UnratedFix available
pyjwt vulnerabilities
Type: advisorySources: OSV
Kingsley Olukanni discovered that PyJWT did not properly handle unknown key identifiers when retrieving signing keys. An attacker could possibly use this issue to amplify requests to the configured key endpoint, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. (CVE-2026-101917) Ekalabya Ghosh discovered that PyJWT did not properly handle certain recursively nested JSON payloads. An attacker could possibly use this issue to cause an application to fail, resulting in a denial of service. (CVE-2026-101918) Pedram Hayati discovered that PyJWT did not properly handle malformed RSA keys in a JSON Web Key Set. An attacker could possibly use this issue to cause authentication failures or a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. (CVE-2026-102274) It was discovered that PyJWT did not properly validate certain OKP private key components. An attacker could possibly use this issue to confuse the identity of public and private keys, and use a stolen sender-constrained token without the legitimate private key. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. (CVE-2026-102275)
- Products
- pyjwt
- Affected versions
- 1.0.0-0ubuntu1, 1.3.0-1, 1.3.0-1ubuntu0.1, 1.3.0-1ubuntu0.1+esm1, 1.3.0-1ubuntu0.1+esm2, 1.3.0-1ubuntu0.1+esm3, 1.4.2-1.1, 1.5.3+ds1-1, 1.5.3+ds1-1ubuntu0.1, 1.5.3+ds1-1ubuntu0.1+esm1, 1.5.3+ds1-1ubuntu0.1+esm2, 1.5.3+ds1-1ubuntu0.1+esm3, 1.7.0-2, 1.7.1-1, 1.7.1-2ubuntu1, 1.7.1-2ubuntu2, 1.7.1-2ubuntu2.1, 1.7.1-2ubuntu2.1+esm1, 1.7.1-2ubuntu2.1+esm2, 1.7.1-2ubuntu2.1+esm3, 2.1.0-1, 2.10.1-2, 2.10.1-3, 2.10.1-3build1, 2.10.1-4, 2.10.1-4ubuntu1, 2.10.1-4ubuntu1.1, 2.10.1-4ubuntu1.2, 2.12.1-1, 2.13.0-1, 2.13.0-1ubuntu1, 2.3.0-1, 2.3.0-1ubuntu0.1, 2.3.0-1ubuntu0.2, 2.3.0-1ubuntu0.3, 2.3.0-1ubuntu0.4, 2.3.0-1ubuntu0.5, 2.7.0-1, 2.7.0-1ubuntu0.1, 2.7.0-1ubuntu0.2, 2.7.0-1ubuntu0.3
- Fixed versions
- 1.3.0-1ubuntu0.1+esm4, 1.5.3+ds1-1ubuntu0.1+esm4, 1.7.1-2ubuntu2.1+esm4, 2.10.1-4ubuntu1.3, 2.13.0-1ubuntu1.1, 2.3.0-1ubuntu0.6, 2.7.0-1ubuntu0.4
- CVEs
- CVE-2026-101917, CVE-2026-101918, CVE-2026-102274, CVE-2026-102275
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 17:54 UTC · Revision 1
Source evidence
Kingsley Olukanni discovered that PyJWT did not properly handle unknown key identifiers when retrieving signing keys. An attacker could possibly use this issue to amplify requests to the configured key endpoint, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. (CVE-2026-101917) Ekalabya Ghosh discovered that PyJWT did not properly handle certain recursively nested JSON payloads. An attacker could possibly use this issue to cause an application to fail, resulting in a denial of service. (CVE-2026-101918) Pedram Hayati discovered that PyJWT did not properly handle malformed RSA keys in a JSON Web Key Set. An attacker could possibly use this issue to cause authentication failures or a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. (CVE-2026-102274) It was discovered that PyJWT did not properly validate certain OKP private key components. An attacker could possibly use this issue to confuse the identity of public and private keys, and use a stolen sender-constrained token without the legitimate private key. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. (CVE-2026-102275)
osv:USN-8934-1
pyjwt
Fixed versions: 1.3.0-1ubuntu0.1+esm4
pyjwt
Fixed versions: 1.5.3+ds1-1ubuntu0.1+esm4
pyjwt
Fixed versions: 1.7.1-2ubuntu2.1+esm4
pyjwt
Fixed versions: 2.3.0-1ubuntu0.6
pyjwt
Fixed versions: 2.7.0-1ubuntu0.4
pyjwt
Fixed versions: 2.13.0-1ubuntu1.1
pyjwt
Fixed versions: 2.10.1-4ubuntu1.3
Complete source record
{
"id": "dee4fe4e87c77f2eeb80cb0ef6bae58faff1161e40fcb015403c7d8cbfdfeb1f",
"url": "https://osv.dev/vulnerability/USN-8934-1",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "pyjwt vulnerabilities",
