CVE-2024-21664

    Dashboard / Vulnerabilities / CVE-2024-21664

    CVE-2024-21664

    Published: 9 Jan 2024Last Modified: 28 Oct 2026

    Summary: Parsing JSON serialized payload without protected field can lead to segfault

    Details: jwx is a Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. Calling `jws.Parse` with a JSON serialized payload where the `signature` field is present while `protected` is absent can lead to a nil pointer dereference. The vulnerability can be used to crash/DOS a system doing JWS verification. This vulnerability has been patched in versions 2.0.19 and 1.2.28.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21664.json, https://github.com/lestrrat-go/jwx/security/advisories/GHSA-pvcr-v8j8-j5q3, https://nvd.nist.gov/vuln/detail/CVE-2024-21664, https://github.com/lestrrat-go/jwx/commit/0e8802ce6842625845d651456493e7c87625601f, https://github.com/lestrrat-go/jwx/commit/8c53d0ae52d5ab1e2b37c5abb67def9e7958fd65, https://github.com/lestrrat-go/jwx/commit/d69a721931a5c48b9850a42404f18e143704adcd

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 8f97f606570bc3de90005ce3188824e7e7eff88a
    Fixed -d69a721931a5c48b9850a42404f18e143704adcd

    Affected versions

    v1.2.27
    v1.2.26
    v1.2.25
    v1.2.24
    v1.2.23
    v1.2.22
    v1.2.21
    v1.2.20
    v1.2.19
    v1.2.18
    v1.2.17
    v1.2.15
    v1.2.14
    v1.2.13
    v1.2.12
    v1.2.11
    v1.2.10
    v1.2.9
    v1.2.8
    v1.2.7
    v1.2.6
    v1.2.5
    v1.2.4
    v1.2.3
    v1.2.2
    v1.2.1
    v1.2.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2024-21664 | CVE-DB