debian/libjwt vulnerabilities

Latest debian/libjwt CVEs

Newest publication first

1. CVE-2026-33996 LibJWT has NULL/bounds validation in JWK octet and RSA PSS parsing

   Published 2026-03-27

   Medium·CVSS 5.8

   LibJWT is a C JSON Web Token Library. Starting in version 3.0.0 and prior to version 3.3.0, the JWK parsing for RSA-PSS did not protect against a NULL value when expecting to parse JSON string values. A specially crafted JWK file could exploit this behavior by using integers in p...

2. DLA-3739-1 libjwt - security update

   Published 2024-02-24

   Unknown

3. CVE-2024-25189 libjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel.

   Published 2024-02-08

   Critical·CVSS 9.8

   libjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.