An update for python-jwt is now available for openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4,openEuler-20.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-3117 Final 1.0 1.0 2026-07-24 Initial 2026-07-24 2026-07-24 openEuler SA Tool V1.0 2026-07-24 python-jwt security update An update for python-jwt is now available for openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4,openEuler-20.03-LTS-SP4 rm -f tests/test_jwks_client.py -m pytest %endif Security Fix(es): PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.(CVE-2026-32597) An update for python-jwt is now available for openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4,openEuler-20.03-LTS-SP4. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High python-jwt https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3117 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-32597 https://nvd.nist.gov/vuln/detail/CVE-2026-32597 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 openEuler-24.03-LTS-SP4 openEuler-20.03-LTS-SP4 python-jwt-2.3.0-5.oe2203sp4.src.rpm python-jwt-2.8.0-3.oe2403sp1.src.rpm python-jwt-2.8.0-3.oe2403sp3.src.rpm python-jwt-2.8.0-3.oe2403sp4.src.rpm python-jwt-1.7.1-5.oe2003sp4.src.rpm python-jwt-help-2.3.0-5.oe2203sp4.noarch.rpm python3-jwt-2.3.0-5.oe2203sp4.noarch.rpm python-jwt-help-2.8.0-3.oe2403sp1.noarch.rpm python3-jwt-2.8.0-3.oe2403sp1.noarch.rpm python-jwt-help-2.8.0-3.oe2403sp3.noarch.rpm python3-jwt-2.8.0-3.oe2403sp3.noarch.rpm python-jwt-help-2.8.0-3.oe2403sp4.noarch.rpm python3-jwt-2.8.0-3.oe2403sp4.noarch.rpm python-jwt-help-1.7.1-5.oe2003sp4.noarch.rpm python2-jwt-1.7.1-5.oe2003sp4.noarch.rpm python3-jwt-1.7.1-5.oe2003sp4.noarch.rpm PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0. 2026-07-24 CVE-2026-32597 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 openEuler-24.03-LTS-SP4 openEuler-20.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N python-jwt security update 2026-07-24 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3117