Medium severity6.8OSV Advisory· Published Apr 1, 2024· Updated Jun 17, 2026
CVE-2024-31033
CVE-2024-31033
Description
JJWT (aka Java JWT) through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. The impacted code is the setSigningKey() method within the DefaultJwtParser class and the signWith() method within the DefaultJwtBuilder class. NOTE: the vendor disputes this because the "ignores" behavior cannot occur (in any version) unless there is a user error in how JJWT is used, and because the version that was actually tested must have been more than six years out of date.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
io.jsonwebtoken:jjwt-implMaven | <= 0.12.5 | — |
Affected products
2Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-r65j-6h5f-4f92ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-31033ghsaADVISORY
- github.com/jwtk/jjwt/blob/26948610fbef81eba867cbaad54b516d1874c70a/impl/src/main/java/io/jsonwebtoken/impl/DefaultJwtParserBuilder.javaghsaWEB
- github.com/jwtk/jjwt/issues/930nvdWEB
- www.viralpatel.net/java-create-validate-jwt-tokenghsaWEB
- www.viralpatel.net/java-create-validate-jwt-token/nvd
News mentions
0No linked articles in our index yet.