PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set
Priority HIGH 66CWE-755Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 2 fixed, 20 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications can experience authentication failures or request-level denial of service. This issue is fixed in version 2.14.0.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00549 46th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial pyjwt (jpadilla): 2.14.0PyJWT (PyPI): 2.14.0Red Hat: 7 advisoriesRed Hat: 2 fixed, 20 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| jpadilla | pyjwt | 2.9.0 to before 2.14.0 | 2.14.0 | Patch available | CNA |
| — | PyJWT (PyPI) | 2.9.0 to before 2.14.0 | 2.14.0 | Patch available | GHSA-w6j9-cwv2-h6wq |
- pyjwt Vendorjpadilla Affected 2.9.0 to before 2.14.0 Fixed in 2.14.0 Patch available CNA
- PyJWT (PyPI) Vendor— Affected 2.9.0 to before 2.14.0 Fixed in 2.14.0 Patch available GHSA-w6j9-cwv2-h6wq
Remediation
- Fix · CNA pyjwt (jpadilla) Fixed in 2.14.0
- Fix · GHSA-w6j9-cwv2-h6wq PyJWT (PyPI) Fixed in 2.14.0 Advisory →
Red Hat 7 advisories
- RHSA-2026:92452 Released 2026-10-29 · Red Hat rating CriticalRed Hat Enterprise Linux AI 3.5.2 enhancement update
- Red Hat Enterprise Linux AI 3.5 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
- RHSA-2026:92449 Released 2026-10-29 · Red Hat rating CriticalRed Hat Enterprise Linux AI 3.5.2 enhancement update
- Red Hat Enterprise Linux AI 3.5 registry.redhat.io/rhelai3/disk-image-cuda-rhel9
- RHSA-2026:82415 Released 2026-10-13 · Red Hat rating CriticalRed Hat AI Inference 3.5.2 (cpu)
- Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-cpu-rhel9
Show 4 more Red Hat advisories
- RHSA-2026:82371 Released 2026-10-13 · Red Hat rating CriticalRed Hat AI Inference 3.5.2 (spyre)
- Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-spyre-rhel9
- RHSA-2026:82368 Released 2026-10-13 · Red Hat rating CriticalRed Hat AI Inference 3.5.2 (cuda)
- Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-cuda-rhel9
- RHSA-2026:82061 Released 2026-10-13 · Red Hat rating CriticalRed Hat AI Inference Tech Preview 3.5.2 (Gaudi)
- Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-gaudi-rhel9
- RHSA-2026:82059 Released 2026-10-13 · Red Hat rating CriticalRed Hat AI Inference 3.5.2 (ROCm)
- Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-rocm-rhel9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Ansible Automation Orchestrator 2026 | Affected | No fix yet: Fix deferred |
| Confidential Compute Attestation | Affected | No fix yet: Fix deferred |
| Fence Agents Remediation Operator | Affected | No fix yet: Fix deferred |
| Lightspeed Core | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Applications 8 | Affected | No fix yet: Fix deferred |
| OpenShift Lightspeed | Affected | No fix yet: Fix deferred |
| Red Hat AI Inference Server | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 4 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 7 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 9 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet: Fix deferred |
| Red Hat Quay 3 | Affected | No fix yet: Fix deferred |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
| Red Hat Trusted Artifact Signer | Affected | No fix yet: Fix deferred |
| Red Hat Update Infrastructure 5 | Affected | No fix yet: Fix deferred |
| Red Hat AI Inference Server 3.5 | Fixed | RHSA-2026:82059, RHSA-2026:82061, RHSA-2026:82368, RHSA-2026:82371, RHSA-2026:82415 |
| Red Hat Enterprise Linux AI 3.5 | Fixed | RHSA-2026:92449, RHSA-2026:92452 |
Not affected: 12 products
- Red Hat AI Inference Server
- Red Hat Ansible Automation Platform 2
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat Enterprise Linux command line assistant
- Red Hat Hardened Images
- Red Hat OpenStack Platform 13 (Queens)
- Red Hat OpenStack Platform 16.2
- Red Hat OpenStack Platform 17.1
- Red Hat OpenStack Platform 18.0
- Red Hat Satellite 6
- Red Hat Update Infrastructure 4 for Cloud Providers
Timeline
- 2026-10-02 Threatist record created from CVE-2026-102274
- 2026-10-03 Alias added: GHSA-w6j9-cwv2-h6wq
- 2026-10-06 CVSS score added · NVD
- 2026-10-06 Priority changed: MEDIUM → HIGH
- 2026-10-09 Affected versions changed · Red Hat
- 2026-10-13 Fix available: RHSA-2026:82061 · Red Hat
- 2026-10-13 Fix available: RHSA-2026:82059 · Red Hat
- 2026-10-13 Fix available: Red Hat AI Inference Server 3.5 · Red Hat
- 2026-10-14 Fix available: RHSA-2026:82368 · Red Hat
- 2026-10-14 Fix available: RHSA-2026:82415 · Red Hat
- 2026-10-14 Fix available: RHSA-2026:82371 · Red Hat
- 2026-10-15 Affected versions changed · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92452 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92449 · Red Hat
- 2026-10-30 Fix available: Red Hat Enterprise Linux AI 3.5 · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
References
More jpadilla Pyjwt vulnerabilities
- TI-2026-65303 Improper signature verification in jpadilla pyjwt CVSS 3.1CRITICAL 9.1
- TI-2026-65301 PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation CVSS 3.1CRITICAL 9.1
- TI-2026-65219 PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse… CVSS 3.1HIGH 7.5
- TI-2026-65218 PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524) CVSS 3.1HIGH 7.5
- TI-2026-25107 PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation) CVSS 3.1HIGH 7.5
- TI-2026-65310 PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion CVSS 3.1HIGH 8.2
Sources
- CVE-2026-102274 · CVE Program
- CVE-2026-102274 · NVD
- FIRST EPSS
- GHSA-w6j9-cwv2-h6wq · GitHub Advisory Database · CC BY 4.0
- CVE-2026-102274 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences