OESA-2026-3117

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-3117
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2026-3117.json
JSON Data
https://api.osv.dev/v1/vulns/OESA-2026-3117
Upstream
Published
2026-07-24T03:26:14Z
Modified
2026-07-24T03:45:11.679850096Z
Summary
python-jwt security update
Details

rm -f tests/testjwksclient.py -m pytest %endif

Security Fix(es):

PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 ยง4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.(CVE-2026-32597)

Database specific 
{
    "severity": "High"
}
References

Affected packages

openEuler:20.03-LTS-SP4
python-jwt

Package

Name
python-jwt
Purl
pkg:rpm/openEuler/python-jwt&distro=openEuler-20.03-LTS-SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.7.1-5.oe2003sp4

Ecosystem specific 

{
    "src": [
        "python-jwt-1.7.1-5.oe2003sp4.src.rpm"
    ],
    "noarch": [
        "python-jwt-help-1.7.1-5.oe2003sp4.noarch.rpm",
        "python2-jwt-1.7.1-5.oe2003sp4.noarch.rpm",
        "python3-jwt-1.7.1-5.oe2003sp4.noarch.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-3117.json"
openEuler:22.03-LTS-SP4
python-jwt

Package

Name
python-jwt
Purl
pkg:rpm/openEuler/python-jwt&distro=openEuler-22.03-LTS-SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.3.0-5.oe2203sp4

Ecosystem specific 

{
    "src": [
        "python-jwt-2.3.0-5.oe2203sp4.src.rpm"
    ],
    "noarch": [
        "python-jwt-help-2.3.0-5.oe2203sp4.noarch.rpm",
        "python3-jwt-2.3.0-5.oe2203sp4.noarch.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-3117.json"
openEuler:24.03-LTS-SP1
python-jwt

Package

Name
python-jwt
Purl
pkg:rpm/openEuler/python-jwt&distro=openEuler-24.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.8.0-3.oe2403sp1

Ecosystem specific 

{
    "src": [
        "python-jwt-2.8.0-3.oe2403sp1.src.rpm"
    ],
    "noarch": [
        "python-jwt-help-2.8.0-3.oe2403sp1.noarch.rpm",
        "python3-jwt-2.8.0-3.oe2403sp1.noarch.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-3117.json"
openEuler:24.03-LTS-SP3
python-jwt

Package

Name
python-jwt
Purl
pkg:rpm/openEuler/python-jwt&distro=openEuler-24.03-LTS-SP3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.8.0-3.oe2403sp3

Ecosystem specific 

{
    "src": [
        "python-jwt-2.8.0-3.oe2403sp3.src.rpm"
    ],
    "noarch": [
        "python-jwt-help-2.8.0-3.oe2403sp3.noarch.rpm",
        "python3-jwt-2.8.0-3.oe2403sp3.noarch.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-3117.json"
openEuler:24.03-LTS-SP4
python-jwt

Package

Name
python-jwt
Purl
pkg:rpm/openEuler/python-jwt&distro=openEuler-24.03-LTS-SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.8.0-3.oe2403sp4

Ecosystem specific 

{
    "src": [
        "python-jwt-2.8.0-3.oe2403sp4.src.rpm"
    ],
    "noarch": [
        "python-jwt-help-2.8.0-3.oe2403sp4.noarch.rpm",
        "python3-jwt-2.8.0-3.oe2403sp4.noarch.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-3117.json"