{
  "@id": "urn:uuid:63a75bda-05a6-4752-a613-881f3ca5d9d5",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 13,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T16:55:15.270861+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-29217 is fixed in version 2.3.0.post1+tuxcare of pyjwt.",
      "vulnerability": {
        "name": "CVE-2022-29217"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-06T09:18:00.239158+00:00",
      "status_notes": "Vulnerability CVE-2026-101917 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare.",
      "vulnerability": {
        "name": "CVE-2026-101917"
      },
      "action_statement": "Vulnerability CVE-2026-101917 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-06T09:18:00.239158+00:00",
      "status_notes": "Vulnerability CVE-2026-101918 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare.",
      "vulnerability": {
        "name": "CVE-2026-101918"
      },
      "action_statement": "Vulnerability CVE-2026-101918 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T19:23:04.118629+00:00",
      "status_notes": "Vulnerability CVE-2026-102265 affects version 2.3.0.post1+tuxcare of pyjwt.",
      "vulnerability": {
        "name": "CVE-2026-102265"
      },
      "action_statement": "Vulnerability CVE-2026-102265 affects version 2.3.0.post1+tuxcare of pyjwt."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T19:23:04.118629+00:00",
      "status_notes": "Vulnerability CVE-2026-102266 affects version 2.3.0.post1+tuxcare of pyjwt.",
      "vulnerability": {
        "name": "CVE-2026-102266"
      },
      "action_statement": "Vulnerability CVE-2026-102266 affects version 2.3.0.post1+tuxcare of pyjwt."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-06T09:18:00.239158+00:00",
      "status_notes": "Vulnerability CVE-2026-102267 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare.",
      "vulnerability": {
        "name": "CVE-2026-102267"
      },
      "action_statement": "Vulnerability CVE-2026-102267 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-06T09:18:00.239158+00:00",
      "status_notes": "Vulnerability CVE-2026-102268 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare.",
      "vulnerability": {
        "name": "CVE-2026-102268"
      },
      "action_statement": "Vulnerability CVE-2026-102268 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-06T09:18:00.239158+00:00",
      "status_notes": "Vulnerability CVE-2026-102269 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare.",
      "vulnerability": {
        "name": "CVE-2026-102269"
      },
      "action_statement": "Vulnerability CVE-2026-102269 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-06T09:18:00.239158+00:00",
      "status_notes": "Vulnerability CVE-2026-102270 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare.",
      "vulnerability": {
        "name": "CVE-2026-102270"
      },
      "action_statement": "Vulnerability CVE-2026-102270 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T18:56:53.865914+00:00",
      "status_notes": "Vulnerability CVE-2026-102271 affects version 2.3.0.post1+tuxcare of pyjwt.",
      "vulnerability": {
        "name": "CVE-2026-102271"
      },
      "action_statement": "Vulnerability CVE-2026-102271 affects version 2.3.0.post1+tuxcare of pyjwt."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T19:23:04.118629+00:00",
      "status_notes": "Vulnerability CVE-2026-102272 affects version 2.3.0.post1+tuxcare of pyjwt.",
      "vulnerability": {
        "name": "CVE-2026-102272"
      },
      "action_statement": "Vulnerability CVE-2026-102272 affects version 2.3.0.post1+tuxcare of pyjwt."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T19:23:04.118629+00:00",
      "status_notes": "Vulnerability CVE-2026-102273 affects version 2.3.0.post1+tuxcare of pyjwt.",
      "vulnerability": {
        "name": "CVE-2026-102273"
      },
      "action_statement": "Vulnerability CVE-2026-102273 affects version 2.3.0.post1+tuxcare of pyjwt."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T18:56:53.865914+00:00",
      "status_notes": "Vulnerability CVE-2026-102274 affects version 2.3.0.post1+tuxcare of pyjwt.",
      "vulnerability": {
        "name": "CVE-2026-102274"
      },
      "action_statement": "Vulnerability CVE-2026-102274 affects version 2.3.0.post1+tuxcare of pyjwt."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-06T09:18:00.239158+00:00",
      "status_notes": "Vulnerability CVE-2026-102275 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare.",
      "vulnerability": {
        "name": "CVE-2026-102275"
      },
      "action_statement": "Vulnerability CVE-2026-102275 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T19:23:04.118629+00:00",
      "status_notes": "Vulnerability CVE-2026-103001 affects version 2.3.0.post1+tuxcare of pyjwt.",
      "vulnerability": {
        "name": "CVE-2026-103001"
      },
      "action_statement": "Vulnerability CVE-2026-103001 affects version 2.3.0.post1+tuxcare of pyjwt."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-32597 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post3+tuxcare.",
      "vulnerability": {
        "name": "CVE-2026-32597"
      },
      "action_statement": "Vulnerability CVE-2026-32597 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post3+tuxcare."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-19T06:50:00.228674+00:00",
      "status_notes": "Vulnerability CVE-2026-48522 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post2+tuxcare.",
      "vulnerability": {
        "name": "CVE-2026-48522"
      },
      "action_statement": "Vulnerability CVE-2026-48522 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post2+tuxcare."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T16:55:15.270861+00:00",
      "status_notes": "Vulnerability CVE-2026-48523 does not affect version 2.3.0.post1+tuxcare of pyjwt. not_affected \u2014 PyJWT 2.3.0.post4+tuxcare is NOT affected by CVE-2026-48523. The vulnerability requires the \"Decode with PyJWK\" feature (commit ab8176abe21e550dbc1c9a6bb7e78ad80853bfb1), which was introduced in version 2.9.0 and is NOT present in this version. In 2.3.0, PyJWK objects cannot be passed directly to jwt.decode() as verification keys - the documented API requires extracting .key first. The attack c...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-48523"
      },
      "impact_statement": "not_affected \u2014 PyJWT 2.3.0.post4+tuxcare is NOT affected by CVE-2026-48523. The vulnerability requires the \"Decode with PyJWK\" feature (commit ab8176abe21e550dbc1c9a6bb7e78ad80853bfb1), which was introduced in version 2.9.0 and is NOT present in this version. In 2.3.0, PyJWK objects cannot be passed directly to jwt.decode() as verification keys - the documented API requires extracting .key first. The attack c..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-48524 does not affect version 2.3.0.post1+tuxcare of pyjwt. not_affected \u2014 Target PyJWT version 2.3.0 is not affected by CVE-2026-48524. The vulnerability requires the jwk_set_cache feature with a finally-block cache-clearing pattern that was introduced in version 2.5.0. Version 2.3.0 predates this feature and uses a simpler lru_cache-based architecture that inherently avoids the cache-clearing behavior.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-48524"
      },
      "impact_statement": "not_affected \u2014 Target PyJWT version 2.3.0 is not affected by CVE-2026-48524. The vulnerability requires the jwk_set_cache feature with a finally-block cache-clearing pattern that was introduced in version 2.5.0. Version 2.3.0 predates this feature and uses a simpler lru_cache-based architecture that inherently avoids the cache-clearing behavior."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-48525 does not affect version 2.3.0.post1+tuxcare of pyjwt. not_affected \u2014 Version 2.3.0.post1+tuxcare does not support RFC 7797 detached payloads (b64=false feature), which is the attack vector for CVE-2026-48525. The vulnerability-specific code path does not exist in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-48525"
      },
      "impact_statement": "not_affected \u2014 Version 2.3.0.post1+tuxcare does not support RFC 7797 detached payloads (b64=false feature), which is the attack vector for CVE-2026-48525. The vulnerability-specific code path does not exist in this version."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-48526 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post2+tuxcare.",
      "vulnerability": {
        "name": "CVE-2026-48526"
      },
      "action_statement": "Vulnerability CVE-2026-48526 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post2+tuxcare."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-27T11:09:00.152346+00:00",
      "status_notes": "Vulnerability GHSA-pxh4-856f-4h89 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post2+tuxcare.",
      "vulnerability": {
        "name": "GHSA-pxh4-856f-4h89"
      },
      "action_statement": "Vulnerability GHSA-pxh4-856f-4h89 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post2+tuxcare."
    }
  ]
}