Read the docs
TI-2026-25107 Aliases CVE-2026-32597GHSA-752w-5fwx-jx9f

PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

Priority HIGH 72CWE-345Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 36 fixed, 8 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-345.

Summary

PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00299 22nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial pyjwt (jpadilla): 2.12.0PyJWT (PyPI): 2.12.0Red Hat: 35 advisoriesRed Hat: 36 fixed, 8 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
jpadillapyjwtbefore 2.12.02.12.0Patch availableCNA
—PyJWT (PyPI)before 2.12.02.12.0Patch availableGHSA-752w-5fwx-jx9f
  • pyjwt Vendorjpadilla Affected before 2.12.0 Fixed in 2.12.0 Patch available CNA
  • PyJWT (PyPI) Vendor— Affected before 2.12.0 Fixed in 2.12.0 Patch available GHSA-752w-5fwx-jx9f

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pyjwt_project:pyjwt:*:*:*:*:*:*:*:*before 2.12.0Vulnerablejpadilla
  • cpe:2.3:a:pyjwt_project:pyjwt:*:*:*:*:*:*:*:* Versions before 2.12.0 Vulnerable ·jpadilla

Remediation

  • Fix · CNA pyjwt (jpadilla) Fixed in 2.12.0
  • Fix · GHSA-752w-5fwx-jx9f PyJWT (PyPI) Fixed in 2.12.0 Advisory →

