{ "@id": "urn:uuid:3bafb891-deca-44c5-9294-294e7e9d898a", "role": "Document Creator", "author": "https://tuxcare.com", "version": 14, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-29T23:36:00.107520+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2022-29217 affects version 2.8.0.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2022-29217" }, "action_statement": "Vulnerability CVE-2022-29217 affects version 2.8.0.post2+tuxcare of pyjwt." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-45768 is fixed in version 2.8.0.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2025-45768" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-101917 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-101917" }, "action_statement": "Vulnerability CVE-2026-101917 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-101918 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-101918" }, "action_statement": "Vulnerability CVE-2026-101918 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102265 affects version 2.8.0.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102265" }, "action_statement": "Vulnerability CVE-2026-102265 affects version 2.8.0.post2+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102266 affects version 2.8.0.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102266" }, "action_statement": "Vulnerability CVE-2026-102266 affects version 2.8.0.post2+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-102267 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102267" }, "action_statement": "Vulnerability CVE-2026-102267 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-102268 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102268" }, "action_statement": "Vulnerability CVE-2026-102268 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-102269 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102269" }, "action_statement": "Vulnerability CVE-2026-102269 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-102270 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102270" }, "action_statement": "Vulnerability CVE-2026-102270 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-102271 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102271" }, "action_statement": "Vulnerability CVE-2026-102271 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102272 affects version 2.8.0.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102272" }, "action_statement": "Vulnerability CVE-2026-102272 affects version 2.8.0.post2+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102273 affects version 2.8.0.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102273" }, "action_statement": "Vulnerability CVE-2026-102273 affects version 2.8.0.post2+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-102274 affects version 2.8.0.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102274" }, "action_statement": "Vulnerability CVE-2026-102274 affects version 2.8.0.post2+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102275 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-102275" }, "action_statement": "Vulnerability CVE-2026-102275 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T23:36:00.107520+00:00", "status_notes": "Vulnerability CVE-2026-103001 does not affect version 2.8.0.post2+tuxcare of pyjwt. not_affected \u2014 The target PyJWT version 2.8.0.post5+tuxcare is not affected by CVE-2026-103001. The vulnerability (caller-supplied options dict mutation causing claim verification bypass when dict is reused across decode operations) was fixed in upstream commit 3d4d822 (2022-04-05) by Aarni Koskela. This fix was already present in the upstream PyJWT 2.8.0 release that TuxCare onboarded. The CVE describes a re...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-103001" }, "impact_statement": "not_affected \u2014 The target PyJWT version 2.8.0.post5+tuxcare is not affected by CVE-2026-103001. The vulnerability (caller-supplied options dict mutation causing claim verification bypass when dict is reused across decode operations) was fixed in upstream commit 3d4d822 (2022-04-05) by Aarni Koskela. This fix was already present in the upstream PyJWT 2.8.0 release that TuxCare onboarded. The CVE describes a re..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32597 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-32597" }, "action_statement": "Vulnerability CVE-2026-32597 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48522 does not affect version 2.8.0.post2+tuxcare of pyjwt. already_fixed \u2014 CVE-2026-48522: PyJWKClient URI scheme SSRF vulnerability is already fixed in the target repository. The fix was introduced via commit 67029b7 (Backport CVE-2026-48526 to 2.8.0) on 2026-07-13, which added URI scheme validation to reject non-HTTP(S) schemes (file://, ftp://, data:, etc.) before any fetch operation. While the version number was later reverted from 2.8.0.post2+tuxcare to 2.8.0.pos...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48522" }, "impact_statement": "already_fixed \u2014 CVE-2026-48522: PyJWKClient URI scheme SSRF vulnerability is already fixed in the target repository. The fix was introduced via commit 67029b7 (Backport CVE-2026-48526 to 2.8.0) on 2026-07-13, which added URI scheme validation to reject non-HTTP(S) schemes (file://, ftp://, data:, etc.) before any fetch operation. While the version number was later reverted from 2.8.0.post2+tuxcare to 2.8.0.pos..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:54:49.980091+00:00", "status_notes": "Vulnerability CVE-2026-48523 does not affect version 2.8.0.post2+tuxcare of pyjwt. not_affected \u2014 PyJWT 2.8.0 is not affected by CVE-2026-48523. The vulnerability (algorithm allow-list bypass when decoding JWTs with PyJWK keys) was introduced in commit ab8176abe21e550dbc1c9a6bb7e78ad80853bfb1 (\"Decode with PyJWK #886\") in May 2024, first released in version 2.9.0. Version 2.8.0 predates this feature entirely. While PyJWK exists as a class in 2.8.0, it cannot be used with jwt.decode() becaus...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48523" }, "impact_statement": "not_affected \u2014 PyJWT 2.8.0 is not affected by CVE-2026-48523. The vulnerability (algorithm allow-list bypass when decoding JWTs with PyJWK keys) was introduced in commit ab8176abe21e550dbc1c9a6bb7e78ad80853bfb1 (\"Decode with PyJWK #886\") in May 2024, first released in version 2.9.0. Version 2.8.0 predates this feature entirely. While PyJWK exists as a class in 2.8.0, it cannot be used with jwt.decode() becaus..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48524 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-48524" }, "action_statement": "Vulnerability CVE-2026-48524 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48525 does not affect version 2.8.0.post2+tuxcare of pyjwt. pyjwt 2.8.0 is not affected by CVE-2026-48525. The upstream fix (jpadilla/pyjwt@95791b1) forwards the opt-in 'enforce_minimum_key_length' option into sig_options in api_jwt.py; the vulnerability is that setting that option per call had no effect, letting an undersized RSA key through. Branch tuxcare-current/2.8.0 contains none of that machinery (no enforce_minimum_key_length, no sig_options, no InsecureKeyLengthWarning in jwt/). The CVE-2025-45768 backport (796cc35, PYELSCVE-180) instead enforces a minimum 2048-bit RSA key unconditionally in RSAAlgorithm.prepare_key, which no option can disable. Verified on the released 2.8.0.post3+tuxcare wheel from Nexus with a fresh 1024-bit RSA key: rejected with no options, with enforce_minimum_key_length=False and with verify_signature=False; a 2048-bit key still round-trips. MR !18 was changelog-only and has been closed. Jira PYELSCVE-1216.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48525" }, "impact_statement": "pyjwt 2.8.0 is not affected by CVE-2026-48525. The upstream fix (jpadilla/pyjwt@95791b1) forwards the opt-in 'enforce_minimum_key_length' option into sig_options in api_jwt.py; the vulnerability is that setting that option per call had no effect, letting an undersized RSA key through. Branch tuxcare-current/2.8.0 contains none of that machinery (no enforce_minimum_key_length, no sig_options, no InsecureKeyLengthWarning in jwt/). The CVE-2025-45768 backport (796cc35, PYELSCVE-180) instead enforces a minimum 2048-bit RSA key unconditionally in RSAAlgorithm.prepare_key, which no option can disable. Verified on the released 2.8.0.post3+tuxcare wheel from Nexus with a fresh 1024-bit RSA key: rejected with no options, with enforce_minimum_key_length=False and with verify_signature=False; a 2048-bit key still round-trips. MR !18 was changelog-only and has been closed. Jira PYELSCVE-1216." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48526 is fixed in version 2.8.0.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48526" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T17:24:00.162980+00:00", "status_notes": "Vulnerability GHSA-pxh4-856f-4h89 does not affect version 2.8.0.post2+tuxcare of pyjwt. not_affected \u2014 PyJWT 2.8.0.post5+tuxcare contains the vulnerable code pattern (HMACAlgorithm.from_jwk accepts empty k and returns b'' without validation at jwt/algorithms.py:365), but the library's documented verification paths are protected by a runtime defense. The prepare_key method (lines 285-326) validates and rejects empty HMAC keys before any cryptographic operations. All library verification flows rou...", "vulnerability": { "name": "GHSA-pxh4-856f-4h89" }, "impact_statement": "not_affected \u2014 PyJWT 2.8.0.post5+tuxcare contains the vulnerable code pattern (HMACAlgorithm.from_jwk accepts empty k and returns b'' without validation at jwt/algorithms.py:365), but the library's documented verification paths are protected by a runtime defense. The prepare_key method (lines 285-326) validates and rejects empty HMAC keys before any cryptographic operations. All library verification flows rou..." } ] }