Home / mailings

PDF

[USN-8934-1] PyJWT vulnerabilities

Posted on 21 October 2026
Ubuntu Security

==========================================================================Ubuntu Security Notice USN-8934-1
October 19, 2026

pyjwt vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.10
- Ubuntu 26.04 LTS
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in PyJWT.

Software Description:
- pyjwt: Python 3 implementation of JSON Web Token

Details:

Kingsley Olukanni discovered that PyJWT did not properly handle unknown key
identifiers when retrieving signing keys. An attacker could possibly use
this issue to amplify requests to the configured key endpoint, resulting in
a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu
24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. (CVE-2026-101917)

Ekalabya Ghosh discovered that PyJWT did not properly handle certain
recursively nested JSON payloads. An attacker could possibly use this issue
to cause an application to fail, resulting in a denial of service.
(CVE-2026-101918)

Pedram Hayati discovered that PyJWT did not properly handle malformed RSA
keys in a JSON Web Key Set. An attacker could possibly use this issue to
cause authentication failures or a denial of service. This issue only
affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu
26.10. (CVE-2026-102274)

It was discovered that PyJWT did not properly validate certain OKP private
key components. An attacker could possibly use this issue to confuse the
identity of public and private keys, and use a stolen sender-constrained
token without the legitimate private key. This issue only affected Ubuntu
22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10.
(CVE-2026-102275)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.10
python3-jwt 2.13.0-1ubuntu1.1

Ubuntu 26.04 LTS
python3-jwt 2.10.1-4ubuntu1.3

Ubuntu 24.04 LTS
python3-jwt 2.7.0-1ubuntu0.4

Ubuntu 22.04 LTS
python3-jwt 2.3.0-1ubuntu0.6

Ubuntu 20.04 LTS
python3-jwt 1.7.1-2ubuntu2.1+esm4
Available with Ubuntu Pro

Ubuntu 18.04 LTS
python-jwt 1.5.3+ds1-1ubuntu0.1+esm4
Available with Ubuntu Pro
python3-jwt 1.5.3+ds1-1ubuntu0.1+esm4
Available with Ubuntu Pro

Ubuntu 16.04 LTS
python-jwt 1.3.0-1ubuntu0.1+esm4
Available with Ubuntu Pro
python3-jwt 1.3.0-1ubuntu0.1+esm4
Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-8934-1
CVE-2026-101917, CVE-2026-101918, CVE-2026-102274, CVE-2026-102275

Package Information:
https://launchpad.net/ubuntu/+source/pyjwt/2.13.0-1ubuntu1.1
https://launchpad.net/ubuntu/+source/pyjwt/2.10.1-4ubuntu1.3
https://launchpad.net/ubuntu/+source/pyjwt/2.7.0-1ubuntu0.4
https://launchpad.net/ubuntu/+source/pyjwt/2.3.0-1ubuntu0.6

--===============3082436110798049912==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature

 

TOP