Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2024-21664

22
FAUCET Score

CVE-2024-21664 is a nil pointer dereference vulnerability affecting the lestrrat-go jwx Go module. It occurs when jws.Parse is called with a JSON serialized payload containing a signature field but lacking a protected field. This vulnerability has a CVSS score of 7.5 (High), indicating it can be exploited remotely with low complexity to cause a denial of service (DoS) by crashing systems performing JWS verification. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE. Patches are available in jwx versions 2.0.19 and 1.2.28.

Impacted Technologies

VendorProductVersion(s)CPE
< 2.0.19CPE matchmatch criteria
cpe:2.3:a:lestrrat-go:jwx:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

4.3MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
Exploitability Score
2.8
Impact Score
1.4
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.86%
Probability of exploitation in next 30 days
EPSS Percentile
54.9%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15
This CVE's current EPSS score of 0.0086 is in the 30th percentile among its peer group of 51,553 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (4)

github_advisorypatch availablevia nvd_reference
View patch
gopatch availablevia ghsa
Product: github.com/lestrrat-go/jwx/v2Fixed in: 2.0.19
gopatch availablevia ghsa
Product: github.com/lestrrat-go/jwxFixed in: 1.2.28
redhatend of lifevia redhat_api
Product: OpenShift Service Mesh 2Fixed in: openshift-service-mesh/istio-cni-rhel8

Vendor Advisories (2)

goGHSA-pvcr-v8j8-j5q3medium

Parsing JSON serialized payload without protected field can lead to segfault

Jan 9, 2024
redhatCVE-2024-21664Moderate

jwx: parsing JSON serialized payload without protected field can lead to panic

Jan 9, 2024

References

github.com / lestrrat-go/jwx/commit/0e8802ce6842625845d651456493e7c87625601f
Patch
github.com / lestrrat-go/jwx/commit/8c53d0ae52d5ab1e2b37c5abb67def9e7958fd65
github.com / lestrrat-go/jwx/commit/d69a721931a5c48b9850a42404f18e143704adcd
Patch
github.com / lestrrat-go/jwx/security/advisories/GHSA-pvcr-v8j8-j5q3
ExploitVendor Advisory