UBUNTU-CVE-2026-48524
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests. The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint behavior (rate limiting, transient errors) which is beyond the attacker's control. This vulnerability is fixed in 2.13.0.
UBUNTU-CVE-2026-48524
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:UBUNTU-CVE-2026-48524
pyjwt
Source reference: /affected/0/package/name
- Affected versions
- 2.7.0-1
Source reference:
/affected/0/versions2.7.0-1ubuntu0.1Source reference:
/affected/0/versions - Fixed versions
- 2.7.0-1ubuntu0.2
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
pyjwt
Source reference: /affected/1/package/name
- Affected versions
- 2.10.1-2
Source reference:
/affected/1/versions2.10.1-2ubuntu0.1Source reference:
/affected/1/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
pyjwt
Source reference: /affected/2/package/name
- Affected versions
- 2.10.1-2
Source reference:
/affected/2/versions2.10.1-3Source reference:
/affected/2/versions2.10.1-3build1Source reference:
/affected/2/versions2.10.1-4Source reference:
/affected/2/versions2.10.1-4ubuntu1Source reference:
/affected/2/versions - Fixed versions
- 2.10.1-4ubuntu1.1
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.0-1ubuntu0.2"
}
]
}
],
"package": {
"name": "pyjwt",
"purl": "pkg:deb/ubuntu/pyjwt?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"2.7.0-1",
"2.7.0-1ubuntu0.1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-48524.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-jwt",
"binary_version": "2.7.0-1ubuntu0.2"
}
],
"availability": "No subscription required"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "pyjwt",
"purl": "pkg:deb/ubuntu/pyjwt?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"2.10.1-2",
"2.10.1-2ubuntu0.1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-48524.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-jwt",
"binary_version": "2.10.1-2ubuntu0.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.10.1-4ubuntu1.1"
}
]
}
],
"package": {
"name": "pyjwt",
"purl": "pkg:deb/ubuntu/pyjwt?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"2.10.1-2",
"2.10.1-3",
"2.10.1-3build1",
"2.10.1-4",
"2.10.1-4ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-48524.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-jwt",
"binary_version": "2.10.1-4ubuntu1.1"
}
],
"availability": "No subscription required"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #22391 · Revision 1
- Added to Heist Feed
- Publisher date