"summary": "Kingsley Olukanni discovered that PyJWT did not properly handle unknown key identifiers when retrieving signing keys. An attacker could possibly use this issue to amplify requests to the configured key endpoint, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. (CVE-2026-101917) Ekalabya Ghosh discovered that PyJWT did not properly handle certain recursively nested JSON payloads. An attacker could possibly use this issue to cause an application to fail, resulting in a denial of service. (CVE-2026-101918) Pedram Hayati discovered that PyJWT did not properly handle malformed RSA keys in a JSON Web Key Set. An attacker could possibly use this issue to cause authentication failures or a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. (CVE-2026-102274) It was discovered that PyJWT did not properly validate certain OKP private key components. An attacker could possibly use this issue to confuse the identity of public and private keys, and use a stolen sender-constrained token without the legitimate private key. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. (CVE-2026-102275)",
"evidence": "osv:USN-8934-1",
"products": [
{
"name": {
"value": "pyjwt",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.3.0-1ubuntu0.1+esm4",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "1.0.0-0ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "1.3.0-1",
"evidence": "/affected/0/versions"
},
{
"value": "1.3.0-1ubuntu0.1",
"evidence": "/affected/0/versions"
},
{
"value": "1.3.0-1ubuntu0.1+esm1",
"evidence": "/affected/0/versions"
},
{
"value": "1.3.0-1ubuntu0.1+esm2",
"evidence": "/affected/0/versions"
},
{
"value": "1.3.0-1ubuntu0.1+esm3",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "pyjwt",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.5.3+ds1-1ubuntu0.1+esm4",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": [
{
"value": "1.4.2-1.1",
"evidence": "/affected/1/versions"
},
{
"value": "1.5.3+ds1-1",
"evidence": "/affected/1/versions"
},
{
"value": "1.5.3+ds1-1ubuntu0.1",
"evidence": "/affected/1/versions"
},
{
"value": "1.5.3+ds1-1ubuntu0.1+esm1",
"evidence": "/affected/1/versions"
},
{
"value": "1.5.3+ds1-1ubuntu0.1+esm2",
"evidence": "/affected/1/versions"
},
{
"value": "1.5.3+ds1-1ubuntu0.1+esm3",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "pyjwt",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.7.1-2ubuntu2.1+esm4",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "1.7.0-2",
"evidence": "/affected/2/versions"
},
{
"value": "1.7.1-1",
"evidence": "/affected/2/versions"
},
{
"value": "1.7.1-2ubuntu1",
"evidence": "/affected/2/versions"
},
{
"value": "1.7.1-2ubuntu2",
"evidence": "/affected/2/versions"
},
{
"value": "1.7.1-2ubuntu2.1",
"evidence": "/affected/2/versions"
},
{
"value": "1.7.1-2ubuntu2.1+esm1",
"evidence": "/affected/2/versions"
},
{
"value": "1.7.1-2ubuntu2.1+esm2",
"evidence": "/affected/2/versions"
},
{
"value": "1.7.1-2ubuntu2.1+esm3",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "pyjwt",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.3.0-1ubuntu0.6",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": [
{
"value": "1.7.1-2ubuntu2",
"evidence": "/affected/3/versions"
},
{
"value": "2.1.0-1",
"evidence": "/affected/3/versions"
},
{
"value": "2.3.0-1",
"evidence": "/affected/3/versions"
},
{
"value": "2.3.0-1ubuntu0.1",
"evidence": "/affected/3/versions"
},
{
"value": "2.3.0-1ubuntu0.2",
"evidence": "/affected/3/versions"
},
{
"value": "2.3.0-1ubuntu0.3",
"evidence": "/affected/3/versions"
},
{
"value": "2.3.0-1ubuntu0.4",
"evidence": "/affected/3/versions"
},
{
"value": "2.3.0-1ubuntu0.5",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "pyjwt",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.7.0-1ubuntu0.4",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": [
{
"value": "2.7.0-1",
"evidence": "/affected/4/versions"
