https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T02:19:44.446595+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-278354 EUVD-2026-278354 2026-10-09T02:19:44.449269+00:00 EUVD-2026-278354 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33996 fkie_cve-2026-33996 2026-10-09T02:19:44.449301+00:00

LibJWT is a C JSON Web Token Library. Starting in version 3.0.0 and prior to version 3.3.0, the JWK parsing for RSA-PSS did not protect against a NULL value when expecting to parse JSON string values. A specially crafted JWK file could exploit this behavior by using integers in places where the code expected a string. This was fixed in v3.3.0. A workaround is available. Users importing keys through a JWK file should not do so from untrusted sources. Use the `jwk2key` tool to check for validity of a JWK file. Likewise, if possible, do not use JWK files with RSA-PSS keys.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-33996 UBUNTU-CVE-2026-33996 2026-10-09T02:19:44.449336+00:00

Affected: Ubuntu:18.04:LTS: libjwt, Ubuntu:20.04:LTS: libjwt, Ubuntu:22.04:LTS: libjwt, Ubuntu:24.04:LTS: libjwt, Ubuntu:25.10: libjwt, Ubuntu:26.04:LTS: libjwt, Ubuntu:26.04:LTS: libjwt3

LibJWT is a C JSON Web Token Library. Starting in version 3.0.0 and prior to version 3.3.0, the JWK parsing for RSA-PSS did not protect against a NULL value when expecting to parse JSON string values. A specially crafted JWK file could exploit this behavior by using integers in places where the code expected a string. This was fixed in v3.3.0. A workaround is available. Users importing keys through a JWK file should not do so from untrusted sources. Use the `jwk2key` tool to check for validity of a JWK file. Likewise, if possible, do not use JWK files with RSA-PSS keys.