CVE-2026-101918
Fixed in a distro release EPSS <1%CVSS 5.3
PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a result, documented PyJWT exception handling does not contain the failure. Consequently, an unauthenticated request can raise an exception that may produce an HTTP 500 response. The advisory-defined affected implementation also includes jwt/api_jwt.py, verify_signature=False. This issue is fixed in version 2.15.0.
Products: jpadilla pyjwt
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | pyjwt | 2.15.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2023 | python3-jwt | 2.4.0-1.amzn2023.0.6 |
| Amazon Linux 2023 | python3-jwt+crypto | 2.4.0-1.amzn2023.0.6 |
| Chainguard | airflow-2 | no fix |
| Chainguard | airflow-core-2 | no fix |
| Chainguard | authentik-fips-2026.5 | 2026.5.7-r7 |
| Chainguard | awx | 24.6.1-r67 |
| Chainguard | azureml-inference-server-http | 1.5.1-r11 |
| Chainguard | azureml-inference-server-http-fips | 1.5.1-r10 |
| Chainguard | dagster | 1.13.25-r0 |
| Chainguard | datadog-agent-7.77-core-integrations | no fix |
| Chainguard | datadog-agent-7.78-core-integrations | no fix |
| Chainguard | datadog-agent-7.79-core-integrations | 7.79.2-r21 |
| Chainguard | datadog-agent-7.80-core-integrations | no fix |
| Chainguard | datadog-agent-7.81-core-integrations | no fix |
| Chainguard | datadog-agent-7.82-core-integrations | no fix |
| Chainguard | datadog-agent-7.83-core-integrations | no fix |
| Chainguard | datadog-agent-7.84-core-integrations | 7.84.1-r1 |
| Chainguard | datadog-agent-fips-7.77-core-integrations | no fix |
| Chainguard | datadog-agent-fips-7.78-core-integrations | no fix |
| Chainguard | datadog-agent-fips-7.79-core-integrations | no fix |
| Chainguard | datadog-agent-fips-7.80-core-integrations | no fix |
| Chainguard | datadog-agent-fips-7.81-core-integrations | no fix |
| Chainguard | datadog-agent-fips-7.82-core-integrations | no fix |
| Chainguard | datadog-agent-fips-7.83-core-integrations | no fix |
| Chainguard | datadog-agent-fips-7.84-core-integrations | 7.84.2-r3 |
| Chainguard | datahub-ingestion-fips | 1.7.0.1-r2 |
| Chainguard | ggshield | 1.55.0-r2 |
| Chainguard | keep-api-fips | 0.54.3-r3 |
| Chainguard | kserve-huggingfaceserver-cuda-13.3 | 0.21.0-r4 |
| Chainguard | kserve-storage-controller | 0.21.0-r2 |
| Chainguard | lmcache-cuda-12.8 | 0.5.5-r2 |
| Chainguard | lmcache-cuda-13.0 | 0.5.5-r1 |
| Chainguard | localstack | 4.14.0-r26 |
| Chainguard | metaflow-service-fips | 2.6.1-r2 |
| Chainguard | mlrun | 1.12.0-r1 |
| Chainguard | mlrun-api | 1.12.0-r1 |
| Chainguard | nemo-rl-cuda-13.0-gym | 0.7.0-r2 |
| Chainguard | nemo-rl-cuda-13.0-vllm | 0.7.0-r2 |
| Chainguard | netbox-fips | 4.7.2-r2 |
| Chainguard | open-webui | 0.11.4-r3 |
| Chainguard | openstack-barbican-2025.2 | 21.0.0_git20260928-r2 |
| Chainguard | openstack-barbican-2026.1 | 22.0.0_git20260928-r2 |
| Chainguard | openstack-cinder-2026.1 | 28.0.0_git20260904-r6 |
| Chainguard | openstack-designate-2025.2 | 21.0.1_git20260817-r4 |
| Chainguard | openstack-designate-2026.1 | 22.0.1_git20260827-r4 |
| Chainguard | openstack-glance-2025.1 | 30.2.0_git20260912-r5 |
| Chainguard | openstack-glance-2025.1-fips | 30.2.0_git20260928-r4 |
| Chainguard | openstack-glance-2025.2 | 31.1.0_git20260925-r4 |
| Chainguard | openstack-glance-2025.2-fips | 31.1.0_git20260925-r4 |
| Chainguard | openstack-glance-2026.1 | 32.0.0_git20260930-r3 |
| Chainguard | openstack-glance-2026.1-fips | 32.0.0_git20260930-r3 |
| Chainguard | openstack-heat-2025.2 | 25.0.1_git20260905-r3 |
| Chainguard | openstack-heat-2026.1 | 26.0.1_git20260905-r3 |
| Chainguard | openstack-horizon-2025.1 | 25.3.2_git20260617-r18 |
| Chainguard | openstack-horizon-2025.1-fips | 25.3.2_git20260617-r17 |
| Chainguard | openstack-horizon-2025.2 | 25.5.2_git20260914-r7 |
