SB20261022526 - openEuler 22.03 LTS SP4 update for python-jwt

Description

This security bulletin contains information about 4 vulnerabilities.

1) Uncaught Exception (CVE-ID: CVE-2026-101918)

CWE-ID: CWE-248 - Uncaught Exception

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an uncaught exception in PyJWT._decode_payload when parsing a recursively nested JWT payload before signature verification. A remote attacker can submit a JWT with a deeply nested payload to cause a denial of service.

2) Uncontrolled Recursion (CVE-ID: CVE-2026-102265)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in the PyJWS._load() header JSON parsing path when processing a compact token with a deeply nested JSON header. A remote attacker can send an unsigned crafted token to cause a denial of service.

The header is parsed before signature verification, and the resulting exception can bypass applications' normal PyJWT error handling.

3) Incorrect Behavior Order: Validate Before Canonicalize (CVE-ID: CVE-2026-102269)

CWE-ID: CWE-180 - Incorrect Behavior Order: Validate Before Canonicalize

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass token revocation controls.

The vulnerability exists due to incorrect behavior order: validate before canonicalize in compact JWS signature-segment decoding when processing a compact JWS with a non-canonical signature segment. A remote attacker can append non-Base64URL characters to a valid token's signature segment to bypass token revocation controls.

Exploitation requires an application to use the raw serialized token as the identity for revocation, replay, rate-limit, or cache state.

4) Insufficient verification of data authenticity (CVE-ID: CVE-2026-102275)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to use a stolen sender-constrained access token without possessing the legitimate holder's private key.

The vulnerability exists due to insufficient verification of data authenticity in OKP private JWK import handling in jwt/algorithms.py when processing a JWK whose x and d values belong to different key pairs. A remote attacker can supply a crafted private OKP JWK to use a stolen sender-constrained access token without possessing the legitimate holder's private key.

Exploitation requires a DPoP verifier that calculates a thumbprint from x, passes the complete JWK to PyJWT for signature verification, and does not reject private JWK parameters.

Remediation

Install update from vendor's website.

References

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-4454