Improper Handling of Exceptional Conditions

Overview Affected versions of this package are vulnerable to Improper Handling of Exceptional Conditions via the token parsing process. An attacker can cause the service to terminate threads and degrade availability by submitting JWTs with timestamp claims containing out-of-range values...

CVE-2026-85473

The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim exp, nbf, iat containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests of this nature may lead to degraded availability of the...

CVE-2026-85473

The auth0/java-jwt library is vulnerable to a flaw where it may terminate a thread upon receiving a JSON Web Token (JWT) containing an out-of-range value in timestamp claims such as exp , nbf , or iat . This issue occurs during the token parsing phase, specifically before signature verification t...

CVE-2026-85473 Out-of-Range Timestamp Claim Handling in auth0/java-jwt

The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim exp, nbf, iat containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests of this nature may lead to degraded availability of the...

CVE-2026-85473: Improper Handling of Exceptional Conditions

The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim exp, nbf, iat containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests of this nature may lead to degraded availability of the...

com.avast.grpc.jwt:grpc-java-jwt-keycloak (0.5.9), com.ritense.valtimo:keycloak-iam (>=9.26.1.release, <=9.26.2.release) +76 more potentially affected by CVE-2024-4028 via org.keycloak:keycloak-core (20.0.2)

org.keycloak:keycloak-core MAVEN version 20.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.avast.grpc.jwt:grpc-java-jwt-keycloak 0.5.9 - com.ritense.valtimo:keycloak-iam =9.26.1.release, =2.0.5...

java-jwt-4.4.0-1.1 on GA media (moderate)

java-jwt-4.4.0-1.1 on GA media Announcement ID: openSUSE-SU-2024:14395-1 Rating: moderate Cross-References: CVE-2022-42003 CVSS scores: CVE-2022-42003 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be...

Withdrawn: JJWT improperly generates signing keys

Withdrawn Advisory This advisory has been withdrawn because it has been found to be disputed. Please see the issue here for more information. Original Description JJWT aka Java JWT through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. The...

CVE-2024-31033

JJWT aka Java JWT through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. The impacted code is the setSigningKey method within the DefaultJwtParser class and the signWith method within the DefaultJwtBuilder class. NOTE: the vendor disputes thi...

CVE-2024-31033

The JJWT (Java JWT) library through version 0.12.5 contains a vulnerability where it ignores certain characters, potentially leading users to believe they possess a stronger key than they actually do. This issue affects the setSigningKey() method in the DefaultJwtParser class and the signWith() m...

Java JWT security vulnerabilities

Java JWT is a jwtk open source JSON web token for Java and Android. A security vulnerability exists in Java JWT JJWT version 0.12.5, which stems from a security issue in the setSigningKey method in the DefaultJwtParser class and in the signWith method in the DefaultJwtBuilder class, which omits...

CVE-2024-31033

JJWT aka Java JWT through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. The impacted code is the setSigningKey method within the DefaultJwtParser class and the signWith method within the DefaultJwtBuilder class. NOTE: the vendor disputes thi...

CVE-2024-31033

JJWT aka Java JWT through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. The impacted code is the setSigningKey method within the DefaultJwtParser class and the signWith method within the DefaultJwtBuilder class. NOTE: the vendor disputes thi...

CVE-2024-31033

JJWT aka Java JWT through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. The impacted code is the setSigningKey method within the DefaultJwtParser class and the signWith method within the DefaultJwtBuilder class. NOTE: the vendor disputes thi...

com.avast.grpc.jwt:grpc-java-jwt-keycloak (0.5.2), com.c4-soft.springaddons:keycloak-grants-mapper (>=3.1.13-jdk1.8, <=3.1.14-jdk17) +104 more potentially affected by CVE-2023-0105 via org.keycloak:keycloak-core (16.1.0)

org.keycloak:keycloak-core MAVEN version 16.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.avast.grpc.jwt:grpc-java-jwt-keycloak 0.5.2 - com.c4-soft.springaddons:keycloak-grants-mapper...

java-jwt:JWTFuzzer: Security exception in java.base/java.util.Arrays.copyOf

Detailed Report: https://oss-fuzz.com/testcase?key=5492225885995008 Project: java-jwt Fuzzing Engine: libFuzzer Fuzz Target: JWTFuzzer Job Type: libfuzzerasanjava-jwt Platform Id: linux Crash Type: Security exception Crash Address: Crash State: java.base/java.util.Arrays.copyOf...