USN-8934-1

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/notices/USN-8934-1
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8934-1.json
JSON Data
https://api.osv.dev/v1/vulns/USN-8934-1
Upstream
CVE (4)
Published
2026-10-19T19:00:51Z
Modified
2026-10-20T10:58:22Z
Summary
pyjwt vulnerabilities
Details

Kingsley Olukanni discovered that PyJWT did not properly handle unknown key identifiers when retrieving signing keys. An attacker could possibly use this issue to amplify requests to the configured key endpoint, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. (CVE-2026-101917)

Ekalabya Ghosh discovered that PyJWT did not properly handle certain recursively nested JSON payloads. An attacker could possibly use this issue to cause an application to fail, resulting in a denial of service. (CVE-2026-101918)

Pedram Hayati discovered that PyJWT did not properly handle malformed RSA keys in a JSON Web Key Set. An attacker could possibly use this issue to cause authentication failures or a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. (CVE-2026-102274)

It was discovered that PyJWT did not properly validate certain OKP private key components. An attacker could possibly use this issue to confuse the identity of public and private keys, and use a stolen sender-constrained token without the legitimate private key. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. (CVE-2026-102275)

References

Affected packages

Ubuntu:22.04:LTS
pyjwt

Package

Name
pyjwt
Purl
pkg:deb/ubuntu/pyjwt?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.3.0-1ubuntu0.6

Affected versions

1.*
1.7.1-2ubuntu2
2.*
2.1.0-1
2.3.0-1
2.3.0-1ubuntu0.1
2.3.0-1ubuntu0.2
2.3.0-1ubuntu0.3
2.3.0-1ubuntu0.4
2.3.0-1ubuntu0.5

Ecosystem specific 

{
    "availability":  "No subscription required",
    "binaries":  [
        {
            "binary_name":  "python3-jwt",
            "binary_version":  "2.3.0-1ubuntu0.6"
        }
    ]
}

Database specific

cves_map 
{
    "cves":  [],
    "ecosystem":  "Ubuntu:22.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8934-1.json"
Ubuntu:24.04:LTS
pyjwt

Package

Name
pyjwt
Purl
pkg:deb/ubuntu/pyjwt?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.7.0-1ubuntu0.4

Affected versions

2.*
2.7.0-1
2.7.0-1ubuntu0.1
2.7.0-1ubuntu0.2
2.7.0-1ubuntu0.3

Ecosystem specific 

{
    "availability":  "No subscription required",
    "binaries":  [
        {
            "binary_name":  "python3-jwt",
            "binary_version":  "2.7.0-1ubuntu0.4"
        }
    ]
}

Database specific

cves_map 
{
    "cves":  [],
    "ecosystem":  "Ubuntu:24.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8934-1.json"
Ubuntu:26.04:LTS
pyjwt

Package

Name
pyjwt
Purl
pkg:deb/ubuntu/pyjwt?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.10.1-4ubuntu1.3

Affected versions

2.*
2.10.1-2
2.10.1-3
2.10.1-3build1
2.10.1-4
2.10.1-4ubuntu1
2.10.1-4ubuntu1.1
2.10.1-4ubuntu1.2

Ecosystem specific 

{
    "availability":  "No subscription required",
    "binaries":  [
        {
            "binary_name":  "python3-jwt",
            "binary_version":  "2.10.1-4ubuntu1.3"
        }
    ]
}

Database specific

cves_map 
{
    "cves":  [],
    "ecosystem":  "Ubuntu:26.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8934-1.json"
Ubuntu:26.10
pyjwt

Package

Name
pyjwt
Purl
pkg:deb/ubuntu/pyjwt?arch=source&distro=stonking

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.13.0-1ubuntu1.1

Affected versions

2.*
2.10.1-4ubuntu1
2.12.1-1
2.13.0-1
2.13.0-1ubuntu1

Ecosystem specific 

{
    "availability":  "No subscription required",
    "binaries":  [
        {
            "binary_name":  "python3-jwt",
            "binary_version":  "2.13.0-1ubuntu1.1"
        }
    ]
}

Database specific

cves_map 
{
    "cves":  [],
    "ecosystem":  "Ubuntu:26.10"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8934-1.json"
Ubuntu:Pro:16.04:LTS
pyjwt

Package

Name
pyjwt
Purl
pkg:deb/ubuntu/pyjwt?arch=source&distro=esm-infra-legacy%2Fxenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.3.0-1ubuntu0.1+esm4

Affected versions

1.*
1.0.0-0ubuntu1
1.3.0-1
1.3.0-1ubuntu0.1
1.3.0-1ubuntu0.1+esm1
1.3.0-1ubuntu0.1+esm2
1.3.0-1ubuntu0.1+esm3

Ecosystem specific 

{
    "availability":  "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
    "binaries":  [
        {
            "binary_name":  "python-jwt",
            "binary_version":  "1.3.0-1ubuntu0.1+esm4"
        },
        {
            "binary_name":  "python3-jwt",
            "binary_version":  "1.3.0-1ubuntu0.1+esm4"
        }
    ]
}

Database specific

cves_map 
{
    "cves":  [],
    "ecosystem":  "Ubuntu:Pro:16.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8934-1.json"
Ubuntu:Pro:18.04:LTS
pyjwt

Package

Name
pyjwt
Purl
pkg:deb/ubuntu/pyjwt?arch=source&distro=esm-infra%2Fbionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.5.3+ds1-1ubuntu0.1+esm4

Affected versions

1.*
1.4.2-1.1
1.5.3+ds1-1
1.5.3+ds1-1ubuntu0.1
1.5.3+ds1-1ubuntu0.1+esm1
1.5.3+ds1-1ubuntu0.1+esm2
1.5.3+ds1-1ubuntu0.1+esm3

Ecosystem specific 

{
    "availability":  "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "binaries":  [
        {
            "binary_name":  "python-jwt",
            "binary_version":  "1.5.3+ds1-1ubuntu0.1+esm4"
        },
        {
            "binary_name":  "python3-jwt",
            "binary_version":  "1.5.3+ds1-1ubuntu0.1+esm4"
        }
    ]
}

Database specific

cves_map 
{
    "cves":  [],
    "ecosystem":  "Ubuntu:Pro:18.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8934-1.json"
Ubuntu:Pro:20.04:LTS
pyjwt

Package

Name
pyjwt
Purl
pkg:deb/ubuntu/pyjwt?arch=source&distro=esm-infra%2Ffocal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.7.1-2ubuntu2.1+esm4

Affected versions

1.*
1.7.0-2
1.7.1-1
1.7.1-2ubuntu1
1.7.1-2ubuntu2
1.7.1-2ubuntu2.1
1.7.1-2ubuntu2.1+esm1
1.7.1-2ubuntu2.1+esm2
1.7.1-2ubuntu2.1+esm3

Ecosystem specific 

{
    "availability":  "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "binaries":  [
        {
            "binary_name":  "python3-jwt",
            "binary_version":  "1.7.1-2ubuntu2.1+esm4"
        }
    ]
}

Database specific

cves_map 
{
    "cves":  [],
    "ecosystem":  "Ubuntu:Pro:20.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8934-1.json"