Cette page suit l'état du correctif pour Ubuntu. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2026-102274 →

UBUNTU-CVE-2026-102274

PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malform...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications can experience authentication failures or request-level denial of service. This issue is fixed in version 2.14.0.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Ubuntu:22.04:LTS pyjwt

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:24.04:LTS pyjwt

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:26.10 pyjwt

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:26.04:LTS pyjwt

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Références

report ubuntu.com
report cve.org
report github.com
report github.com
report github.com