},
{
"value": "2.7.0-1ubuntu0.1",
"evidence": "/affected/4/versions"
},
{
"value": "2.7.0-1ubuntu0.2",
"evidence": "/affected/4/versions"
},
{
"value": "2.7.0-1ubuntu0.3",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "pyjwt",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.13.0-1ubuntu1.1",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": [
{
"value": "2.10.1-4ubuntu1",
"evidence": "/affected/5/versions"
},
{
"value": "2.12.1-1",
"evidence": "/affected/5/versions"
},
{
"value": "2.13.0-1",
"evidence": "/affected/5/versions"
},
{
"value": "2.13.0-1ubuntu1",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "pyjwt",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.10.1-4ubuntu1.3",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": [
{
"value": "2.10.1-2",
"evidence": "/affected/6/versions"
},
{
"value": "2.10.1-3",
"evidence": "/affected/6/versions"
},
{
"value": "2.10.1-3build1",
"evidence": "/affected/6/versions"
},
{
"value": "2.10.1-4",
"evidence": "/affected/6/versions"
},
{
"value": "2.10.1-4ubuntu1",
"evidence": "/affected/6/versions"
},
{
"value": "2.10.1-4ubuntu1.1",
"evidence": "/affected/6/versions"
},
{
"value": "2.10.1-4ubuntu1.2",
"evidence": "/affected/6/versions"
}
]
}
],
"severity": "unknown",
"structured": {
"id": "USN-8934-1",
"aliases": [
"USN-8934-1"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.0-1ubuntu0.1+esm4"
}
]
}
],
"package": {
"name": "pyjwt",
"purl": "pkg:deb/ubuntu/pyjwt?arch=source&distro=esm-infra-legacy%2Fxenial",
"ecosystem": "Ubuntu:Pro:16.04:LTS"
},
"versions": [
"1.0.0-0ubuntu1",
"1.3.0-1",
"1.3.0-1ubuntu0.1",
"1.3.0-1ubuntu0.1+esm1",
"1.3.0-1ubuntu0.1+esm2",
"1.3.0-1ubuntu0.1+esm3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8934-1.json",
"cves_map": {
"cves": [
{
"id": "CVE-2026-101918",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
}
],
"ecosystem": "Ubuntu:Pro:16.04:LTS"
}
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python-jwt",
"binary_version": "1.3.0-1ubuntu0.1+esm4"
},
{
"binary_name": "python3-jwt",
"binary_version": "1.3.0-1ubuntu0.1+esm4"
}
],
"availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.3+ds1-1ubuntu0.1+esm4"
}
]
}
],
"package": {
"name": "pyjwt",
"purl": "pkg:deb/ubuntu/pyjwt?arch=source&distro=esm-infra%2Fbionic",
"ecosystem": "Ubuntu:Pro:18.04:LTS"
},
"versions": [
"1.4.2-1.1",
"1.5.3+ds1-1",
"1.5.3+ds1-1ubuntu0.1",
"1.5.3+ds1-1ubuntu0.1+esm1",
"1.5.3+ds1-1ubuntu0.1+esm2",
"1.5.3+ds1-1ubuntu0.1+esm3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8934-1.json",
"cves_map": {
"cves": [
{
"id": "CVE-2026-101918",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
}
],
"ecosystem": "Ubuntu:Pro:18.04:LTS"
}
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python-jwt",
"binary_version": "1.5.3+ds1-1ubuntu0.1+esm4"
},
{
"binary_name": "python3-jwt",
"binary_version": "1.5.3+ds1-1ubuntu0.1+esm4"
}
],
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.7.1-2ubuntu2.1+esm4"
}
]
}
],
"package": {
"name": "pyjwt",
"purl": "pkg:deb/ubuntu/pyjwt?arch=source&distro=esm-infra%2Ffocal",
"ecosystem": "Ubuntu:Pro:20.04:LTS"
},
"versions": [
"1.7.0-2",
"1.7.1-1",
"1.7.1-2ubuntu1",
"1.7.1-2ubuntu2",
"1.7.1-2ubuntu2.1",
"1.7.1-2ubuntu2.1+esm1",
"1.7.1-2ubuntu2.1+esm2",
"1.7.1-2ubuntu2.1+esm3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8934-1.json",
"cves_map": {
"cves": [
{
"id": "CVE-2026-101918",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
}
],
"ecosystem": "Ubuntu:Pro:20.04:LTS"
}
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-jwt",
"binary_version": "1.7.1-2ubuntu2.1+esm4"
}
],
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.3.0-1ubuntu0.6"
}
]
}
],
"package": {
"name": "pyjwt",
"purl": "pkg:deb/ubuntu/pyjwt?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"1.7.1-2ubuntu2",
"2.1.0-1",
"2.3.0-1",
"2.3.0-1ubuntu0.1",
"2.3.0-1ubuntu0.2",
