Skip to content
Heist/ feed
MediumFix available

PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set

Type: advisorySource: OSV1 source record

## Summary A malformed RSA JWK inside a JWK Set aborts parsing of the entire set instead of being skipped, because `RSAAlgorithm.from_jwk` can raise a plain `ValueError` that isn't caught by `PyJWKSet`'s per-key error-skipping logic. ## Affected component / version - Package: `PyJWT` (PyPI, ecosystem `pip`) - Files: `jwt/api_jwk.py` (`PyJWK.__init__`, `PyJWKSet.__init__`), `jwt/algorithms.py` (`RSAAlgorithm.from_jwk`) - Confirmed present in the `master` branch as of 2026-09-05 (commit `7144e4534c34810f4525dc4578a32addd8212cff`, tag `2.13.0`). Directly verified identical in tags `2.9.0`, `2.10.0`, `2.11.0`, `2.12.0`, `2.12.1`, `2.13.0` -- the vulnerable call and the `except PyJWTError` guard are unchanged across all six releases. Not verified against any release prior to `2.9.0`. ## Details `PyJWKSet.__init__` (`jwt/api_jwk.py:145-152`) iterates each key in a JWK Set: ```python for key in keys: try: self.keys.append(PyJWK(key)) except PyJWTError as error: if isinstance(error, MissingCryptographyError): raise error # skip unusable keys continue ``` `PyJWK.__init__` (`api_jwk.py:82`) calls `self.Algorithm.from_jwk(self._jwk_data)` with no try/except of its own. For an RSA JWK, this dispatches to `RSAAlgorithm.from_jwk` (`jwt/algorithms.py:539-586`). When the JWK supplies `d`, `e`, `n` without the CRT parameters (`p`, `q`, `dp`, `dq`, `qi`), `from_jwk` calls `cryptography`'s `rsa_recover_prime_factors(public_numbers.n, d, public_numbers.e)` (`algorithms.py:572-574`) to derive the

Announced Source revision 1
Original source ↗

GHSA-w6j9-cwv2-h6wq

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-w6j9-cwv2-h6wq

pyjwt

Source reference: /affected/0/package/name

Affected versions
2.10.0

Source reference: /affected/0/versions

2.10.1

Source reference: /affected/0/versions

2.11.0

Source reference: /affected/0/versions

2.12.0

Source reference: /affected/0/versions

2.12.1

Source reference: /affected/0/versions

2.13.0

Source reference: /affected/0/versions

2.9.0

Source reference: /affected/0/versions

Fixed versions
2.14.0

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "2.9.0"
          },
          {
            "fixed": "2.14.0"
          }
        ]
      }
    ],
    "package": {
      "name": "pyjwt",
      "purl": "pkg:pypi/pyjwt",
      "ecosystem": "PyPI"
    },
    "versions": [
      "2.10.0",
      "2.10.1",
      "2.11.0",
      "2.12.0",
      "2.12.1",
      "2.13.0",
      "2.9.0"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-w6j9-cwv2-h6wq/GHSA-w6j9-cwv2-h6wq.json",
      "last_known_affected_version_range": "<= 2.13.0"
    }
  }
]
Related CVEs
CVE-2026-102274

Source reference: /aliases

Publisher severity

No explicit severity was provided.

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-102274 · Medium

pyjwt

Event
#62536 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement