SB2026110399 - Ubuntu update for pyjwt
Published: November 3, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-101917)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service through excessive outbound JWKS requests and repeated parsing work.
The vulnerability exists due to resource allocation without throttling in PyJWT's PyJWKClient when processing unverified token headers containing unknown key identifiers. A remote attacker can submit tokens with unknown kid values to force repeated JWKS fetches, bypassing an otherwise valid cache and consuming server resources to cause a denial of service.
2) Uncaught Exception (CVE-ID: CVE-2026-101918)
CWE-ID: CWE-248 - Uncaught Exception
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an uncaught exception in PyJWT._decode_payload when parsing a recursively nested JWT payload before signature verification. A remote attacker can submit a JWT with a deeply nested payload to cause a denial of service.
3) Improper handling of exceptional conditions (CVE-ID: CVE-2026-102274)
CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper handling of exceptional conditions in PyJWKSet and RSAAlgorithm.from_jwk when parsing a JWK Set containing a malformed RSA private key. A remote attacker can provide a JWK Set containing an RSA key with an invalid private exponent to cause a denial of service.
4) Insufficient verification of data authenticity (CVE-ID: CVE-2026-102275)
CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity
CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to use a stolen sender-constrained access token without possessing the legitimate holder's private key.
The vulnerability exists due to insufficient verification of data authenticity in OKP private JWK import handling in jwt/algorithms.py when processing a JWK whose x and d values belong to different key pairs. A remote attacker can supply a crafted private OKP JWK to use a stolen sender-constrained access token without possessing the legitimate holder's private key.
Exploitation requires a DPoP verifier that calculates a thumbprint from x, passes the complete JWK to PyJWT for signature verification, and does not reject private JWK parameters.
Remediation
Install update from vendor's website.