jwtk/jjwt · error · MalformedKeyException

RSA JWK 'oth' (Other Prime Info) must contain map elements o

Error message

RSA JWK 'oth' (Other Prime Info) must contain map elements of name/value pairs. Element type found: ${o.getClass().getName()}

What it means

Thrown as MalformedKeyException when converting the RSA JWK 'oth' (Other Prime Info) array during JWK parsing and an individual element is not a Map. Each 'oth' entry must be a JSON object with 'r', 't', and 'd' name/value pairs per RFC 7518. The library throws because a non-object element (string, number, etc.) cannot be interpreted as prime info.

Source

Thrown at impl/src/main/java/io/jsonwebtoken/impl/security/RSAOtherPrimeInfoConverter.java:58

    @Override
    public Object applyTo(RSAOtherPrimeInfo info) {
        Map<String, Object> m = new LinkedHashMap<>(3);
        m.put(PRIME_FACTOR.getId(), PRIME_FACTOR.applyTo(info.getPrime()));
        m.put(FACTOR_CRT_EXPONENT.getId(), FACTOR_CRT_EXPONENT.applyTo(info.getExponent()));
        m.put(FACTOR_CRT_COEFFICIENT.getId(), FACTOR_CRT_COEFFICIENT.applyTo(info.getCrtCoefficient()));
        return m;
    }

    @Override
    public RSAOtherPrimeInfo applyFrom(Object o) {
        if (o == null) {
            throw new MalformedKeyException("RSA JWK 'oth' (Other Prime Info) element cannot be null.");
        }
        if (!(o instanceof Map)) {
            String msg = "RSA JWK 'oth' (Other Prime Info) must contain map elements of name/value pairs. " +
                    "Element type found: " + o.getClass().getName();
            throw new MalformedKeyException(msg);
        }
        Map<?, ?> m = (Map<?, ?>) o;
        if (Collections.isEmpty(m)) {
            throw new MalformedKeyException("RSA JWK 'oth' (Other Prime Info) element map cannot be empty.");
        }

        // Need a Context instance to satisfy the API contract of the reader.get* methods below.
        JwkContext<?> ctx = new DefaultJwkContext<>(PARAMS);
        try {
            for (Map.Entry<?, ?> entry : m.entrySet()) {
                String name = String.valueOf(entry.getKey());
                ctx.put(name, entry.getValue());
            }
        } catch (Exception e) {
            throw new MalformedKeyException(e.getMessage(), e);
        }

        ParameterReadable reader = new RequiredParameterReader(ctx);

View on GitHub (pinned to fb71496164)

Solutions

1. Fix the JWK 'oth' array so every element is a JSON object with r/t/d name/value pairs.
2. Remove the 'oth' member entirely if the key is not a multi-prime RSA key (it is optional for standard two-prime keys).
3. Regenerate the key with Jwts.SIG.RSxxx.keyPair() or a standard keytool/openssl flow and re-export a valid JWK.

Example fix

// before
"oth": ["4C9f...", "1a2b"]
// after
"oth": [ {"r":"4C9f...","t":"dHJ1...","d":"cHJp..."} ]

boolean othValid = oth != null && oth.stream().allMatch(e -> e instanceof Map && !((Map<?,?>) e).isEmpty());

boolean isOthElement(Object o) { return o instanceof Map && !((Map<?,?>) o).isEmpty(); }

try { /* parse JWK */ } catch (MalformedKeyException e) { log.error("Invalid 'oth' element: {}", e.getMessage()); throw new IllegalArgumentException("JWK 'oth' must be array of objects with r/t/d", e); }

When it happens

Trigger: Parsing a JWK string/JSON whose RSA 'oth' array contains a non-object element, e.g. oth: ["abc"] or oth: [123], via Jwts.parser key/JWK loading or JwkBuilder input.

Common situations: Hand-written or third-party JWKs with malformed multi-prime RSA data; JSON serialization tools flattening nested objects into strings; truncated or corrupted key material copied between systems.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• RSA JWK 'oth' (Other Prime Info) element map cannot be empty
• ${e.getMessage()}
• Unable to create JWK: ${iae.getMessage()}
• JWK must be a Map<String,?> (JSON Object). Type found: ${typ
• Malformed JWK Set JSON: ${t.getMessage()}

AI-assisted analysis of jwtk/jjwt@fb71496164 (2026-09-09). Data as JSON: /api/errors/f7374c674393a622. Report an issue: GitHub.