SB2026110345 - openEuler 24.03 LTS SP4 update for python-jwt
Published: November 3, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 vulnerabilities.
1) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-101917)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service through excessive outbound JWKS requests and repeated parsing work.
The vulnerability exists due to resource allocation without throttling in PyJWT's PyJWKClient when processing unverified token headers containing unknown key identifiers. A remote attacker can submit tokens with unknown kid values to force repeated JWKS fetches, bypassing an otherwise valid cache and consuming server resources to cause a denial of service.
2) Uncaught Exception (CVE-ID: CVE-2026-101918)
CWE-ID: CWE-248 - Uncaught Exception
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an uncaught exception in PyJWT._decode_payload when parsing a recursively nested JWT payload before signature verification. A remote attacker can submit a JWT with a deeply nested payload to cause a denial of service.
3) Uncontrolled Recursion (CVE-ID: CVE-2026-102265)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in the PyJWS._load() header JSON parsing path when processing a compact token with a deeply nested JSON header. A remote attacker can send an unsigned crafted token to cause a denial of service.
The header is parsed before signature verification, and the resulting exception can bypass applications' normal PyJWT error handling.
4) Incorrect Behavior Order: Validate Before Canonicalize (CVE-ID: CVE-2026-102269)
CWE-ID: CWE-180 - Incorrect Behavior Order: Validate Before Canonicalize
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass token revocation controls.
The vulnerability exists due to incorrect behavior order: validate before canonicalize in compact JWS signature-segment decoding when processing a compact JWS with a non-canonical signature segment. A remote attacker can append non-Base64URL characters to a valid token's signature segment to bypass token revocation controls.
Exploitation requires an application to use the raw serialized token as the identity for revocation, replay, rate-limit, or cache state.
5) Insufficient verification of data authenticity (CVE-ID: CVE-2026-102275)
CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity
CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to use a stolen sender-constrained access token without possessing the legitimate holder's private key.
The vulnerability exists due to insufficient verification of data authenticity in OKP private JWK import handling in jwt/algorithms.py when processing a JWK whose x and d values belong to different key pairs. A remote attacker can supply a crafted private OKP JWK to use a stolen sender-constrained access token without possessing the legitimate holder's private key.
Exploitation requires a DPoP verifier that calculates a thumbprint from x, passes the complete JWK to PyJWT for signature verification, and does not reject private JWK parameters.
Remediation
Install update from vendor's website.