CVE-2026-33996: 
NixOS vulnerability analysis and mitigation

CVE-2026-33996 is a NULL Pointer Dereference vulnerability in LibJWT, a C JSON Web Token library, affecting the JWK parsing logic for RSA-PSS (and Octet/HS) algorithms. Versions 3.0.0 through 3.2.x are affected; the 2.x series is not impacted as it lacks JWK parsing. The vulnerability was discovered by researcher AkshayJainG, disclosed on March 25–27, 2026, and patched in version 3.3.0. It carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 5.8 (Medium) (GitHub Advisory, Feedly).

The root cause is a NULL Pointer Dereference (CWE-476) in the JWK parsing code for RSA-PSS and Octet (HS) key types. When parsing a JWK file, the library expected JSON string values for certain key fields but did not validate against NULL or non-string types; an attacker could supply a crafted JWK file using integer values in those fields, causing the parser to dereference a NULL pointer. The fix in commit cfd8902 added explicit NULL and bounds validation in the JWK octet and RSA-PSS parsing paths, along with a comprehensive security test suite covering type confusion and NULL safety scenarios (GitHub Advisory, Patch Commit).

Successful exploitation causes the application using LibJWT to crash when it attempts to import and parse a maliciously crafted JWK file, resulting in a denial of service (DoS) condition. There is no confidentiality or integrity impact on the vulnerable system itself, though the CVSS v4.0 scoring notes low confidentiality and integrity impact on subsequent systems. Exploitation requires user interaction — specifically, a user or automated process must import a JWK file from an untrusted source — limiting the attack surface to systems that dynamically load external JWK files for RSA-PSS or HS key operations (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.023%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an attacker to supply a crafted JWK file to a target that processes it, which necessitates user interaction and access to the JWK import workflow (GitHub Advisory, Feedly).

1. Craft a malicious JWK file: Create a JSON Web Key file targeting RSA-PSS or Octet (HS) key types, substituting integer values in fields where the LibJWT parser expects JSON strings (e.g., replacing string parameters like "n" or "k" with integer values).
2. Deliver the JWK file: Distribute the crafted JWK file to a target system or user that uses LibJWT 3.0.0–3.2.x and imports JWK files from external or user-supplied sources (e.g., via a file upload, configuration endpoint, or shared storage).
3. Trigger JWK parsing: Cause the application to import and parse the malicious JWK file — this may occur automatically (e.g., on startup or key refresh) or require a user action.
4. Achieve denial of service: The NULL pointer dereference in the RSA-PSS or Octet JWK parsing code causes the application to crash, resulting in service unavailability (GitHub Advisory, Patch Commit).

• Logs: Application crash logs or core dumps triggered during JWK file import, particularly referencing RSA-PSS or HS key parsing routines in LibJWT; segmentation fault signals (SIGSEGV) in process logs.
• File System: Presence of unexpected or externally sourced JWK files in application configuration directories, especially files containing integer values in fields normally expected to hold strings.
• Process: Abnormal termination (crash/restart) of services using LibJWT when processing JWK files; repeated service restarts correlated with JWK file import events.

Upgrade LibJWT to version 3.3.0 or later, which contains the fix for this vulnerability (Patch Commit). If immediate upgrade is not possible, apply the following workarounds: only import JWK files from trusted, controlled sources; use the jwk2key tool bundled with LibJWT to validate JWK files before importing them; and avoid using JWK files with RSA-PSS or HS keys where possible (GitHub Advisory).

The LibJWT maintainer (Ben Collins) published the security advisory on GitHub and acknowledged a procedural error — the fix was released before the vulnerability report was created — and noted that new processes are in place to improve security response going forward. The advisory credits AkshayJainG for discovering and responsibly reporting the issue (GitHub Advisory). A Tenable Nessus detection plugin (ID 304156) was published to identify vulnerable LibJWT installations (Tenable). Community reaction has been limited given the moderate severity and low exploitation likelihood.