SUSE-SU-2026:24134-1
Vulnerability from csaf_suse - Published: 2026-10-09 11:50 - Updated: 2026-10-14 16:41Summary
Security update for python-PyJWT
Severity
Important
Notes
Title of the patch: Security update for python-PyJWT
Description of the patch: This update for python-PyJWT fixes the following issues:
- CVE-2026-101917: attacker traffic can amplify outbound requests to the configured JWKS endpoint (bsc#1283060).
- CVE-2026-101918: unauthenticated request can raise an exception that may produce an HTTP 500 response (bsc#1283061).
- CVE-2026-102267: forwarded credentials may be disclosed or verification keys may be substituted (bsc#1283064).
- CVE-2026-102268: an attacker who knows the public key can forge authenticated HMAC tokens (bsc#1283065).
- CVE-2026-102269: raw-token revocation checks can fail to recognize an equivalent modified token (bsc#1283066).
- CVE-2026-102270: an attacker can cause intensive CPU consumption (bsc#1283067).
- CVE-2026-102271: an attacker who knows the public key can forge authenticated HMAC tokens (bsc#1283068).
- CVE-2026-102274: Malformed RSA JWK aborts parsing of an entire JWK Set (bsc#1283071).
- CVE-2026-102275: an attacker may use a stolen sender-constrained token without the legitimate private key
(bsc#1283072).
Patchnames: SUSE-SLE-Micro-6.0-922
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
5.3 (Medium)
Affected products
Recommended
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:python311-PyJWT-0:2.9.0-159998.1.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
1 product, the same list as for
CVE-2026-101917
Threats
Impact
moderate
7.4 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2026-101917
Threats
Impact
important
7.4 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2026-101917
Threats
Impact
important
4.8 (Medium)
Affected products
Recommended
1 product, the same list as for
CVE-2026-101917
Threats
Impact
moderate
4.4 (Medium)
Affected products
Recommended
1 product, the same list as for
CVE-2026-101917
Threats
Impact
moderate
7.4 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2026-101917
Threats
Impact
important
5.9 (Medium)
Affected products
Recommended
1 product, the same list as for
CVE-2026-101917
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
1 product, the same list as for
CVE-2026-101917
Threats
Impact
moderate
References
40 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for python-PyJWT",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for python-PyJWT fixes the following issues:\n\n- CVE-2026-101917: attacker traffic can amplify outbound requests to the configured JWKS endpoint (bsc#1283060).\n- CVE-2026-101918: unauthenticated request can raise an exception that may produce an HTTP 500 response (bsc#1283061).\n- CVE-2026-102267: forwarded credentials may be disclosed or verification keys may be substituted (bsc#1283064).\n- CVE-2026-102268: an attacker who knows the public key can forge authenticated HMAC tokens (bsc#1283065).\n- CVE-2026-102269: raw-token revocation checks can fail to recognize an equivalent modified token (bsc#1283066).\n- CVE-2026-102270: an attacker can cause intensive CPU consumption (bsc#1283067).\n- CVE-2026-102271: an attacker who knows the public key can forge authenticated HMAC tokens (bsc#1283068).\n- CVE-2026-102274: Malformed RSA JWK aborts parsing of an entire JWK Set (bsc#1283071).\n- CVE-2026-102275: an attacker may use a stolen sender-constrained token without the legitimate private key\n (bsc#1283072).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLE-Micro-6.0-922",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_24134-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:24134-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202624134-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:24134-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202624134-1/"
},
{
"category": "self",
"summary": "SUSE Bug 1283060",
"url": "https://bugzilla.suse.com/1283060"
},
{
"category": "self",
"summary": "SUSE Bug 1283061",
"url": "https://bugzilla.suse.com/1283061"
},
{
"category": "self",
"summary": "SUSE Bug 1283064",
"url": "https://bugzilla.suse.com/1283064"
},
{
"category": "self",
"summary": "SUSE Bug 1283065",
"url": "https://bugzilla.suse.com/1283065"
},
{
"category": "self",
"summary": "SUSE Bug 1283066",
"url": "https://bugzilla.suse.com/1283066"
},
{
"category": "self",
"summary": "SUSE Bug 1283067",
"url": "https://bugzilla.suse.com/1283067"
},
{
"category": "self",
"summary": "SUSE Bug 1283068",
"url": "https://bugzilla.suse.com/1283068"
},
{
"category": "self",
"summary": "SUSE Bug 1283071",
"url": "https://bugzilla.suse.com/1283071"
},
{
"category": "self",
"summary": "SUSE Bug 1283072",
"url": "https://bugzilla.suse.com/1283072"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-101917 page",
"url": "https://www.suse.com/security/cve/CVE-2026-101917/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-101918 page",
"url": "https://www.suse.com/security/cve/CVE-2026-101918/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-102267 page",
"url": "https://www.suse.com/security/cve/CVE-2026-102267/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-102268 page",
"url": "https://www.suse.com/security/cve/CVE-2026-102268/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-102269 page",
"url": "https://www.suse.com/security/cve/CVE-2026-102269/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-102270 page",