"2.3.0-1ubuntu0.3",
"2.3.0-1ubuntu0.4",
"2.3.0-1ubuntu0.5"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8934-1.json",
"cves_map": {
"cves": [
{
"id": "CVE-2026-101917",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-101918",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-102274",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-102275",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
}
],
"ecosystem": "Ubuntu:22.04:LTS"
}
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-jwt",
"binary_version": "2.3.0-1ubuntu0.6"
}
],
"availability": "No subscription required"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.0-1ubuntu0.4"
}
]
}
],
"package": {
"name": "pyjwt",
"purl": "pkg:deb/ubuntu/pyjwt?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"2.7.0-1",
"2.7.0-1ubuntu0.1",
"2.7.0-1ubuntu0.2",
"2.7.0-1ubuntu0.3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8934-1.json",
"cves_map": {
"cves": [
{
"id": "CVE-2026-101917",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-101918",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-102274",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-102275",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
}
],
"ecosystem": "Ubuntu:24.04:LTS"
}
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-jwt",
"binary_version": "2.7.0-1ubuntu0.4"
}
],
"availability": "No subscription required"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.13.0-1ubuntu1.1"
}
]
}
],
"package": {
"name": "pyjwt",
"purl": "pkg:deb/ubuntu/pyjwt?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"2.10.1-4ubuntu1",
"2.12.1-1",
"2.13.0-1",
"2.13.0-1ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8934-1.json",
"cves_map": {
"cves": [
{
"id": "CVE-2026-101917",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-101918",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-102274",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-102275",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
}
],
"ecosystem": "Ubuntu:26.10"
}
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-jwt",
"binary_version": "2.13.0-1ubuntu1.1"
}
],
"availability": "No subscription required"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.10.1-4ubuntu1.3"
}
]
}
],
"package": {
"name": "pyjwt",
"purl": "pkg:deb/ubuntu/pyjwt?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"2.10.1-2",
"2.10.1-3",
"2.10.1-3build1",
"2.10.1-4",
"2.10.1-4ubuntu1",
"2.10.1-4ubuntu1.1",
"2.10.1-4ubuntu1.2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8934-1.json",
"cves_map": {
"cves": [
{
"id": "CVE-2026-101917",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-101918",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-102274",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-102275",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
}
],
"ecosystem": "Ubuntu:26.04:LTS"
}
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-jwt",
"binary_version": "2.10.1-4ubuntu1.3"
}
],
"availability": "No subscription required"
}
}
],
"modified": "2026-10-27T11:56:51.364530970Z",
"provider": "osv",
"upstream": [
"CVE-2026-101917",
"CVE-2026-101918",
"CVE-2026-102274",
"CVE-2026-102275",
"UBUNTU-CVE-2026-101917",
"UBUNTU-CVE-2026-101918",
"UBUNTU-CVE-2026-102274",
"UBUNTU-CVE-2026-102275"
],
"references": [
"https://ubuntu.com/security/notices/USN-8934-1",
"https://ubuntu.com/security/CVE-2026-101917",
"https://ubuntu.com/security/CVE-2026-101918",
"https://ubuntu.com/security/CVE-2026-102274",
"https://ubuntu.com/security/CVE-2026-102275"
]
},
"related_cves": [
{
"value": "CVE-2026-101917",
"evidence": "/upstream"
},
{
"value": "CVE-2026-101918",
"evidence": "/upstream"
},
{
"value": "CVE-2026-102274",
"evidence": "/upstream"
},
{
"value": "CVE-2026-102275",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 461468,
"published_at": "2026-10-19T19:00:51+00:00"
}