MediumFix available

PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set

Type: advisorySource: OSV2 source records

## Summary A malformed RSA JWK inside a JWK Set aborts parsing of the entire set instead of being skipped, because `RSAAlgorithm.from_jwk` can raise a plain `ValueError` that isn't caught by `PyJWKSet`'s per-key error-skipping logic. ## Affected component / version - Package: `PyJWT` (PyPI, ecosystem `pip`) - Files: `jwt/api_jwk.py` (`PyJWK.__init__`, `PyJWKSet.__init__`), `jwt/algorithms.py` (`RSAAlgorithm.from_jwk`) - Confirmed present in the `master` branch as of 2026-09-05 (commit `7144e4534c34810f4525dc4578a32addd8212cff`, tag `2.13.0`). Directly verified identical in tags `2.9.0`, `2.10.0`, `2.11.0`, `2.12.0`, `2.12.1`, `2.13.0` -- the vulnerable call and the `except PyJWTError` guard are unchanged across all six releases. Not verified against any release prior to `2.9.0`. ## Details `PyJWKSet.__init__` (`jwt/api_jwk.py:145-152`) iterates each key in a JWK Set: ```python for key in keys: try: self.keys.append(PyJWK(key)) except PyJWTError as error: if isinstance(error, MissingCryptographyError): raise error # skip unusable keys continue ``` `PyJWK.__init__` (`api_jwk.py:82`) calls `self.Algorithm.from_jwk(self._jwk_data)` with no try/except of its own. For an RSA JWK, this dispatches to `RSAAlgorithm.from_jwk` (`jwt/algorithms.py:539-586`). When the JWK supplies `d`, `e`, `n` without the CRT parameters (`p`, `q`, `dp`, `dq`, `qi`), `from_jwk` calls `cryptography`'s `rsa_recover_prime_factors(public_numbers.n, d, public_numbers.e)` (`algorithms.py:572-574`) to derive the

Announced 29 Sept 2026Group revision 1

Original source ↗

PYSEC-2026-4152

Revision 1

PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:PYSEC-2026-4152

pyjwt

Source reference: /affected/0/package/name

Affected versions: 2.10.0
Source reference: /affected/0/versions
2.10.1
Source reference: /affected/0/versions
2.11.0
Source reference: /affected/0/versions
2.12.0
Source reference: /affected/0/versions
2.12.1
Source reference: /affected/0/versions
2.13.0
Source reference: /affected/0/versions
2.9.0
Source reference: /affected/0/versions
Fixed versions: 2.14.0
Source reference: /affected/0/ranges
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "2.9.0"
          },
          {
            "fixed": "2.14.0"
          }
        ]
      }
    ],
    "package": {
      "name": "pyjwt",
      "purl": "pkg:pypi/pyjwt",
      "ecosystem": "PyPI"
    },
    "versions": [
      "2.10.0",
      "2.10.1",
      "2.11.0",
      "2.12.0",
      "2.12.1",
      "2.13.0",
      "2.9.0"
    ],
    "database_specific": {
      "source": "https://github.com/pypa/advisory-database/blob/main/vulns/pyjwt/PYSEC-2026-4152.yaml"
    }
  }
]

Related CVEs: CVE-2026-102274
Source reference: /aliases

Publisher severity

No explicit severity was provided.

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-102274 · Medium

pyjwt

Event: #62513 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 19:26:43 GMT
Publisher date: Thu, 01 Oct 2026 16:38:40 GMT

Read the original announcement

GHSA-w6j9-cwv2-h6wq

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-w6j9-cwv2-h6wq

pyjwt

Source reference: /affected/0/package/name

Affected versions: 2.10.0
Source reference: /affected/0/versions
2.10.1
Source reference: /affected/0/versions
2.11.0
Source reference: /affected/0/versions
2.12.0
Source reference: /affected/0/versions
2.12.1
Source reference: /affected/0/versions
2.13.0
Source reference: /affected/0/versions
2.9.0
Source reference: /affected/0/versions
Fixed versions: 2.14.0
Source reference: /affected/0/ranges
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "2.9.0"
          },
          {
            "fixed": "2.14.0"
          }
        ]
      }
    ],
    "package": {
      "name": "pyjwt",
      "purl": "pkg:pypi/pyjwt",
      "ecosystem": "PyPI"
    },
    "versions": [
      "2.10.0",
      "2.10.1",
      "2.11.0",
      "2.12.0",
      "2.12.1",
      "2.13.0",
      "2.9.0"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-w6j9-cwv2-h6wq/GHSA-w6j9-cwv2-h6wq.json",
      "last_known_affected_version_range": "<= 2.13.0"
    }
  }
]

Related CVEs: CVE-2026-102274
Source reference: /aliases

Publisher severity

No explicit severity was provided.

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-102274 · Medium

pyjwt

Event: #62536 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 19:26:56 GMT
Publisher date: Tue, 29 Sep 2026 18:23:01 GMT

Read the original announcement

PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set

PYSEC-2026-4152

PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set

Security context

pyjwt

Structured affected-version data

Publisher severity

Linked CVE context

GHSA-w6j9-cwv2-h6wq

Security context

pyjwt

Structured affected-version data

Publisher severity

Linked CVE context

Revision history