From: Remi Tricot-Le Breton <rlebreton@haproxy.com>
Date: Thu, 6 Aug 2026 07:35:42 +0000 (+0200)
Subject: BUG/MINOR: jwt: don't take an extra reference on the certificate public key
X-Git-Url: http://git.ipfire.org/index.cgi?a=commitdiff_plain;h=d09e44d51b7ca6f0ee67b3bc1213aa77ec93edf6;p=thirdparty%2Fhaproxy.git

BUG/MINOR: jwt: don't take an extra reference on the certificate public key

X509_get_pubkey() already returns an owned reference, so the extra
EVP_PKEY_up_ref() on the cert-store path leaked one reference per
verification, since only one EVP_PKEY_free() is done afterwards. Over
time this means key objects accumulate and are never released, even
across certificate reloads.

Drop the extra reference. The "jwt_cert_tree" path below still needs
its up_ref, since it only holds a borrowed pointer.

Introduced in 3.3 by 522bca98e ("MAJOR: jwt: Allow certificate instead
of public key in jwt_verify converter"). Must be backported to 3.3.

Reported-by: Claude (ANT-2026-PKPCQ3ZN)
---

diff --git a/src/jwt.c b/src/jwt.c
index 8eb4f063c..d10ab1257 100644
--- a/src/jwt.c
+++ b/src/jwt.c
@@ -421,9 +421,10 @@ jwt_jwsverify_rsa_ecdsa(const struct jwt_ctx *ctx, struct buffer *decoded_signat
 			store = ckchs_lookup(ctx->key);
 			if (store) {
 				if (store->conf.jwt) {
+					/* Note: X509_get_pubkey() already returns an
+					 * owned reference, don't take another one!
+					 */
 					pubkey = X509_get_pubkey(store->data->cert);
-					if (pubkey)
-						EVP_PKEY_up_ref(pubkey);
 				} else
 					retval = JWT_VRFY_UNAVAIL_CERT;
 			}