{
  "@id": "urn:uuid:62c69df2-dab6-4307-af8f-612d390afd8a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T16:55:15.270861+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-06T09:18:00.239158+00:00",
      "status_notes": "Vulnerability CVE-2022-29217 is fixed in version 2.3.0.post4+tuxcare of pyjwt.",
      "vulnerability": {
        "name": "CVE-2022-29217"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-06T09:18:00.239158+00:00",
      "status_notes": "Vulnerability CVE-2026-101917 is fixed in version 2.3.0.post4+tuxcare of pyjwt.",
      "vulnerability": {
        "name": "CVE-2026-101917"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-06T09:18:00.239158+00:00",
      "status_notes": "Vulnerability CVE-2026-101918 is fixed in version 2.3.0.post4+tuxcare of pyjwt.",
      "vulnerability": {
        "name": "CVE-2026-101918"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T19:23:04.118629+00:00",
      "status_notes": "Vulnerability CVE-2026-102265 affects version 2.3.0.post4+tuxcare of pyjwt.",
      "vulnerability": {
        "name": "CVE-2026-102265"
      },
      "action_statement": "Vulnerability CVE-2026-102265 affects version 2.3.0.post4+tuxcare of pyjwt."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T19:23:04.118629+00:00",
      "status_notes": "Vulnerability CVE-2026-102266 affects version 2.3.0.post4+tuxcare of pyjwt.",
      "vulnerability": {
        "name": "CVE-2026-102266"
      },
      "action_statement": "Vulnerability CVE-2026-102266 affects version 2.3.0.post4+tuxcare of pyjwt."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-06T09:18:00.239158+00:00",
      "status_notes": "Vulnerability CVE-2026-102267 is fixed in version 2.3.0.post4+tuxcare of pyjwt.",
      "vulnerability": {
        "name": "CVE-2026-102267"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-06T09:18:00.239158+00:00",
      "status_notes": "Vulnerability CVE-2026-102268 is fixed in version 2.3.0.post4+tuxcare of pyjwt.",
      "vulnerability": {
        "name": "CVE-2026-102268"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-06T09:18:00.239158+00:00",
      "status_notes": "Vulnerability CVE-2026-102269 is fixed in version 2.3.0.post4+tuxcare of pyjwt.",
      "vulnerability": {
        "name": "CVE-2026-102269"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-06T09:18:00.239158+00:00",
      "status_notes": "Vulnerability CVE-2026-102270 is fixed in version 2.3.0.post4+tuxcare of pyjwt.",
      "vulnerability": {
        "name": "CVE-2026-102270"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T18:56:53.865914+00:00",
      "status_notes": "Vulnerability CVE-2026-102271 affects version 2.3.0.post4+tuxcare of pyjwt.",
      "vulnerability": {
        "name": "CVE-2026-102271"
      },
      "action_statement": "Vulnerability CVE-2026-102271 affects version 2.3.0.post4+tuxcare of pyjwt."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T19:23:04.118629+00:00",
      "status_notes": "Vulnerability CVE-2026-102272 affects version 2.3.0.post4+tuxcare of pyjwt.",
      "vulnerability": {
        "name": "CVE-2026-102272"
      },
      "action_statement": "Vulnerability CVE-2026-102272 affects version 2.3.0.post4+tuxcare of pyjwt."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T19:23:04.118629+00:00",
      "status_notes": "Vulnerability CVE-2026-102273 affects version 2.3.0.post4+tuxcare of pyjwt.",
      "vulnerability": {
        "name": "CVE-2026-102273"
      },
      "action_statement": "Vulnerability CVE-2026-102273 affects version 2.3.0.post4+tuxcare of pyjwt."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T18:56:53.865914+00:00",
      "status_notes": "Vulnerability CVE-2026-102274 affects version 2.3.0.post4+tuxcare of pyjwt.",
      "vulnerability": {
        "name": "CVE-2026-102274"
      },
      "action_statement": "Vulnerability CVE-2026-102274 affects version 2.3.0.post4+tuxcare of pyjwt."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-06T09:18:00.239158+00:00",
      "status_notes": "Vulnerability CVE-2026-102275 is fixed in version 2.3.0.post4+tuxcare of pyjwt.",
      "vulnerability": {
        "name": "CVE-2026-102275"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T19:23:04.118629+00:00",
      "status_notes": "Vulnerability CVE-2026-103001 affects version 2.3.0.post4+tuxcare of pyjwt.",
      "vulnerability": {
        "name": "CVE-2026-103001"
      },
      "action_statement": "Vulnerability CVE-2026-103001 affects version 2.3.0.post4+tuxcare of pyjwt."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-06T09:18:00.239158+00:00",
      "status_notes": "Vulnerability CVE-2026-32597 is fixed in version 2.3.0.post4+tuxcare of pyjwt.",
      "vulnerability": {
        "name": "CVE-2026-32597"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-19T06:50:00.228674+00:00",
      "status_notes": "Vulnerability CVE-2026-48522 is fixed in version 2.3.0.post4+tuxcare of pyjwt.",
      "vulnerability": {
        "name": "CVE-2026-48522"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T16:55:15.270861+00:00",
      "status_notes": "Vulnerability CVE-2026-48523 does not affect version 2.3.0.post4+tuxcare of pyjwt. not_affected \u2014 PyJWT 2.3.0.post4+tuxcare is NOT affected by CVE-2026-48523. The vulnerability requires the \"Decode with PyJWK\" feature (commit ab8176abe21e550dbc1c9a6bb7e78ad80853bfb1), which was introduced in version 2.9.0 and is NOT present in this version. In 2.3.0, PyJWK objects cannot be passed directly to jwt.decode() as verification keys - the documented API requires extracting .key first. The attack c...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-48523"
      },
      "impact_statement": "not_affected \u2014 PyJWT 2.3.0.post4+tuxcare is NOT affected by CVE-2026-48523. The vulnerability requires the \"Decode with PyJWK\" feature (commit ab8176abe21e550dbc1c9a6bb7e78ad80853bfb1), which was introduced in version 2.9.0 and is NOT present in this version. In 2.3.0, PyJWK objects cannot be passed directly to jwt.decode() as verification keys - the documented API requires extracting .key first. The attack c..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-06T09:18:00.239158+00:00",
      "status_notes": "Vulnerability CVE-2026-48524 does not affect version 2.3.0.post4+tuxcare of pyjwt. not_affected \u2014 Target PyJWT version 2.3.0 is not affected by CVE-2026-48524. The vulnerability requires the jwk_set_cache feature with a finally-block cache-clearing pattern that was introduced in version 2.5.0. Version 2.3.0 predates this feature and uses a simpler lru_cache-based architecture that inherently avoids the cache-clearing behavior.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-48524"
      },
      "impact_statement": "not_affected \u2014 Target PyJWT version 2.3.0 is not affected by CVE-2026-48524. The vulnerability requires the jwk_set_cache feature with a finally-block cache-clearing pattern that was introduced in version 2.5.0. Version 2.3.0 predates this feature and uses a simpler lru_cache-based architecture that inherently avoids the cache-clearing behavior."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-06T09:18:00.239158+00:00",
      "status_notes": "Vulnerability CVE-2026-48525 does not affect version 2.3.0.post4+tuxcare of pyjwt. not_affected \u2014 Version 2.3.0.post1+tuxcare does not support RFC 7797 detached payloads (b64=false feature), which is the attack vector for CVE-2026-48525. The vulnerability-specific code path does not exist in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-48525"
      },
      "impact_statement": "not_affected \u2014 Version 2.3.0.post1+tuxcare does not support RFC 7797 detached payloads (b64=false feature), which is the attack vector for CVE-2026-48525. The vulnerability-specific code path does not exist in this version."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-06T09:18:00.239158+00:00",
      "status_notes": "Vulnerability CVE-2026-48526 is fixed in version 2.3.0.post4+tuxcare of pyjwt.",
      "vulnerability": {
        "name": "CVE-2026-48526"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare",
          "identifiers": {
            "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-27T11:09:00.152346+00:00",
      "status_notes": "Vulnerability GHSA-pxh4-856f-4h89 is fixed in version 2.3.0.post4+tuxcare of pyjwt.",
      "vulnerability": {
        "name": "GHSA-pxh4-856f-4h89"
      }
    }
  ]
}