Red Hat 35 advisories

  • RHSA-2026:93780 Released 2026-11-02 · Red Hat rating Important
    python-jwt security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) python-jwt-1.6.1-2.el8_6.1, python3-jwt-1.6.1-2.el8_6.1
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) python-jwt-1.6.1-2.el8_6.1, python3-jwt-1.6.1-2.el8_6.1
  • RHSA-2026:93624 Released 2026-11-02 · Red Hat rating Important
    python-jwt security update
    • Red Hat Enterprise Linux BaseOS E4S (v.8.8) python-jwt-1.6.1-2.el8_8.1, python3-jwt-1.6.1-2.el8_8.1
    • Red Hat Enterprise Linux BaseOS TUS (v.8.8) python-jwt-1.6.1-2.el8_8.1, python3-jwt-1.6.1-2.el8_8.1
  • RHSA-2026:93626 Released 2026-11-02 · Red Hat rating Important
    python-jwt security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) python-jwt-1.6.1-2.el8_4.1, python3-jwt-1.6.1-2.el8_4.1
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) python-jwt-1.6.1-2.el8_4.1, python3-jwt-1.6.1-2.el8_4.1
Show 32 more Red Hat advisories
  • RHSA-2026:93440 Released 2026-11-02 · Red Hat rating Important
    python-jwt security update
    • Red Hat Enterprise Linux BaseOS (v. 8) python-jwt-1.6.1-2.el8_10.1, python3-jwt-1.6.1-2.el8_10.1
  • RHSA-2026:73987 Released 2026-09-30 · Red Hat rating Critical
    RHOAI 3.3.7 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
  • RHSA-2026:42644 Released 2026-07-21 · Red Hat rating Important
    RHOAI 2.25.9 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-feature-server-rhel9, registry.redhat.io/rhoai/odh-kserve-storage-initializer-rhel9 +36
  • RHSA-2026:37275 Released 2026-07-09 · Red Hat rating Critical
    RHOAI 3.3.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9, registry.redhat.io/rhoai/odh-feast-operator-rhel9 +45
  • RHSA-2026:26226 Released 2026-06-16 · Red Hat rating Important
    General availability of the satellite/iop-host-inventory-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-host-inventory-rhel9
  • RHSA-2026:24977 Released 2026-06-10 · Red Hat rating Important
    RHOAI 2.25.7 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +34
  • RHSA-2026:22330 Released 2026-06-01 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) fence-agents-4.10.0-43.el9_2.21, fence-agents-common-4.10.0-43.el9_2.21, fence-agents-compute-4.10.0-43.el9_2.21 +11
    • Red Hat Enterprise Linux High Availability E4S (v.9.2) fence-agents-aliyun-4.10.0-43.el9_2.21, fence-agents-all-4.10.0-43.el9_2.21, fence-agents-amt-ws-4.10.0-43.el9_2.21 +40
    • Red Hat Enterprise Linux Resilient Storage E4S (v.9.2) fence-agents-aliyun-4.10.0-43.el9_2.21, fence-agents-all-4.10.0-43.el9_2.21, fence-agents-amt-ws-4.10.0-43.el9_2.21 +39
  • RHSA-2026:21517 Released 2026-05-28 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) fence-agents-4.10.0-62.el9_4.24, fence-agents-common-4.10.0-62.el9_4.24, fence-agents-compute-4.10.0-62.el9_4.24 +11
    • Red Hat Enterprise Linux High Availability EUS (v.9.4) fence-agents-aliyun-4.10.0-62.el9_4.24, fence-agents-all-4.10.0-62.el9_4.24, fence-agents-amt-ws-4.10.0-62.el9_4.24 +40
    • Red Hat Enterprise Linux Resilient Storage EUS (v.9.4) fence-agents-aliyun-4.10.0-62.el9_4.24, fence-agents-all-4.10.0-62.el9_4.24, fence-agents-amt-ws-4.10.0-62.el9_4.24 +39
  • RHSA-2026:21431 Released 2026-05-27 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) fence-agents-4.10.0-86.el9_6.16, fence-agents-aliyun-4.10.0-86.el9_6.16, fence-agents-all-4.10.0-86.el9_6.16 +47
  • RHSA-2026:19712 Released 2026-05-20 · Red Hat rating Critical
    RHOAI 3.3.3 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +33
  • RHSA-2026:19355 Released 2026-05-19 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream (v. 9) fence-agents-4.10.0-110.el9_8.2, fence-agents-aliyun-4.10.0-110.el9_8.2, fence-agents-all-4.10.0-110.el9_8.2 +47
  • RHSA-2026:19375 Released 2026-05-19 · Red Hat rating Important
    Red Hat Quay 3.16.4
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:19138 Released 2026-05-19 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream (v. 10) fence-agents-4.16.0-21.el10_2.1, fence-agents-aliyun-4.16.0-21.el10_2.1, fence-agents-all-4.16.0-21.el10_2.1 +47
  • RHSA-2026:17083 Released 2026-05-13 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) fence-agents-4.16.0-5.el10_0.9, fence-agents-aliyun-4.16.0-5.el10_0.9, fence-agents-all-4.16.0-5.el10_0.9 +47
  • RHSA-2026:13916 Released 2026-05-06 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream (v. 10) fence-agents-4.16.0-13.el10_1.4, fence-agents-aliyun-4.16.0-13.el10_1.4, fence-agents-all-4.16.0-13.el10_1.4 +47
  • RHSA-2026:13672 Released 2026-05-05 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream (v. 9) fence-agents-4.10.0-98.el9_7.12, fence-agents-aliyun-4.10.0-98.el9_7.12, fence-agents-all-4.10.0-98.el9_7.12 +47
  • RHSA-2026:13553 Released 2026-05-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Container Release Update
    • Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/ee-supported-rhel8, registry.redhat.io/ansible-automation-platform-25/gateway-rhel8, registry.redhat.io/ansible-automation-platform-25/hub-rhel8 +2
  • RHSA-2026:13545 Released 2026-05-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/ansible-dev-tools-rhel9, registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/eda-controller-rhel9 +11
  • RHSA-2026:13512 Released 2026-05-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower-4.6.28-3.el8ap, automation-gateway-proxy-2.5.10-5.el8ap, automation-gateway-proxy-server-2.5.10-5.el8ap +19
    • Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower-4.6.28-3.el9ap, automation-gateway-proxy-2.6.14-2.el9, automation-gateway-proxy-server-2.6.14-2.el9 +19
  • RHSA-2026:13508 Released 2026-05-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor-1.6.4-3.el10ap, receptorctl-1.6.4-3.el10ap
    • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-4.7.11-2.el9ap, automation-controller-cli-4.7.11-2.el9ap, automation-controller-server-4.7.11-2.el9ap +25
  • RHSA-2026:12176 Released 2026-04-30 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream (v. 8) fence-agents-4.2.1-129.el8_10.25, fence-agents-all-4.2.1-129.el8_10.25, fence-agents-amt-ws-4.2.1-129.el8_10.25 +41
    • Red Hat Enterprise Linux HighAvailability (v. 8) fence-agents-aliyun-4.2.1-129.el8_10.25, fence-agents-aws-4.2.1-129.el8_10.25, fence-agents-azure-arm-4.2.1-129.el8_10.25 +2
