{"id":"USN-8934-1","summary":"pyjwt vulnerabilities","details":"Kingsley Olukanni discovered that PyJWT did not properly handle unknown key\nidentifiers when retrieving signing keys. An attacker could possibly use\nthis issue to amplify requests to the configured key endpoint, resulting in\na denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu\n24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. (CVE-2026-101917)\n\nEkalabya Ghosh discovered that PyJWT did not properly handle certain\nrecursively nested JSON payloads. An attacker could possibly use this issue\nto cause an application to fail, resulting in a denial of service.\n(CVE-2026-101918)\n\nPedram Hayati discovered that PyJWT did not properly handle malformed RSA\nkeys in a JSON Web Key Set. An attacker could possibly use this issue to\ncause authentication failures or a denial of service. This issue only\naffected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS,  Ubuntu 26.04 LTS and Ubuntu\n26.10. (CVE-2026-102274)\n\nIt was discovered that PyJWT did not properly validate certain OKP private\nkey components. An attacker could possibly use this issue to confuse the\nidentity of public and private keys, and use a stolen sender-constrained\ntoken without the legitimate private key. This issue only affected Ubuntu\n22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10.\n(CVE-2026-102275)","modified":"2026-10-20T10:58:22.607251955Z","published":"2026-10-19T19:00:51Z","upstream":["CVE-2026-101917","CVE-2026-101918","CVE-2026-102274","CVE-2026-102275","UBUNTU-CVE-2026-101917","UBUNTU-CVE-2026-101918","UBUNTU-CVE-2026-102274","UBUNTU-CVE-2026-102275"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-8934-1"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-101917"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-101918"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-102274"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-102275"}],"affected":[{"package":{"name":"pyjwt","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/pyjwt?arch=source&distro=esm-infra-legacy%2Fxenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-1ubuntu0.1+esm4"}]}],"versions":["1.0.0-0ubuntu1","1.3.0-1","1.3.0-1ubuntu0.1","1.3.0-1ubuntu0.1+esm1","1.3.0-1ubuntu0.1+esm2","1.3.0-1ubuntu0.1+esm3"],"ecosystem_specific":{"binaries":[{"binary_version":"1.3.0-1ubuntu0.1+esm4","binary_name":"python-jwt"},{"binary_name":"python3-jwt","binary_version":"1.3.0-1ubuntu0.1+esm4"}],"availability":"Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro"},"database_specific":{"cves_map":{"cves":[],"ecosystem":"Ubuntu:Pro:16.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8934-1.json"}},{"package":{"name":"pyjwt","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/pyjwt?arch=source&distro=esm-infra%2Fbionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3+ds1-1ubuntu0.1+esm4"}]}],"versions":["1.4.2-1.1","1.5.3+ds1-1","1.5.3+ds1-1ubuntu0.1","1.5.3+ds1-1ubuntu0.1+esm1","1.5.3+ds1-1ubuntu0.1+esm2","1.5.3+ds1-1ubuntu0.1+esm3"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro","binaries":[{"binary_version":"1.5.3+ds1-1ubuntu0.1+esm4","binary_name":"python-jwt"},{"binary_version":"1.5.3+ds1-1ubuntu0.1+esm4","binary_name":"python3-jwt"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8934-1.json","cves_map":{"cves":[],"ecosystem":"Ubuntu:Pro:18.04:LTS"}}},{"package":{"name":"pyjwt","ecosystem":"Ubuntu:Pro:20.04:LTS","purl":"pkg:deb/ubuntu/pyjwt?arch=source&distro=esm-infra%2Ffocal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-2ubuntu2.1+esm4"}]}],"versions":["1.7.0-2","1.7.1-1","1.7.1-2ubuntu1","1.7.1-2ubuntu2","1.7.1-2ubuntu2.1","1.7.1-2ubuntu2.1+esm1","1.7.1-2ubuntu2.1+esm2","1.7.1-2ubuntu2.1+esm3"],"ecosystem_specific":{"binaries":[{"binary_name":"python3-jwt","binary_version":"1.7.1-2ubuntu2.1+esm4"}],"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:Pro:20.04:LTS","cves":[]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8934-1.json"}},{"package":{"name":"pyjwt","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/pyjwt?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-1ubuntu0.6"}]}],"versions":["1.7.1-2ubuntu2","2.1.0-1","2.3.0-1","2.3.0-1ubuntu0.1","2.3.0-1ubuntu0.2","2.3.0-1ubuntu0.3","2.3.0-1ubuntu0.4","2.3.0-1ubuntu0.5"],"ecosystem_specific":{"binaries":[{"binary_version":"2.3.0-1ubuntu0.6","binary_name":"python3-jwt"}],"availability":"No subscription required"},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:22.04:LTS","cves":[]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8934-1.json"}},{"package":{"name":"pyjwt","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/pyjwt?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-1ubuntu0.4"}]}],"versions":["2.7.0-1","2.7.0-1ubuntu0.1","2.7.0-1ubuntu0.2","2.7.0-1ubuntu0.3"],"ecosystem_specific":{"binaries":[{"binary_version":"2.7.0-1ubuntu0.4","binary_name":"python3-jwt"}],"availability":"No subscription required"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8934-1.json","cves_map":{"cves":[],"ecosystem":"Ubuntu:24.04:LTS"}}},{"package":{"name":"pyjwt","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/pyjwt?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.0-1ubuntu1.1"}]}],"versions":["2.10.1-4ubuntu1","2.12.1-1","2.13.0-1","2.13.0-1ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_version":"2.13.0-1ubuntu1.1","binary_name":"python3-jwt"}],"availability":"No subscription required"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8934-1.json","cves_map":{"ecosystem":"Ubuntu:26.10","cves":[]}}},{"package":{"name":"pyjwt","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/pyjwt?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.1-4ubuntu1.3"}]}],"versions":["2.10.1-2","2.10.1-3","2.10.1-3build1","2.10.1-4","2.10.1-4ubuntu1","2.10.1-4ubuntu1.1","2.10.1-4ubuntu1.2"],"ecosystem_specific":{"binaries":[{"binary_name":"python3-jwt","binary_version":"2.10.1-4ubuntu1.3"}],"availability":"No subscription required"},"database_specific":{"cves_map":{"cves":[],"ecosystem":"Ubuntu:26.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8934-1.json"}}],"schema_version":"1.9.0"}