{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:dbb8bba4-be6b-5595-a98b-363d133439f2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "pyjwt", "purl": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare", "type": "library", "bom-ref": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare", "version": "1.7.1.post4+tuxcare", "pedigree": { "ancestors": [ { "name": "pyjwt", "purl": "pkg:pypi/pyjwt@1.7.1", "type": "library", "version": "1.7.1" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-29217", "affects": [ { "ref": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } ], "bom-ref": "urn:uuid:e8a5a4d3-e760-5437-8207-14980ad92f79", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-29217 is fixed in version 1.7.1.post4+tuxcare of pyjwt." } }, { "id": "CVE-2026-101917", "affects": [ { "ref": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } ], "bom-ref": "urn:uuid:dc50bceb-e14d-5e8f-be0e-36cb9f599220", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-101917 does not affect version 1.7.1.post4+tuxcare of pyjwt. not_affected \u2014 PyJWT 1.7.1 is not affected by CVE-2026-101917. The vulnerability concerns PyJWKClient's unbounded JWKS endpoint refresh mechanism triggered by unknown key IDs, enabling unauthenticated DoS attacks. PyJWT version 1.7.1 predates the introduction of the PyJWKClient class entirely - the jwt/jwks_client.py module does not exist, and there is no JWKS endpoint fetching functionality. While this versi...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-101918", "affects": [ { "ref": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } ], "bom-ref": "urn:uuid:266d937b-505d-58ca-ae64-636a746bd2d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101918 affects version 1.7.1.post4+tuxcare of pyjwt." } }, { "id": "CVE-2026-102265", "affects": [ { "ref": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } ], "bom-ref": "urn:uuid:f2925a82-0e60-52be-915c-afbd2826df18", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-102265 affects version 1.7.1.post4+tuxcare of pyjwt." } }, { "id": "CVE-2026-102266", "affects": [ { "ref": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } ], "bom-ref": "urn:uuid:9ec099df-1ece-5683-bad2-0a3bba110e29", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-102266 affects version 1.7.1.post4+tuxcare of pyjwt." } }, { "id": "CVE-2026-102267", "affects": [ { "ref": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } ], "bom-ref": "urn:uuid:d9557884-b9ab-5aa5-a6e3-63d702297063", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-102267 does not affect version 1.7.1.post4+tuxcare of pyjwt. not_affected \u2014 PyJWT 1.7.1.post3+tuxcare is not affected by CVE-2026-102267. The vulnerability affects the PyJWKClient class in jwt/jwks_client.py, which fetches JWKS over HTTP and incorrectly follows redirects. This feature does not exist in version 1.7.1 - the PyJWKClient class and jwt/jwks_client.py module were introduced in later versions of PyJWT (after 1.7.1). The target version lacks any HTTP client fu...", "justification": "code_not_present" } }, { "id": "CVE-2026-102268", "affects": [ { "ref": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } ], "bom-ref": "urn:uuid:4a2c0b38-1c93-587e-8470-61cf81088436", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-102268 is fixed in version 1.7.1.post4+tuxcare of pyjwt." } }, { "id": "CVE-2026-102269", "affects": [ { "ref": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } ], "bom-ref": "urn:uuid:b2e45f33-622a-539c-b16d-9a22e8712273", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-102269 is fixed in version 1.7.1.post4+tuxcare of pyjwt." } }, { "id": "CVE-2026-102270", "affects": [ { "ref": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } ], "bom-ref": "urn:uuid:c85cac03-6854-5cf7-b7c4-6381b68ebd0a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-102270 is fixed in version 1.7.1.post4+tuxcare of pyjwt." } }, { "id": "CVE-2026-102271", "affects": [ { "ref": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } ], "bom-ref": "urn:uuid:ca25145b-0f97-55a2-8485-666b03f6f9e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-102271 affects version 1.7.1.post4+tuxcare of pyjwt." } }, { "id": "CVE-2026-102272", "affects": [ { "ref": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } ], "bom-ref": "urn:uuid:d6aad492-33ec-5a32-8a2b-952353007825", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-102272 affects version 1.7.1.post4+tuxcare of pyjwt." } }, { "id": "CVE-2026-102273", "affects": [ { "ref": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } ], "bom-ref": "urn:uuid:365f2c2d-8c72-57b7-9a29-d9c054de383d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-102273 affects version 1.7.1.post4+tuxcare of pyjwt." } }, { "id": "CVE-2026-102274", "affects": [ { "ref": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } ], "bom-ref": "urn:uuid:2cfa20d2-ddd1-50b1-906f-6f8e7b2532aa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-102274 does not affect version 1.7.1.post4+tuxcare of pyjwt. not_affected \u2014 Version 1.7.1 is not affected by CVE-2026-102274. The vulnerability requires JWK Set parsing infrastructure (PyJWK, PyJWKSet, PyJWKClient classes in jwt/api_jwk.py) that was not yet implemented in version 1.7.1. While the underlying RSAAlgorithm.from_jwk() method that can raise ValueError exists in jwt/algorithms.py, there is no JWK Set iteration logic that would exhibit the vulnerable behavior...", "justification": "code_not_present" } }, { "id": "CVE-2026-102275", "affects": [ { "ref": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } ], "bom-ref": "urn:uuid:b4e396fe-ace9-5000-b130-0f2b052af07b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-102275 does not affect version 1.7.1.post4+tuxcare of pyjwt. not_affected \u2014 Target version 1.7.1.post4+tuxcare predates OKP/EdDSA support entirely. The OKPAlgorithm class and Ed25519/Ed448 key handling were introduced in PyJWT 2.1.0 (per CVE). Version 1.7.1 has no code to receive or process OKP private JWKs, making the vulnerability impossible to manifest. The CVE's affected range (>= 2.1.0, <= 2.14.0) explicitly excludes this older version. Exhaustive searches confirm...", "justification": "code_not_present" } }, { "id": "CVE-2026-103001", "affects": [ { "ref": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } ], "bom-ref": "urn:uuid:c0d8956f-6828-54ca-90d3-1ec2b88aec78", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-103001 does not affect version 1.7.1.post4+tuxcare of pyjwt. not_affected \u2014 PyJWT 1.7.1 is not affected by CVE-2026-103001. The vulnerability pattern (conditional mutation of verify_exp/nbf/iat/aud/iss/sub/jti flags based on verify_signature=False) was introduced in PR #1045 (merged 2025-03-05) via the _merge_options() method. Version 1.7.1 predates this architectural change and uses merge_dict() utility which creates copies instead of mutating caller-supplied dicts. E...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-32597", "affects": [ { "ref": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } ], "bom-ref": "urn:uuid:e0e25597-686c-5e45-960e-af0166a78ce3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32597 is fixed in version 1.7.1.post4+tuxcare of pyjwt." } }, { "id": "CVE-2026-48522", "affects": [ { "ref": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } ], "bom-ref": "urn:uuid:d5f13869-4e9d-5e8c-92aa-741b31809bb8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-48522 does not affect version 1.7.1.post4+tuxcare of pyjwt. not_affected \u2014 Version 1.7.1 is not affected by CVE-2026-48522. The vulnerability concerns PyJWKClient accepting non-HTTP(S) URL schemes (file://, ftp://, data:) without validation, enabling local file read and SSRF. However, PyJWKClient class does not exist in version 1.7.1 - it was introduced in later versions (tested vulnerable in 2.11.0 and 2.12.1). The affected component and its entire remote JWKS fetchi...", "justification": "code_not_present" } }, { "id": "CVE-2026-48523", "affects": [ { "ref": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } ], "bom-ref": "urn:uuid:217dfc5b-5429-58ce-b128-9c89d1264c48", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-48523 does not affect version 1.7.1.post4+tuxcare of pyjwt. not_affected \u2014 Target version 1.7.1 is not affected by CVE-2026-48523. The vulnerability requires the PyJWK class introduced in version 2.9.0 (commit ab8176a). The target predates this feature and has no PyJWK class, no api_jwk.py module, and no isinstance(key, PyJWK) verification path. The target's architecture always uses the algorithm from the JWT header for verification, making the \"algorithm mismatch via...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-48524", "affects": [ { "ref": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } ], "bom-ref": "urn:uuid:252ef340-c736-57d3-8b28-8f76f647325f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-48524 does not affect version 1.7.1.post4+tuxcare of pyjwt. not_affected \u2014 PyJWT version 1.7.1 is not affected by CVE-2026-48524. The vulnerability concerns PyJWKClient.fetch_data() clearing the JWKS cache on fetch errors, enabling unlimited HTTP requests. PyJWKClient was introduced in PyJWT 2.0.0 (2021), and this target version 1.7.1 (2018) predates that feature entirely. No JWKS fetching capability, no cache mechanism, and no code path exists for the vulnerability p...", "justification": "code_not_present" } }, { "id": "CVE-2026-48525", "affects": [ { "ref": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } ], "bom-ref": "urn:uuid:ae501106-2707-5f3b-bdf1-47e83903a238", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-48525 is fixed in version 1.7.1.post4+tuxcare of pyjwt." } }, { "id": "CVE-2026-48526", "affects": [ { "ref": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } ], "bom-ref": "urn:uuid:d27edae5-b9ca-5483-8bc0-0cb17d9ee83c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-48526 is fixed in version 1.7.1.post4+tuxcare of pyjwt." } }, { "id": "GHSA-pxh4-856f-4h89", "affects": [ { "ref": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } ], "bom-ref": "urn:uuid:e374dffe-653d-5fe7-8428-dc102e02995f", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-pxh4-856f-4h89 does not affect version 1.7.1.post4+tuxcare of pyjwt. not_affected \u2014 PyJWT 1.7.1 is not affected by GHSA-pxh4-856f-4h89. The CVE describes a vulnerability where PyJWK/PyJWKSet/PyJWKClient classes bypass the prepare_key() empty-key defense when resolving HMAC keys from JWKs, allowing empty-key forgery attacks. Version 1.7.1 lacks this architectural pattern entirely\u2014PyJWK classes were introduced in later 2.x versions. All documented verification flows in 1.7.1 go ...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } ] }