SUSE-SU-2026:24377-1

SUSE-SU-2026:24377-1 · Security update for python-PyJWT

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This update for python-PyJWT fixes the following issues: - CVE-2026-101917: attacker traffic can amplify outbound requests to the configured JWKS endpoint (bsc#1283060). - CVE-2026-101918: unauthenticated request can raise an exception that may produce an HTTP 500 response (bsc#1283061). - CVE-2026-102267: forwarded credentials may be disclosed or verification keys may be substituted (bsc#1283064). - CVE-2026-102268: an attacker who knows the public key can forge authenticated HMAC tokens (bsc#1283065). - CVE-2026-102269: raw-token revocation checks can fail to recognize an equivalent modified token (bsc#1283066). - CVE-2026-102270: an attacker can cause intensive CPU consumption (bsc#1283067). - CVE-2026-102271: an attacker who knows the public key can forge authenticated HMAC tokens (bsc#1283068). - CVE-2026-102274: Malformed RSA JWK aborts parsing of an entire JWK Set (bsc#1283071). - CVE-2026-102275: an attacker may use a stolen sender-constrained token without the legitimate private key (bsc#1283072). - CVE-2026-103001: reused mutable options mapping can cause verification checks bypass on subsequent decode calls (bsc#1283829).

Fix available

Published

2026-10-20T15:12:20Z

Updated

2026-10-27T17:23:19.403372208Z

Stack: system

Check your server →