SB2026110448 - SUSE update for python-PyJWT
Published: November 4, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 vulnerabilities.
1) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-101917)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service through excessive outbound JWKS requests and repeated parsing work.
The vulnerability exists due to resource allocation without throttling in PyJWT's PyJWKClient when processing unverified token headers containing unknown key identifiers. A remote attacker can submit tokens with unknown kid values to force repeated JWKS fetches, bypassing an otherwise valid cache and consuming server resources to cause a denial of service.
2) Uncaught Exception (CVE-ID: CVE-2026-101918)
CWE-ID: CWE-248 - Uncaught Exception
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an uncaught exception in PyJWT._decode_payload when parsing a recursively nested JWT payload before signature verification. A remote attacker can submit a JWT with a deeply nested payload to cause a denial of service.
3) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-102267)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive request headers and cause forged JWT acceptance.
The vulnerability exists due to improper validation of redirect destinations in PyJWKClient when fetching JWKS from an attacker-influenced configured endpoint. A remote attacker can cause the endpoint to return a redirect to a different host to disclose sensitive request headers and cause forged JWT acceptance.
A token kid alone does not trigger the issue.
4) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-102268)
CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to forge arbitrary-claim tokens.
The vulnerability exists due to improper verification of cryptographic signatures in HMACAlgorithm.prepare_key and is_pem_format when processing a loader-accepted PEM public key that is not recognized as PEM under a mixed algorithm allow-list. A remote attacker can sign an HS256 token using the public key as an HMAC secret to forge arbitrary-claim tokens.
Exploitation requires knowledge of the public verification key, cryptography to be installed, and use of the raw PEM non-PyJWK verification path.
5) Incorrect Behavior Order: Validate Before Canonicalize (CVE-ID: CVE-2026-102269)
CWE-ID: CWE-180 - Incorrect Behavior Order: Validate Before Canonicalize
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass token revocation controls.
The vulnerability exists due to incorrect behavior order: validate before canonicalize in compact JWS signature-segment decoding when processing a compact JWS with a non-canonical signature segment. A remote attacker can append non-Base64URL characters to a valid token's signature segment to bypass token revocation controls.
Exploitation requires an application to use the raw serialized token as the identity for revocation, replay, rate-limit, or cache state.
6) Inefficient regular expression complexity (CVE-ID: CVE-2026-102270)
CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity
CVSSv4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote privileged user to cause a denial of service through excessive CPU consumption.
The vulnerability exists due to inefficient regular expression complexity in PyJWT's is_pem_format function when processing attacker-controlled key or certificate bytes during key preparation. A remote privileged user can supply malformed PEM-like input containing repeated -----BEGIN CERTIFICATE----- lines without a matching end marker to trigger repeated regular expression rescans with quadratic runtime and exhaust CPU resources.
7) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-102271)
CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature
CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to forge authentication tokens with arbitrary claims.
The vulnerability exists due to improper verification of cryptographic signatures in HMACAlgorithm.prepare_key when verifying tokens with DER-form asymmetric public keys while HMAC and asymmetric algorithms are enabled. A remote attacker can submit a forged HMAC-signed token to forge authentication tokens with arbitrary claims.
The issue does not affect PyJWK or PyJWKClient verification paths.
8) Insufficient verification of data authenticity (CVE-ID: CVE-2026-102275)
CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity
CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to use a stolen sender-constrained access token without possessing the legitimate holder's private key.
The vulnerability exists due to insufficient verification of data authenticity in OKP private JWK import handling in jwt/algorithms.py when processing a JWK whose x and d values belong to different key pairs. A remote attacker can supply a crafted private OKP JWK to use a stolen sender-constrained access token without possessing the legitimate holder's private key.
Exploitation requires a DPoP verifier that calculates a thumbprint from x, passes the complete JWK to PyJWT for signature verification, and does not reject private JWK parameters.
Remediation
Install update from vendor's website.