ZeroDay Findings
Sign inSign up

Findings

HSEC-2026-0010

Improper parsing of fractional NumericDate from JWT exp claims

Published Sep 29, 2026 · corrected/updated Sep 29, 2026 · evidence confidence medium

# Improper parsing of fractional from JWT claims Since its [initial commit][], package jwt uses [ ][scientific] to extract the fractional mantissa in a way that improperly *discards the exponent*. This can lead to incorrect parsing of the claim in JWT payload body. PoC: The encoded claim is: 1. Explicitly allowed by RFC 7519 [section 2][rfc-2] to contain fractional part (*"... non-integer values can be represented."*); 2. Decodes correctly as (including in JS implementations on jwt.io & token.dev); 3. Decodes incorrectly as (== posix epoch ) by the library. This happens because jwt's only extracts the parsed while ignoring [ ][scientific], which in this case becomes negative non-zero. Since the standard claim carries credential expiration time: > ### [4.1.4][rfc-4.1.4]. "exp" (Expiration Time) Claim > > The "exp" (expiration time) claim identifies the expiration time on > or after which the JWT MUST NOT be accepted for processing. The > processing of the "exp" claim requires that the current date/time > MUST be before the expiration date/time listed in the "exp" claim. — this parsing mistake of dropping the exponent can have security-relevant consequences, should an attacker be able to forge JWTs with fractional expiry dates and get them fed into software that uses the library for consuming JWTs. [initial commit]: https://github.com/puffnfresh/haskell-jwt/commit/76567342c71f62f3f7554da8987579d90e532209 [rfc-2]: https://www.rfc-editor.org/info/rfc7519/#section-2 [rfc-4.1.4]: https://www.rfc-editor.org/info/rfc7519/#section-4.1.4 [scientific]: https://hackage-content.haskell.org/package/scientific-0.3.8.1/docs/Data-Scientific.html#g:2

Grounded briefings

Catalog interpretations for three audiences. Each brief cites ingested metadata and the original advisories below. They are not independent research and they do not invent exploit steps.

Executive

HSEC-2026-0010 is a unknown public vulnerability record for this product. It is not currently listed in the CISA Known Exploited catalog. Check the linked vendor or CERT advisories for patch status. This summary is a catalog interpretation of the ingested metadata and cites the original advisories below.

System administrator

Identify whether this product is in your estate, then compare installed versions with the affected ranges. Affected packages or ranges on record: jwt (0.1.0 → 0.12.0). Check the linked vendor or CERT advisories for patch status. Prefer the vendor or distribution advisory linked in Sources before changing production systems. This is a catalog interpretation, not a runbook.

Security analyst

Signals on file: no CVSS/EPSS yet. It is not currently listed in the CISA Known Exploited catalog. Sources contributing to this record: osv. Public exploit references, when present, are outbound links only and are not proof of active exploitation. This is a catalog interpretation of stored metadata.

Exploitation and remediation

  • Exploitation evidence

    Not listed as known exploited in CISA KEV. Not in CISA KEV or VulnCheck KEV.

  • Patch and remediation

    No required-action text is stored yet. Use the vendor or CERT links in Sources for patch availability.

  • Safe detection guidance

    Compare installed versions with the affected ranges below and verify the advisory from the original publisher. This site stores metadata and outbound links only; it does not ship exploit code or proof-of-concept payloads.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 29, 2026 · OpenSSF OSV / OSV Scanner

    Detected

    # Improper parsing of fractional from JWT claims Since its [initial commit][], package jwt uses [ ][scientific] to extract the fractional mantissa in a way that improperly *discards the exponent*. This can lead to incorrect parsing of the claim in JWT payload body. PoC: The encoded claim is: 1. Explicitly allowed by RFC 7519 [section 2][rfc-2] to contain fractional part (*"... non-integer values c

  2. Sep 29, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    jwt fixed in 0.12.0

  3. Sep 29, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    jwt fixed in 0.12.0

  4. Sep 29, 2026 · OpenSSF OSV / OSV Scanner

    Updated

    # Improper parsing of fractional from JWT claims Since its [initial commit][], package jwt uses [ ][scientific] to extract the fractional mantissa in a way that improperly *discards the exponent*. This can lead to incorrect parsing of the claim in JWT payload body. PoC: The encoded claim is: 1. Explicitly allowed by RFC 7519 [section 2][rfc-2] to contain fractional part (*"... non-integer values c

Affected

  • Hackage jwt0.1.0 → 0.12.0

Sources

References