This update for python-PyJWT fixes the following issues:
- CVE-2026-101917: attacker traffic can amplify outbound requests to the configured JWKS endpoint (bsc#1283060).
- CVE-2026-101918: unauthenticated request can raise an exception that may produce an HTTP 500 response (bsc#1283061).
- CVE-2026-102267: forwarded credentials may be disclosed or verification keys may be substituted (bsc#1283064).
- CVE-2026-102268: an attacker who knows the public key can forge authenticated HMAC tokens (bsc#1283065).
- CVE-2026-102269: raw-token revocation checks can fail to recognize an equivalent modified token (bsc#1283066).
- CVE-2026-102270: an attac
This update for python-PyJWT fixes the following issues
- CVE-2026-48522: `PyJWKClient` passes URI arguments directly to `urllib.request.urlopen()` and allows for SSRF and
token forgery (bsc#1266798).
- CVE-2026-48523: verifier-side algorithm allow-list bypass when `jwt.decode()` or `jwt.decode_complete()` are called
with a PyJWK key (bsc#1266799).
- CVE-2026-48524: unlimited processing of JWTs with unknown kid values by `PyJWKClient.get_signing_key()` leads to
unbounded JWKS endpoint requests and DoS (bsc#1266800).
- CVE-2026-48525: unbounded Base64URL decoding of unused payload segment in `b64=false` detached JWS allows for DoS
(bs
This update for python-PyJWT fixes the following issues:
Update to PyJWT 2.12.1:
- CVE-2024-53861: prevent partial matching of the Issuer field (bsc#1234038).
- CVE-2026-32597: validate the crit Header Parameter defined in RFC 7515 (bsc#1259616).
Changelog:
Update to 2.12.1:
- Add missing typing_extensions dependency for Python < 3.11 in
#1150
Update to 2.12.0:
- Annotate PyJWKSet.keys for pyright by @tamird in #1134
- Close HTTPError response to prevent ResourceWarning on
Python 3.14 by @veeceey in #1133
- Do not keep algorithms dict in PyJWK instances by @akx in
#1143
- Use PyJWK algorithm when encoding without explic