This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-102274 →

DEBIAN-CVE-2026-102274

PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malform...

Original description

The description as published by the source.

PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications can experience authentication failures or request-level denial of service. This issue is fixed in version 2.14.0.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 pyjwt

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 pyjwt

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 pyjwt

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.0-1"}]}]

References

advisory security-tracker.debian.org