p PatchFirst

CVE-2026-32597

CVE-2026-32597 · PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.

CVSS 7.5 · High · EPSS 0.3% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • pyjwt

    Versions
    • < 2.12.0: Affected

    No fix published

  • pyjwt Debian:12

    Versions
    • 2.6.0-1
    Affected ranges
    • ECOSYSTEM: < 2.6.0-1+deb12u1

    Update to 2.6.0-1+deb12u1

  • pyjwt Debian:13

    Versions
    • 2.10.1-2
    Affected ranges
    • ECOSYSTEM: < 2.10.1-2+deb13u1

    Update to 2.10.1-2+deb13u1

  • pyjwt Debian:14

    Versions
    • 2.10.1-2
    • 2.10.1-3
    • 2.10.1-4
    • 2.11.0-2
    Affected ranges
    • ECOSYSTEM: < 2.12.1-1

    Update to 2.12.1-1

  • pyjwt PyPI

    Versions
    • 0.1.1
    • 0.1.2
    • 0.1.3
    • 0.1.4
    • 0.1.5
    • 0.1.6
    • 0.1.7
    • 0.1.8
    • 0.1.9
    • 0.2.0
    • 0.2.1
    • 0.2.3
    • 0.3.0
    • 0.3.1
    • 0.3.2
    • 0.4.0
    • 0.4.1
    • 0.4.2
    • 0.4.3
    • 1.0.0
    • 1.0.1
    • 1.1.0
    • 1.3.0
    • 1.4.0
    • 1.4.1
    • 1.4.2
    • 1.5.0
    • 1.5.1
    • 1.5.2
    • 1.5.3
    • 1.6.0
    • 1.6.1
    • 1.6.3
    • 1.6.4
    • 1.7.0
    • 1.7.1
    • 2.0.0
    • 2.0.0a1
    • 2.0.0a2
    • 2.0.1
    • 2.1.0
    • 2.10.0
    • 2.10.1
    • 2.11.0
    • 2.2.0
    • 2.3.0
    • 2.4.0
    • 2.5.0
    • 2.6.0
    • 2.7.0
    • 2.8.0
    • 2.9.0
    Affected ranges
    • ECOSYSTEM: < 2.12.0

    Update to 2.12.0

  • pyjwt Ubuntu:Pro:16.04:LTS

    Versions
    • 1.0.0-0ubuntu1
    • 1.3.0-1
    • 1.3.0-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: < 1.3.0-1ubuntu0.1+esm1

    Update to 1.3.0-1ubuntu0.1+esm1

  • pyjwt Ubuntu:Pro:18.04:LTS

    Versions
    • 1.4.2-1.1
    • 1.5.3+ds1-1
    • 1.5.3+ds1-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: < 1.5.3+ds1-1ubuntu0.1+esm1

    Update to 1.5.3+ds1-1ubuntu0.1+esm1

  • pyjwt Ubuntu:Pro:20.04:LTS

    Versions
    • 1.7.0-2
    • 1.7.1-1
    • 1.7.1-2ubuntu1
    • 1.7.1-2ubuntu2
    • 1.7.1-2ubuntu2.1
    Affected ranges
    • ECOSYSTEM: < 1.7.1-2ubuntu2.1+esm1

    Update to 1.7.1-2ubuntu2.1+esm1

  • pyjwt Ubuntu:22.04:LTS

    Versions
    • 1.7.1-2ubuntu2
    • 2.1.0-1
    • 2.3.0-1
    • 2.3.0-1ubuntu0.1
    • 2.3.0-1ubuntu0.2
    Affected ranges
    • ECOSYSTEM: < 2.3.0-1ubuntu0.3

    Update to 2.3.0-1ubuntu0.3

  • pyjwt Ubuntu:24.04:LTS

    Versions
    • 2.7.0-1
    Affected ranges
    • ECOSYSTEM: < 2.7.0-1ubuntu0.1

    Update to 2.7.0-1ubuntu0.1

  • pyjwt Ubuntu:25.10

    Versions
    • 2.10.1-2
    Affected ranges
    • ECOSYSTEM: < 2.10.1-2ubuntu0.1

    Update to 2.10.1-2ubuntu0.1

Original sources

Check your server →