CVE-2024-21664

jwx is a Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. Calling `jws.Parse` with a JSON serialized payload where the `signature` field is present while `protected` is absent can lead to a nil pointer dereference. The vulnerability can be used to crash/DOS a system doing JWS verification. This vulnerability has been patched in versions 2.0.19 and 1.2.28.

• CWE-476

• https://github.com/lestrrat-go/jwx/commit/0e8802ce6842625845d651456493e7c87625601fPatch
• https://github.com/lestrrat-go/jwx/commit/8c53d0ae52d5ab1e2b37c5abb67def9e7958fd65
• https://github.com/lestrrat-go/jwx/commit/d69a721931a5c48b9850a42404f18e143704adcdPatch
• https://github.com/lestrrat-go/jwx/security/advisories/GHSA-pvcr-v8j8-j5q3Exploit, Vendor Advisory
• https://github.com/lestrrat-go/jwx/commit/0e8802ce6842625845d651456493e7c87625601fPatch
• https://github.com/lestrrat-go/jwx/commit/8c53d0ae52d5ab1e2b37c5abb67def9e7958fd65
• https://github.com/lestrrat-go/jwx/commit/d69a721931a5c48b9850a42404f18e143704adcdPatch
• https://github.com/lestrrat-go/jwx/security/advisories/GHSA-pvcr-v8j8-j5q3Exploit, Vendor Advisory

Published

Jan 9, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-21655Discourse is a platform for community discussion. For fields…4.3
• CVE-2024-21658discourse-calendar is a discourse plugin which adds the abil…4.3
• CVE-2024-2166Improper Neutralization of Input During Web Page Generation …6.1
• CVE-2024-21661Argo CD is a declarative, GitOps continuous delivery tool fo…7.5
• CVE-2024-21662Argo CD is a declarative, GitOps continuous delivery tool fo…9.1
• CVE-2024-21663Discord-Recon is a Discord bot created to automate bug bount…8.8
• CVE-2024-21665ecommerce-framework-bundle is the Pimcore Ecommerce Framewor…4.3
• CVE-2024-21666The Customer Management Framework (CMF) for Pimcore adds fun…6.5
• CVE-2024-21667pimcore/customer-data-framework is the Customer Management F…6.5
• CVE-2024-21668react-native-mmkv is a library that allows easy use of MMKV …4.9
• CVE-2024-21669Hyperledger Aries Cloud Agent Python (ACA-Py) is a foundatio…8.8
• CVE-2024-2167Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…