CVE-2024-21664: Lestrrat-go Jwx DOS Vulnerability

CVE-2024-21664 Overview

CVE-2024-21664 is a null pointer dereference vulnerability [CWE-476] in lestrrat-go/jwx, a widely used Go module implementing JOSE technologies (JWA/JWE/JWK/JWS/JWT). The flaw resides in the jws.Parse function. Attackers can trigger a panic by sending a JSON-serialized JWS payload where the signature field is present but the protected header is absent. Any Go service performing JWS verification with vulnerable versions of the library can be crashed remotely. The maintainer patched the issue in versions 2.0.19 and 1.2.28.

Critical Impact
Unauthenticated network attackers can crash any service that calls jws.Parse on attacker-controlled JWS input, producing a denial-of-service condition against authentication and token-processing components.

Affected Products

lestrrat-go/jwx v2 series prior to 2.0.19
lestrrat-go/jwx v1 series prior to 1.2.28
Go applications and services that pass untrusted JWS messages to jws.Parse

Discovery Timeline

2024-01-09 - CVE CVE-2024-21664 published to NVD
2024-01-09 - Fixed releases v2.0.19 and v1.2.28 published with GitHub Security Advisory GHSA-pvcr-v8j8-j5q3
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21664

Vulnerability Analysis

The defect is a classic null pointer dereference in the JWS parser. lestrrat-go/jwx supports two JWS serializations: the compact form (three base64 segments joined by dots) and the full JSON form. In JSON form, each signature entry is expected to carry both a signature value and a protected header. When the protected field is omitted, the parser leaves the internal sig.protected pointer as nil. Downstream logic then reads header fields directly from that pointer, causing a runtime panic. Because Go panics propagate up the goroutine, an unrecovered panic terminates the request handler and, depending on server design, can crash the entire process. The EPSS score of 0.864% reflects modest observed exploitation interest, but the exploit primitive itself is trivial to construct.

Root Cause

The parser did not validate that sig.protected was populated before dereferencing it. The maintainer's fix substitutes an empty headers object when the field is missing, allowing jws.Parse to succeed while ensuring that subsequent calls to jws.Verify fail cleanly rather than panic.

Attack Vector

An unauthenticated remote attacker sends a crafted JSON-serialized JWS message to any endpoint that invokes jws.Parse. Common exposure points include OAuth/OIDC token validators, API gateways verifying signed requests, and internal microservices that trust JWS-signed messages. No credentials, user interaction, or privileged position on the network is required.

// Patch from jws/message.go (lestrrat-go/jwx)
// Source: https://github.com/lestrrat-go/jwx/commit/0e8802ce6842625845d651456493e7c87625601f
			sig.SetDecodeCtx(nil)

			if sig.protected == nil {
				// Instead of barfing on a nil protected header, use an empty header
				sig.protected = NewHeaders()
			}

			if i == 0 {
				if !getB64Value(sig.protected) {
					b64 = false

The patch inserts a nil check before any dereference of sig.protected, replacing the missing header with an empty Headers instance. Verification is still expected to fail for such messages, but the process no longer panics.

Detection Methods for CVE-2024-21664

Indicators of Compromise

Unexpected process crashes or goroutine panics in Go services that handle JWT/JWS traffic, with stack traces pointing into github.com/lestrrat-go/jwx/jws.
HTTP 5xx responses or dropped TLS connections immediately following requests containing JSON-serialized JWS bodies.
Inbound requests carrying JWS JSON payloads that include a signature field but omit the protected field.

Detection Strategies

Perform software composition analysis (SCA) on Go modules to flag github.com/lestrrat-go/jwx versions below 1.2.28 or 2.0.19.
Add web application firewall or API gateway rules that inspect JWS JSON bodies and reject entries lacking a protected header.
Instrument jws.Parse call sites with recover() and log panics as security events for retrospective hunting.

Monitoring Recommendations

Alert on repeated panics or restarts of authentication and token-validation services within short time windows.
Track error rates for JWS/JWT parsing endpoints and correlate spikes with source IP concentration.
Ship Go runtime crash logs to centralized logging so that DoS attempts against JWS parsers are visible across the fleet.

How to Mitigate CVE-2024-21664

Immediate Actions Required

Upgrade github.com/lestrrat-go/jwx/v2 to v2.0.19 or later.
Upgrade github.com/lestrrat-go/jwx (v1) to v1.2.28 or later.
Rebuild and redeploy any binaries that statically link vulnerable versions, including sidecars and admission controllers.
Audit dependency graphs for transitive inclusion of lestrrat-go/jwx via other Go modules.

Patch Information

The fix is delivered in v2.0.19 (commit d69a721931a5c48b9850a42404f18e143704adcd) and v1.2.28 (commit 8c53d0ae52d5ab1e2b37c5abb67def9e7958fd65), with the core code change in commit 0e8802ce6842625845d651456493e7c87625601f. See the GitHub Security Advisory GHSA-pvcr-v8j8-j5q3 for the full advisory.

Workarounds

Reject JWS JSON payloads at the ingress layer when the protected field is missing from any signature entry.
Prefer the compact JWS serialization for external interfaces, which returns an error rather than panicking on this input.
Wrap jws.Parse invocations in a defer/recover() block as an interim safety net until patched binaries are deployed.

bash

# Upgrade lestrrat-go/jwx to a patched release
go get github.com/lestrrat-go/jwx/v2@v2.0.19
# or, for v1 consumers:
go get github.com/lestrrat-go/jwx@v1.2.28

go mod tidy
go build ./...