"url": "https://www.suse.com/security/cve/CVE-2026-102270/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-102271 page",
"url": "https://www.suse.com/security/cve/CVE-2026-102271/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-102274 page",
"url": "https://www.suse.com/security/cve/CVE-2026-102274/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-102275 page",
"url": "https://www.suse.com/security/cve/CVE-2026-102275/"
}
],
"title": "Security update for python-PyJWT",
"tracking": {
"current_release_date": "2026-10-14T16:41:33Z",
"generator": {
"date": "2026-10-09T11:50:01Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:24134-1",
"initial_release_date": "2026-10-09T11:50:01Z",
"revision_history": [
{
"date": "2026-10-09T11:50:01Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-10-14T16:41:33Z",
"number": "2",
"summary": "unknown changes"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "python311-PyJWT-0:2.9.0-159998.1.1.noarch",
"product": {
"name": "python311-PyJWT-0:2.9.0-159998.1.1.noarch",
"product_id": "python311-PyJWT-0:2.9.0-159998.1.1.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:pyjwt_project:pyjwt:2.9.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/python311-PyJWT@2.9.0-159998.1.1?arch=noarch\u0026upstream=python-PyJWT-0:2.9.0-159998.1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.0",
"product": {
"name": "SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sl-micro:6.0"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-PyJWT-0:2.9.0-159998.1.1.noarch as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:python311-PyJWT-0:2.9.0-159998.1.1.noarch"
},
"product_reference": "python311-PyJWT-0:2.9.0-159998.1.1.noarch",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-101917",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-101917"
}
],
"notes": [
{
"category": "general",
"text": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or varying kid values absent from the cached JWKS. As a result, each cache miss causes PyJWKClient to refresh the JWKS. Consequently, attacker traffic can amplify outbound requests to the configured JWKS endpoint. This issue is fixed in version 2.14.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:python311-PyJWT-0:2.9.0-159998.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-101917",
"url": "https://www.suse.com/security/cve/CVE-2026-101917"
},
{
"category": "external",
"summary": "SUSE Bug 1283060 for CVE-2026-101917",
"url": "https://bugzilla.suse.com/1283060"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:python311-PyJWT-0:2.9.0-159998.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:python311-PyJWT-0:2.9.0-159998.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-09T11:50:01Z",
"details": "moderate"
}
],
"title": "CVE-2026-101917"
},
{
"cve": "CVE-2026-101918",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-101918"
}
],
"notes": [
{
"category": "general",
"text": "PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a result, documented PyJWT exception handling does not contain the failure. Consequently, an unauthenticated request can raise an exception that may produce an HTTP 500 response. The advisory-defined affected implementation also includes jwt/api_jwt.py, verify_signature=False. This issue is fixed in version 2.15.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:python311-PyJWT-0:2.9.0-159998.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-101918",
"url": "https://www.suse.com/security/cve/CVE-2026-101918"
},
{
"category": "external",
"summary": "SUSE Bug 1283061 for CVE-2026-101918",
"url": "https://bugzilla.suse.com/1283061"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:python311-PyJWT-0:2.9.0-159998.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:python311-PyJWT-0:2.9.0-159998.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-09T11:50:01Z",
"details": "moderate"
}
],
"title": "CVE-2026-101918"
},
{
"cve": "CVE-2026-102267",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-102267"
}
],
"notes": [
{
"category": "general",
"text": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:python311-PyJWT-0:2.9.0-159998.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-102267",
"url": "https://www.suse.com/security/cve/CVE-2026-102267"
},
{
"category": "external",
"summary": "SUSE Bug 1283064 for CVE-2026-102267",
"url": "https://bugzilla.suse.com/1283064"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:python311-PyJWT-0:2.9.0-159998.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:python311-PyJWT-0:2.9.0-159998.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-09T11:50:01Z",
"details": "important"
}
],
"title": "CVE-2026-102267"
},
{
"cve": "CVE-2026-102268",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-102268"
}
],
"notes": [
{
"category": "general",
"text": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a mutated public-key PEM as raw key bytes. As a result, HMACAlgorithm.prepare_key treats the unrecognized asymmetric public key as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:python311-PyJWT-0:2.9.0-159998.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-102268",
"url": "https://www.suse.com/security/cve/CVE-2026-102268"
},
{
"category": "external",
"summary": "SUSE Bug 1283065 for CVE-2026-102268",
"url": "https://bugzilla.suse.com/1283065"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:python311-PyJWT-0:2.9.0-159998.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:python311-PyJWT-0:2.9.0-159998.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-09T11:50:01Z",
