{"record":{"id":"98d8d5fd5836e462","repo":"jwtk/jjwt","slug":"rsa-jwk-oth-other-prime-info-element-cannot-be","errorCode":null,"errorMessage":"RSA JWK 'oth' (Other Prime Info) element cannot be null.","messagePattern":"RSA JWK 'oth' \\(Other Prime Info\\) element cannot be null\\.","errorType":"exception","errorClass":"MalformedKeyException","httpStatus":null,"severity":"error","filePath":"impl/src/main/java/io/jsonwebtoken/impl/security/RSAOtherPrimeInfoConverter.java","lineNumber":53,"sourceCode":"\n    static final Parameter<BigInteger> PRIME_FACTOR = Parameters.secretBigInt(\"r\", \"Prime Factor\");\n    static final Parameter<BigInteger> FACTOR_CRT_EXPONENT = Parameters.secretBigInt(\"d\", \"Factor CRT Exponent\");\n    static final Parameter<BigInteger> FACTOR_CRT_COEFFICIENT = Parameters.secretBigInt(\"t\", \"Factor CRT Coefficient\");\n    static final Set<Parameter<?>> PARAMS = Collections.<Parameter<?>>setOf(PRIME_FACTOR, FACTOR_CRT_EXPONENT, FACTOR_CRT_COEFFICIENT);\n\n    @Override\n    public Object applyTo(RSAOtherPrimeInfo info) {\n        Map<String, Object> m = new LinkedHashMap<>(3);\n        m.put(PRIME_FACTOR.getId(), PRIME_FACTOR.applyTo(info.getPrime()));\n        m.put(FACTOR_CRT_EXPONENT.getId(), FACTOR_CRT_EXPONENT.applyTo(info.getExponent()));\n        m.put(FACTOR_CRT_COEFFICIENT.getId(), FACTOR_CRT_COEFFICIENT.applyTo(info.getCrtCoefficient()));\n        return m;\n    }\n\n    @Override\n    public RSAOtherPrimeInfo applyFrom(Object o) {\n        if (o == null) {\n            throw new MalformedKeyException(\"RSA JWK 'oth' (Other Prime Info) element cannot be null.\");\n        }\n        if (!(o instanceof Map)) {\n            String msg = \"RSA JWK 'oth' (Other Prime Info) must contain map elements of name/value pairs. \" +\n                    \"Element type found: \" + o.getClass().getName();\n            throw new MalformedKeyException(msg);\n        }\n        Map<?, ?> m = (Map<?, ?>) o;\n        if (Collections.isEmpty(m)) {\n            throw new MalformedKeyException(\"RSA JWK 'oth' (Other Prime Info) element map cannot be empty.\");\n        }\n\n        // Need a Context instance to satisfy the API contract of the reader.get* methods below.\n        JwkContext<?> ctx = new DefaultJwkContext<>(PARAMS);\n        try {\n            for (Map.Entry<?, ?> entry : m.entrySet()) {\n                String name = String.valueOf(entry.getKey());\n                ctx.put(name, entry.getValue());\n            }","sourceCodeStart":35,"sourceCodeEnd":71,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/impl/src/main/java/io/jsonwebtoken/impl/security/RSAOtherPrimeInfoConverter.java#L35-L71","documentation":"When converting an RSA JWK's 'oth' (Other Prime Info) array back into a java.security.spec.RSAOtherPrimeInfo, each element must be a non-null map of name/value pairs (r, d, t). A null element is rejected with MalformedKeyException.","triggerScenarios":"Parsing an RSA JWK whose 'oth' array contains a JSON null element, e.g. {\"oth\":[null]} or building a JWK with a null entry in the oth collection.","commonSituations":"Hand-edited or third-party-generated JWKs with null placeholders; serializers emitting nulls for missing primes instead of omitting the 'oth' parameter.","solutions":["Remove null entries from the 'oth' array, or omit 'oth' entirely for standard two-prime RSA keys.","Sanitize/validate the JWK JSON before parsing, rejecting null array elements.","Catch MalformedKeyException when ingesting external JWKs and treat the key as invalid."],"exampleFix":"// before\n{\"kty\":\"RSA\",\"oth\":[null]}\n// after\n{\"kty\":\"RSA\"}  // or a fully populated oth element\n{\"kty\":\"RSA\",\"oth\":[{\"r\":\"...\",\"d\":\"...\",\"t\":\"...\"}]}","handlingStrategy":"validation","validationCode":"List<Object> oth = jwk.get(\"oth\", List.class);\nif (oth != null) {\n    oth.forEach(e -> Objects.requireNonNull(e, \"oth element must not be null\"));\n}","typeGuard":"boolean validOth(List<Object> oth) {\n    return oth == null || oth.stream().allMatch(e -> e instanceof Map && e != null);\n}","tryCatchPattern":"try {\n    RsaJwk jwk = Jwks.parser().build().parse(json);\n} catch (MalformedKeyException e) {\n    // malformed oth (or other) JWK field\n}","preventionTips":["Omit 'oth' for standard two-prime RSA keys","Sanitize third-party JWK JSON before parsing","Never emit null placeholders in JWK arrays"],"tags":["jwk","rsa","jwt","validation"],"backgroundTag":"schema-validation-failed","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}