Most recent entries from all

ALSA-2026:12176 — Important: fence-agents security update

Affected: AlmaLinux:8: fence-agents-aliyun, AlmaLinux:8: fence-agents-all, AlmaLinux:8: fence-agents-amt-ws, AlmaLinux:8: fence-agents-apc, AlmaLinux:8: fence-agents-apc-snmp, AlmaLinux:8: fence-agents-aws, AlmaLinux:8: fence-agents-azure-arm, AlmaLinux:8: fence-agents-bladecenter, AlmaLinux:8: fence-agents-brocade, AlmaLinux:8: fence-agents-cisco-mds and 38 more

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

Security Fix(es):

* cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves (CVE-2026-26007) * pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 ?4.1.11 MUST violation) (CVE-2026-32597) * pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-04360

BELL-CVE-2026-32597

Affected: Alpaquita:25: py3-jwt, Alpaquita:stream: py3-jwt

BREW-azure-cli-CVE-2026-32597 — PyJWT accepts unknown `crit` header extensions

Affected: Homebrew: azure-cli

## Summary

PyJWT does not validate the `crit` (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a `crit` array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the **MUST** requirement in the RFC.

This is the same class of vulnerability as CVE-2025-59420 (Authlib), which received CVSS 7.5 (HIGH).

---

## RFC Requirement

RFC 7515 §4.1.11:

> The "crit" (Critical) Header Parameter indicates that extensions to this > specification and/or [JWA] are being used that **MUST** be understood and > processed. [...] If any of the listed extension Header Parameters are > **not understood and supported** by the recipient, then the **JWS is invalid**.

---

## Proof of Concept

```python import jwt # PyJWT 2.8.0 import hmac, hashlib, base64, json

# Construct token with unknown critical extension header = {"alg": "HS256", "crit": ["x-custom-policy"], "x-custom-policy": "require-mfa"} payload = {"sub": "attacker", "role": "admin"}

def b64url(data): return base64.urlsafe_b64encode(data).rstrip(b"=").decode()

h = b64url(json.dumps(header, separators=(",", ":")).encode()) p = b64url(json.dumps(payload, separators=(",", ":")).encode()) sig = b64url(hmac.new(b"secret", f"{h}.{p}".encode(), hashlib.sha256).digest()) token = f"{h}.{p}.{sig}"

# Should REJECT — x-custom-policy is not understood by PyJWT try: result = jwt.decode(token, "secret", algorithms=["HS256"]) print(f"AC…

certfr-2026-avi-0316 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer…

certfr-2026-avi-0316

CLEANSTART-2026-AJ13963 — Security fix for CVE-2026-32597 applied in: airflow-2 2.11.2-r1, airflow-3 3.1.8-r0, airflow-3 3.2.0-r0, jupyterhub-k8s…

Affected: CleanStart: airflow-2, CleanStart: airflow-3, CleanStart: jupyterhub-k8s-hub

CVE-2026-32597 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

EUVD-2026-366111

fkie_cve-2026-32597

PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.

GHSA-752w-5fwx-jx9f — PyJWT accepts unknown `crit` header extensions

Affected: PyPI: PyJWT

## Summary

This is the same class of vulnerability as CVE-2025-59420 (Authlib), which received CVSS 7.5 (HIGH).

---

## RFC Requirement

RFC 7515 §4.1.11:

---

## Proof of Concept

```python import jwt # PyJWT 2.8.0 import hmac, hashlib, base64, json

# Construct token with unknown critical extension header = {"alg": "HS256", "crit": ["x-custom-policy"], "x-custom-policy": "require-mfa"} payload = {"sub": "attacker", "role": "admin"}

def b64url(data): return base64.urlsafe_b64encode(data).rstrip(b"=").decode()

# Should REJECT — x-custom-policy is not understood by PyJWT try: result = jwt.decode(token, "secret", algorithms=["HS256"]) print(f"AC…

msrc_CVE-2026-32597 — PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

msrc_CVE-2026-32597

OESA-2026-3117 — python-jwt security update

Affected: openEuler:22.03-LTS-SP4: python-jwt, openEuler:24.03-LTS-SP1: python-jwt, openEuler:24.03-LTS-SP3: python-jwt, openEuler:24.03-LTS-SP4: python-jwt, openEuler:20.03-LTS-SP4: python-jwt

rm -f tests/test_jwks_client.py -m pytest %endif Security Fix(es):

openSUSE-SU-2026:10397-1 — python311-PyJWT-2.12.1-1.1 on GA media

python311-PyJWT-2.12.1-1.1 on GA media

PYSEC-2026-120

Affected: PyPI: pyjwt

RHSA-2026:10140 — Red Hat Security Advisory: Red Hat Enterprise Linux AI 3.3.1

python: Python: Command-line option injection in webbrowser.open() via crafted URLs python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules net/url: Incorrect parsing of IPv6 host literals in net/url vllm: vLLM: Remote code execution due to hardcoded trust_remote_code setting pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

RLSA-2026:19138 — Important: fence-agents security update

Affected: Rocky Linux:10: fence-agents

Security Fix(es):

* pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 ?4.1.11 MUST violation) (CVE-2026-32597)

* pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2026:1199-1 — Security update for python-PyJWT

Security update for python-PyJWT

UBUNTU-CVE-2026-32597

Affected: Ubuntu:Pro:16.04:LTS: pyjwt, Ubuntu:Pro:18.04:LTS: pyjwt, Ubuntu:Pro:20.04:LTS: pyjwt, Ubuntu:22.04:LTS: pyjwt, Ubuntu:24.04:LTS: pyjwt, Ubuntu:25.10: pyjwt

WID-SEC-W-2026-2933 — Splunk SOAR: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Splunk SOAR ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen SQL-Injection Angriff durchzuführen, um einen Cross-Site Scripting Angriff durchzuführen, und um beliebigen Programmcode auszuführen.