"details": "important"
}
],
"title": "CVE-2026-102268"
},
{
"cve": "CVE-2026-102269",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-102269"
}
],
"notes": [
{
"category": "general",
"text": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation. This occurs when non-Base64URL characters are appended to a valid compact JWS signature segment. As a result, base64url_decode produces the same signature bytes for different serialized segments. Consequently, raw-token revocation checks can fail to recognize an equivalent modified token. This issue is fixed in version 2.14.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:python311-PyJWT-0:2.9.0-159998.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-102269",
"url": "https://www.suse.com/security/cve/CVE-2026-102269"
},
{
"category": "external",
"summary": "SUSE Bug 1283066 for CVE-2026-102269",
"url": "https://bugzilla.suse.com/1283066"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:python311-PyJWT-0:2.9.0-159998.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:python311-PyJWT-0:2.9.0-159998.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-09T11:50:01Z",
"details": "moderate"
}
],
"title": "CVE-2026-102269"
},
{
"cve": "CVE-2026-102270",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-102270"
}
],
"notes": [
{
"category": "general",
"text": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT is_pem_format is affected because lazy PEM regular expression backtracks extensively. This occurs when a certificate-like input contains repeated BEGIN markers without a matching END marker. As a result, is_pem_format performs unbounded backtracking while searching for a PEM end marker. Consequently, an attacker can cause intensive CPU consumption. This issue is fixed in version 2.14.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:python311-PyJWT-0:2.9.0-159998.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-102270",
"url": "https://www.suse.com/security/cve/CVE-2026-102270"
},
{
"category": "external",
"summary": "SUSE Bug 1283067 for CVE-2026-102270",
"url": "https://bugzilla.suse.com/1283067"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:python311-PyJWT-0:2.9.0-159998.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:python311-PyJWT-0:2.9.0-159998.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-09T11:50:01Z",
"details": "moderate"
}
],
"title": "CVE-2026-102270"
},
{
"cve": "CVE-2026-102271",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-102271"
}
],
"notes": [
{
"category": "general",
"text": "PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a DER public key as the shared verification key. As a result, PyJWT uses public DER bytes as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:python311-PyJWT-0:2.9.0-159998.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-102271",
"url": "https://www.suse.com/security/cve/CVE-2026-102271"
},
{
"category": "external",
"summary": "SUSE Bug 1283068 for CVE-2026-102271",
"url": "https://bugzilla.suse.com/1283068"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:python311-PyJWT-0:2.9.0-159998.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:python311-PyJWT-0:2.9.0-159998.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-09T11:50:01Z",
"details": "important"
}
],
"title": "CVE-2026-102271"
},
{
"cve": "CVE-2026-102274",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-102274"
}
],
"notes": [
{
"category": "general",
"text": "PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications can experience authentication failures or request-level denial of service. This issue is fixed in version 2.14.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:python311-PyJWT-0:2.9.0-159998.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-102274",
"url": "https://www.suse.com/security/cve/CVE-2026-102274"
},
{
"category": "external",
"summary": "SUSE Bug 1283071 for CVE-2026-102274",
"url": "https://bugzilla.suse.com/1283071"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:python311-PyJWT-0:2.9.0-159998.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:python311-PyJWT-0:2.9.0-159998.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-09T11:50:01Z",
"details": "moderate"
}
],
"title": "CVE-2026-102274"
},
{
"cve": "CVE-2026-102275",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-102275"
}
],
"notes": [
{
"category": "general",
"text": "PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components. As a result, identity derived from x can differ from operations performed with d. Consequently, if an integration also accepts private key parameters from a proof header without rejecting them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue is fixed in version 2.15.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:python311-PyJWT-0:2.9.0-159998.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-102275",
"url": "https://www.suse.com/security/cve/CVE-2026-102275"
},
{
"category": "external",
"summary": "SUSE Bug 1283072 for CVE-2026-102275",
"url": "https://bugzilla.suse.com/1283072"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:python311-PyJWT-0:2.9.0-159998.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:python311-PyJWT-0:2.9.0-159998.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-09T11:50:01Z",
"details": "moderate"
}
],
"title": "CVE-2026-102275"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.