openSUSE-SU-2026:21095-1

Import Source

JSON Data

https://api.test.osv.dev/v1/vulns/openSUSE-SU-2026:21095-1

Upstream

CVE (5)

Related

CVE (5)

Published

2026-06-19T05:43:05Z

Modified

2026-06-30T18:24:51Z

Summary

Security update for python-PyJWT

Details

This update for python-PyJWT fixes the following issues

CVE-2026-48522: PyJWKClient passes URI arguments directly to urllib.request.urlopen() and allows for SSRF and token forgery (bsc#1266798).
CVE-2026-48523: verifier-side algorithm allow-list bypass when jwt.decode() or jwt.decode_complete() are called with a PyJWK key (bsc#1266799).
CVE-2026-48524: unlimited processing of JWTs with unknown kid values by PyJWKClient.get_signing_key() leads to unbounded JWKS endpoint requests and DoS (bsc#1266800).
CVE-2026-48525: unbounded Base64URL decoding of unused payload segment in b64=false detached JWS allows for DoS (bsc#1266801).
CVE-2026-48526: no validation of use of JSON Web Keys in HMAC algorithm when decoding JSON Web Tokens allows for forged HS256 tokens (bsc#1266802).

References

Affected packages

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.12.1-160000.2.1

{
    "binaries":  [
        {
            "python313-PyJWT":  "2.12.1-160000.2.1"
        }
    ]
}

source

"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21095-1.json"