This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-102274 →

UBUNTU-CVE-2026-102274

PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malform...

Original description

The description as published by the source.

PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications can experience authentication failures or request-level denial of service. This issue is fixed in version 2.14.0.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Ubuntu:22.04:LTS pyjwt

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:24.04:LTS pyjwt

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:26.10 pyjwt

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:26.04:LTS pyjwt

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

References

report ubuntu.com
report cve.org
report github.com
report github.com
report github.com