Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
GHSA-x33g-cr3x-6449
  • PyPI/pyjwt
 PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity... 05 Oct
  • Fix available
  • Severity - 6.5 (Medium)
PYSEC-2026-4146
  • PyPI/pyjwt
 PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse 01 Oct
  • No fix available
  • Severity - 6.5 (Medium)
PYSEC-2026-4141
  • PyPI/pyjwt
 PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False) 01 Oct
  • Fix available
  • Severity - 5.3 (Medium)
PYSEC-2026-4148
  • PyPI/pyjwt
 PyJWT: ReDoS vulnerability when calling the `is_pem_format` function. 01 Oct
  • Fix available
  • Severity - 4.4 (Medium)
PYSEC-2026-4143
  • PyPI/pyjwt
 PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation 01 Oct
  • Fix available
  • Severity - 7.4 (High)
PYSEC-2026-4142
  • PyPI/pyjwt
 PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header 01 Oct
  • Fix available
  • Severity - 5.3 (Medium)
PYSEC-2026-4147
  • PyPI/pyjwt
 PyJWT: Non-canonical signature segments enable raw-token revocation bypass 01 Oct
  • Fix available
  • Severity - 4.8 (Medium)
PYSEC-2026-4145
  • PyPI/pyjwt
 PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard 01 Oct
  • Fix available
  • Severity - 9.1 (Critical)
PYSEC-2026-4151
  • PyPI/pyjwt
 PyJWT accepts public JWK containers as HMAC secrets 01 Oct
  • Fix available
  • Severity - 7.4 (High)
PYSEC-2026-4144
  • PyPI/pyjwt
 PyJWT: PyJWKClient follows redirects when fetching JWKS 01 Oct
  • Fix available
  • Severity - 7.4 (High)
PYSEC-2026-4149
  • PyPI/pyjwt
 PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard 01 Oct
  • Fix available
  • Severity - 7.4 (High)
PYSEC-2026-4150
  • PyPI/pyjwt
 PyJWT BOM Bypass 01 Oct
  • Fix available
  • Severity - 7.4 (High)
PYSEC-2026-4140
  • PyPI/pyjwt
 PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524) 01 Oct
  • Fix available
  • Severity - 5.3 (Medium)
PYSEC-2026-4152
  • PyPI/pyjwt
 PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set 01 Oct
  • Fix available
  • Severity - 5.9 (Medium)
GHSA-gvp8-978c-rx2q
  • PyPI/pyjwt
 PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse 30 Sep
  • No fix available
  • Severity - 6.5 (Medium)
GHSA-42vr-xj54-vc7v
  • PyPI/pyjwt
 PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False) 30 Sep
  • Fix available
  • Severity - 5.3 (Medium)
Load more...