVE-2026-44699

    LibJWT: Algorithm confusion allows JWT forgery with RSA JWK as empty-key HMAC

    LibJWT is a C JSON Web Token Library. From 3.0.0 to 3.3.2, libjwt accepts an RSA JWK that does not contain an alg parameter as the verification key for an HS256/HS384/HS512 token. In the OpenSSL backend, this causes HMAC verification to run with a zero-length…

    benmcollins libjwt libjwt libjwt3 Debian Ubuntu
  • Medium 5.8
    CVE-2026-33996

    LibJWT has NULL/bounds validation in JWK octet and RSA PSS parsing

    LibJWT is a C JSON Web Token Library. Starting in version 3.0.0 and prior to version 3.3.0, the JWK parsing for RSA-PSS did not protect against a NULL value when expecting to parse JSON string values. A specially crafted JWK file could exploit this behavior b…

    benmcollins libjwt libjwt libjwt3 Debian Ubuntu