    • Red Hat Enterprise Linux ResilientStorage (v. 8) fence-agents-aliyun-4.2.1-129.el8_10.25, fence-agents-aws-4.2.1-129.el8_10.25, fence-agents-azure-arm-4.2.1-129.el8_10.25 +2
  • RHSA-2026:10184 Released 2026-04-23 · Red Hat rating Important
    RHOAI 2.25.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:10141 Released 2026-04-23 · Red Hat rating Important
    Red Hat Enterprise Linux AI 3.3.1
    • Red Hat Enterprise Linux AI 3.3 registry.redhat.io/rhelai3/disk-image-cuda-rhel9
  • RHSA-2026:10140 Released 2026-04-23 · Red Hat rating Important
    Red Hat Enterprise Linux AI 3.3.1
    • Red Hat Enterprise Linux AI 3.3 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
  • RHSA-2026:8748 Released 2026-04-17 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.3.1 (CUDA)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2026:8746 Released 2026-04-17 · Red Hat rating Important
    Red Hat AI Inference Server 3.3.1 (CUDA)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:8747 Released 2026-04-17 · Red Hat rating Important
    Red Hat AI Inference Server 3.3.1 (ROCm)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2026:8437 Released 2026-04-16 · Red Hat rating Important
    RHTAS 1.4 - GA Release of Model Transparency
    • Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/model-transparency-rhel9
  • RHSA-2026:6926 Released 2026-04-07 · Red Hat rating Important
    Red Hat Quay 3.9.20
    • Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:6912 Released 2026-04-07 · Red Hat rating Important
    Red Hat Quay 3.10.20
    • Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:6720 Released 2026-04-06 · Red Hat rating Important
    Red Hat Quay 3.12.16
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:6568 Released 2026-04-03 · Red Hat rating Important
    Red Hat Quay 3.15.4
    • Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift LightspeedAffectedNo fix yet
Red Hat AI Inference ServerAffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Ceph Storage 4AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 7AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat Satellite 6AffectedNo fix yet
Red Hat Trusted Artifact SignerAffectedNo fix yet
Red Hat AI Inference Server 3.3Fixed RHSA-2026:8746, RHSA-2026:8747, RHSA-2026:8748
Red Hat Ansible Automation Platform 2.5Fixed RHSA-2026:13553
Red Hat Ansible Automation Platform 2.5 for RHEL 8Fixed RHSA-2026:13512
Red Hat Ansible Automation Platform 2.5 for RHEL 9Fixed RHSA-2026:13512
Red Hat Ansible Automation Platform 2.6Fixed RHSA-2026:13545
Red Hat Ansible Automation Platform 2.6 for RHEL 9Fixed RHSA-2026:13508
Red Hat Enterprise Linux AI 3.3Fixed RHSA-2026:10140, RHSA-2026:10141
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:13916, RHSA-2026:19138
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:12176
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:13672, RHSA-2026:19355
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:22330
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:17083
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2026:21517
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:21431
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:93440
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2026:93626
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2026:93780
Red Hat Enterprise Linux BaseOS E4S (v.8.8)Fixed RHSA-2026:93624
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)Fixed RHSA-2026:93626
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)Fixed RHSA-2026:93780
Red Hat Enterprise Linux BaseOS TUS (v.8.8)Fixed RHSA-2026:93624
Red Hat Enterprise Linux High Availability E4S (v.9.2)Fixed RHSA-2026:22330
Red Hat Enterprise Linux High Availability EUS (v.9.4)Fixed RHSA-2026:21517
Red Hat Enterprise Linux HighAvailability (v. 8)Fixed RHSA-2026:12176
Red Hat Enterprise Linux Resilient Storage E4S (v.9.2)Fixed RHSA-2026:22330
Red Hat Enterprise Linux Resilient Storage EUS (v.9.4)Fixed RHSA-2026:21517
Red Hat Enterprise Linux ResilientStorage (v. 8)Fixed RHSA-2026:12176
Red Hat OpenShift AI 2.25Fixed RHSA-2026:10184, RHSA-2026:24977, RHSA-2026:42644
Red Hat OpenShift AI 3.3Fixed RHSA-2026:19712, RHSA-2026:37275, RHSA-2026:73987
Red Hat Quay 3.10Fixed RHSA-2026:6912
Red Hat Quay 3.12Fixed RHSA-2026:6720
Red Hat Quay 3.15Fixed RHSA-2026:6568
Red Hat Quay 3.16Fixed RHSA-2026:19375
Red Hat Quay 3.9Fixed RHSA-2026:6926
Red Hat Satellite 6.18Fixed RHSA-2026:26226
Red Hat Trusted Artifact Signer 1.4Fixed RHSA-2026:8437
Not affected: 18 products
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.5
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Ansible Automation Platform 2.6
  • Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.3
  • Red Hat OpenStack Platform 13 (Queens)
  • Red Hat OpenStack Platform 17.1
  • Red Hat OpenStack Platform 18.0
  • Red Hat Quay 3.10
  • Red Hat Quay 3.12
  • Red Hat Quay 3.15
  • Red Hat Quay 3.16
  • Red Hat Quay 3.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-32597
  2. 2026-10-03 Alias added: GHSA-752w-5fwx-jx9f
  3. 2026-10-07 Fix available: RHSA-2026:73987 · Red Hat
  4. 2026-11-02 Fix available: RHSA-2026:93440 · Red Hat
  5. 2026-11-02 Fix available: Red Hat Enterprise Linux BaseOS (v. 8) · Red Hat
  6. 2026-11-02 Fix available: RHSA-2026:93624 · Red Hat
  7. 2026-11-02 Fix available: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8) · Red Hat
  8. 2026-11-02 Fix available: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) +1 · Red Hat
  9. 2026-11-03 Fix available: RHSA-2026:93780 · Red Hat
  10. 2026-11-03 Fix available: RHSA-2026:93626 · Red Hat
  11. 2026-11-06 Fix available: RHSA-2026:42644 · Red Hat

References

Exploit 1

Advisory 1

Other 3

  • TI-2026-65303 Improper signature verification in jpadilla pyjwt CVSS 3.1CRITICAL 9.1
  • TI-2026-65301 PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation CVSS 3.1CRITICAL 9.1
  • TI-2026-65219 PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse… CVSS 3.1HIGH 7.5
  • TI-2026-65218 PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524) CVSS 3.1HIGH 7.5
  • TI-2026-65310 PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion CVSS 3.1HIGH 8.2
  • TI-2026-65307 PyJWT BOM Bypass CVSS 3.1HIGH 7.4
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences