https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 10:04:42 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2026-48524 <p><strong>Affected:</strong> Alpaquita:25: py3-jwt, Alpaquita:stream: py3-jwt</p> <p><strong>Affected:</strong> Alpaquita:25: py3-jwt, Alpaquita:stream: py3-jwt</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-48524 https://cve.radiocsirt.org/vuln/brew-azure-cli-cve-2026-48524 <p><strong>Affected:</strong> Homebrew: azure-cli</p> <p>&gt; [!NOTE] &gt; The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint behavior (rate limiting, transient errors) which is beyond the attacker&#39;s control. Impact is reduced auth availability until the next successful fetch, not complete denial of service.</p> <p>## Summary PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests.</p> <p>Additionally, fetch_data() finally block clears the JWKS cache on network error.</p> <p>## Root Cause jwt/jwks_client.py:172-198 - get_signing_key(kid) calls get_signing_keys(refresh=True) for unknown kids, bypassing TTL cache with no cooldown. jwt/jwks_client.py:120-122 - finally block writes None to cache on error, clearing valid data.</p> <p>## Impact - DoS against JWKS endpoint (unlimited requests per invalid token) - DoS against application (network I/O latency) - Cascading failure (rate limiting clears cache, breaking legitimate auth)</p> <p>## Suggested Fix 1. Add refresh cooldown (refuse refresh more than once per TTL period) 2. Move cache write from finally to else block</p> <p>## Affected Versions All versions with PyJWKClient (2.4.0 through 2.12.1)</p> <p><strong>Affected:</strong> Homebrew: azure-cli</p> <p>&gt; [!NOTE] &gt; The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint behavior (rate limiting, transient errors) which is beyond the attacker&#39;s control. Impact is reduced auth availability until the next successful fetch, not complete denial of service.</p> <p>## Summary PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests.</p> <p>Additionally, fetch_data() finally block clears the JWKS cache on network error.</p> <p>## Root Cause jwt/jwks_client.py:172-198 - get_signing_key(kid) calls get_signing_keys(refresh=True) for unknown kids, bypassing TTL cache with no cooldown. jwt/jwks_client.py:120-122 - finally block writes None to cache on error, clearing valid data.</p> <p>## Impact - DoS against JWKS endpoint (unlimited requests per invalid token) - DoS against application (network I/O latency) - Cascading failure (rate limiting clears cache, breaking legitimate auth)</p> <p>## Suggested Fix 1. Add refresh cooldown (refuse refresh more than once per TTL period) 2. Move cache write from finally to else block</p> <p>## Affected Versions All versions with PyJWKClient (2.4.0 through 2.12.1)</p> https://cve.radiocsirt.org/vuln/brew-azure-cli-cve-2026-48524 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0933 certfr-2026-avi-0933 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0933 https://cve.radiocsirt.org/vuln/cleanstart-2026-af67526 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: jupyterhub-k8s-hub</p> <p>Multiple security vulnerabilities affect the jupyterhub-k8s-hub package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: jupyterhub-k8s-hub</p> <p>Multiple security vulnerabilities affect the jupyterhub-k8s-hub package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-af67526 https://cve.radiocsirt.org/vuln/euvd-2026-322607 EUVD-2026-322607 https://cve.radiocsirt.org/vuln/euvd-2026-322607 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48524 <p>PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests. The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint behavior (rate limiting, transient errors) which is beyond the attacker&#39;s control. This vulnerability is fixed in 2.13.0.</p> <p>PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests. The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint behavior (rate limiting, transient errors) which is beyond the attacker&#39;s control. This vulnerability is fixed in 2.13.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-48524 https://cve.radiocsirt.org/vuln/ghsa-fhv5-28vv-h8m8 <p><strong>Affected:</strong> PyPI: pyjwt</p> <p>&gt; [!NOTE] &gt; The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint behavior (rate limiting, transient errors) which is beyond the attacker&#39;s control. Impact is reduced auth availability until the next successful fetch, not complete denial of service.