{"schema_version":"1.7.2","id":"OESA-2026-4454","modified":"2026-10-22T14:35:19Z","published":"2026-10-22T14:35:19Z","upstream":["CVE-2026-101918","CVE-2026-102265","CVE-2026-102269","CVE-2026-102275"],"summary":"python-jwt security update","details":"setup.py test %endif\r\n\r\nSecurity Fix(es):\n\nPyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a result, documented PyJWT exception handling does not contain the failure. Consequently, an unauthenticated request can raise an exception that may produce an HTTP 500 response. The advisory-defined affected implementation also includes jwt/api_jwt.py, verify_signature=False. This issue is fixed in version 2.15.0.(CVE-2026-101918)\n\nPyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS._load in jwt/api_jws.py is affected because parser catches ValueError but not RecursionError. This occurs when a deeply nested token header reaches json.loads. As a result, RecursionError escapes the documented PyJWT error hierarchy. Consequently, an unauthenticated malformed token can cause a request-level failure and HTTP 500. This issue is fixed in version 2.14.0.(CVE-2026-102265)\n\nPyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation. This occurs when non-Base64URL characters are appended to a valid compact JWS signature segment. As a result, base64url_decode produces the same signature bytes for different serialized segments. Consequently, raw-token revocation checks can fail to recognize an equivalent modified token. This issue is fixed in version 2.14.0.(CVE-2026-102269)\n\nPyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in  jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components. As a result, identity derived from x can differ from operations performed with d. Consequently, if an integration also accepts private key parameters from a proof header without rejecting them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue is fixed in version 2.15.0.(CVE-2026-102275)","affected":[{"package":{"ecosystem":"openEuler:22.03-LTS-SP4","name":"python-jwt","purl":"pkg:rpm/openEuler/python-jwt&distro=openEuler-22.03-LTS-SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-12.oe2203sp4"}]}],"ecosystem_specific":{"noarch":["python-jwt-help-2.3.0-12.oe2203sp4.noarch.rpm","python3-jwt-2.3.0-12.oe2203sp4.noarch.rpm"],"src":["python-jwt-2.3.0-12.oe2203sp4.src.rpm"]}}],"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4454"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101918"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102265"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102269"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102275"}],"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N"}],"database_specific":{"severity":"Medium"}}