</p> <p>## Summary PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests.</p> <p>Additionally, fetch_data() finally block clears the JWKS cache on network error.</p> <p>## Root Cause jwt/jwks_client.py:172-198 - get_signing_key(kid) calls get_signing_keys(refresh=True) for unknown kids, bypassing TTL cache with no cooldown. jwt/jwks_client.py:120-122 - finally block writes None to cache on error, clearing valid data.</p> <p>## Impact - DoS against JWKS endpoint (unlimited requests per invalid token) - DoS against application (network I/O latency) - Cascading failure (rate limiting clears cache, breaking legitimate auth)</p> <p>## Suggested Fix 1. Add refresh cooldown (refuse refresh more than once per TTL period) 2. Move cache write from finally to else block</p> <p>## Affected Versions All versions with PyJWKClient (2.4.0 through 2.12.1)</p> <p><strong>Affected:</strong> PyPI: pyjwt</p> <p>&gt; [!NOTE] &gt; The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint behavior (rate limiting, transient errors) which is beyond the attacker&#39;s control. Impact is reduced auth availability until the next successful fetch, not complete denial of service.</p> <p>## Summary PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests.</p> <p>Additionally, fetch_data() finally block clears the JWKS cache on network error.</p> <p>## Root Cause jwt/jwks_client.py:172-198 - get_signing_key(kid) calls get_signing_keys(refresh=True) for unknown kids, bypassing TTL cache with no cooldown. jwt/jwks_client.py:120-122 - finally block writes None to cache on error, clearing valid data.</p> <p>## Impact - DoS against JWKS endpoint (unlimited requests per invalid token) - DoS against application (network I/O latency) - Cascading failure (rate limiting clears cache, breaking legitimate auth)</p> <p>## Suggested Fix 1. Add refresh cooldown (refuse refresh more than once per TTL period) 2. Move cache write from finally to else block</p> <p>## Affected Versions All versions with PyJWKClient (2.4.0 through 2.12.1)</p> https://cve.radiocsirt.org/vuln/ghsa-fhv5-28vv-h8m8 https://cve.radiocsirt.org/vuln/msrc_cve-2026-48524 msrc_CVE-2026-48524 https://cve.radiocsirt.org/vuln/msrc_cve-2026-48524 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11024-1 <p>python311-PyJWT-2.13.0-1.1 on GA media</p> <p>python311-PyJWT-2.13.0-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11024-1 https://cve.radiocsirt.org/vuln/pysec-2026-177 <p><strong>Affected:</strong> PyPI: pyjwt</p> <p>PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests. The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint behavior (rate limiting, transient errors) which is beyond the attacker&#39;s control. This vulnerability is fixed in 2.13.0.</p> <p><strong>Affected:</strong> PyPI: pyjwt</p> <p>PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests. The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint behavior (rate limiting, transient errors) which is beyond the attacker&#39;s control. This vulnerability is fixed in 2.13.0.</p> https://cve.radiocsirt.org/vuln/pysec-2026-177 https://cve.radiocsirt.org/vuln/suse-su-2026:22138-1 <p>Security update for python-PyJWT</p> <p>Security update for python-PyJWT</p> https://cve.radiocsirt.org/vuln/suse-su-2026:22138-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-48524 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: pyjwt, Ubuntu:25.10: pyjwt, Ubuntu:26.04:LTS: pyjwt</p> <p>PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests. The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint behavior (rate limiting, transient errors) which is beyond the attacker&#39;s control. This vulnerability is fixed in 2.13.0.</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: pyjwt, Ubuntu:25.10: pyjwt, Ubuntu:26.04:LTS: pyjwt</p> <p>PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests. The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint behavior (rate limiting, transient errors) which is beyond the attacker&#39;s control. This vulnerability is fixed in 2.13.0.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-48524