| Chainguard | openstack-horizon-2025.2-fips | 25.5.2_git20260914-r7 |
| Chainguard | openstack-horizon-2026.1 | 25.7.3_git20260924-r7 |
| Chainguard | openstack-horizon-2026.1-fips | 25.7.3_git20261001-r4 |
| Chainguard | openstack-keystone-2025.1 | 27.0.1_git20260910-r5 |
| Chainguard | openstack-keystone-2025.1-fips | 27.0.1_git20260910-r7 |
| Chainguard | openstack-keystone-2025.2 | 28.0.1_git20260902-r8 |
| Chainguard | openstack-keystone-2025.2-fips | 28.0.1_git20260902-r7 |
| Chainguard | openstack-keystone-2026.1 | 29.0.1_git20260904-r11 |
| Chainguard | openstack-keystone-2026.1-fips | 29.0.1_git20260904-r8 |
| Chainguard | openstack-manila-2025.2 | 21.0.2_git20260923-r3 |
| Chainguard | openstack-manila-2026.1 | 22.0.1_git20260905-r3 |
| Chainguard | openstack-neutron-2026.1 | 28.0.2_git20260928-r5 |
| Chainguard | openstack-nova-2025.1 | 31.3.0_git20260717-r16 |
| Chainguard | openstack-nova-2025.2 | 32.2.0_git20260715-r17 |
| Chainguard | openstack-nova-2026.1 | 33.0.1_git20260819-r14 |
| Chainguard | openstack-octavia-2025.2 | 17.0.1_git20260904-r3 |
| Chainguard | openstack-octavia-2026.1 | 18.0.1_git20260904-r3 |
| Chainguard | openstack-placement-2025.1 | 13.0.0_git20260916-r7 |
| Chainguard | openstack-placement-2025.1-fips | 13.0.0_git20260916-r7 |
| Chainguard | openstack-placement-2025.2 | 14.0.0_git20260916-r8 |
| Chainguard | openstack-placement-2025.2-fips | 14.0.0_git20260916-r7 |
| Chainguard | openstack-placement-2026.1 | 15.0.0_git20260806-r13 |
| Chainguard | openstack-placement-2026.1-fips | 15.0.0_git20260812-r12 |
| Chainguard | py3.12-airflow-3 | 3.3.2-r2 |
| Chainguard | py3.12-airflow-core-3 | 3.3.2-r6 |
| Chainguard | py3.12-airflow-postgres-fips-3 | 3.3.2-r5 |
| Chainguard | py3.13-airflow-3 | 3.3.2-r2 |
| Chainguard | py3.13-airflow-core-3 | 3.3.2-r6 |
| Chainguard | py3.13-airflow-postgres-fips-3 | 3.3.2-r5 |
| Chainguard | py3.14-airflow-3 | 3.3.2-r2 |
| Chainguard | py3.14-airflow-core-3 | 3.3.2-r6 |
| Chainguard | py3.14-airflow-postgres-fips-3 | 3.3.2-r5 |
| Chainguard | request-1276 | 0.30.1-r2 |
| Chainguard | semgrep | 1.178.0-r11 |
| Chainguard | superset-5.0 | 5.0.0-r39 |
| Chainguard | superset-6.0 | 6.0.0-r18 |
| Chainguard | superset-6.1 | 6.1.0-r11 |
| Chainguard | superset-fips-6.1 | 6.1.0-r7 |
| Chainguard | tritonserver-backend-vllm-cuda-13.0 | 25.11-r15 |
| Chainguard | wazuh-manager-framework | 4.14.8-r5 |
| Chainguard | wazuh-manager-framework-fips | 4.14.8-r3 |
| Debian 12 | pyjwt | no fix |
| Debian 13 | pyjwt | no fix |
| Debian 14 | pyjwt | 2.15.0-1 |
| SUSE Linux Enterprise Server 16.0 | python-PyJWT | 2.12.1-160000.3.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | python-PyJWT | 2.12.1-160000.3.1 |
| SUSE Linux Micro 6.0 | python-PyJWT | 2.9.0-159998.1.1 |
| SUSE Linux Micro 6.2 | python-PyJWT | 2.12.1-160000.3.1 |
| Ubuntu 22.04 LTS | pyjwt | 2.3.0-1ubuntu0.6 |
| Ubuntu 22.04 LTS | pyjwt | no fix |
| Ubuntu 24.04 LTS | pyjwt | no fix |
| Ubuntu 24.04 LTS | pyjwt | 2.7.0-1ubuntu0.4 |
| Ubuntu 26.04 LTS | pyjwt | 2.10.1-4ubuntu1.3 |
| Ubuntu 26.04 LTS | pyjwt | no fix |
| Ubuntu 26.10 | pyjwt | 2.13.0-1ubuntu1.1 |
| Ubuntu 26.10 | pyjwt | no fix |
| Ubuntu Pro 16.04 LTS | pyjwt | no fix |
| Ubuntu Pro 16.04 LTS | pyjwt | 1.3.0-1ubuntu0.1+esm4 |
| Ubuntu Pro 18.04 LTS | pyjwt | 1.5.3+ds1-1ubuntu0.1+esm4 |
| Ubuntu Pro 18.04 LTS | pyjwt | no fix |
| Ubuntu Pro 20.04 LTS | pyjwt | no fix |
| Ubuntu Pro 20.04 LTS | pyjwt | 1.7.1-2ubuntu2.1+esm4 |
| Wolfi | datadog-agent-7.77-core-integrations | no fix |
| Wolfi | datadog-agent-7.78-core-integrations | no fix |
| Wolfi | datadog-agent-7.79-core-integrations | 7.79.2-r21 |
| Wolfi | datadog-agent-7.80-core-integrations | no fix |
| Wolfi | datadog-agent-7.81-core-integrations | no fix |
| Wolfi | ggshield | 1.55.0-r2 |
| Wolfi | kserve-storage-controller | 0.21.0-r2 |
| Wolfi | open-webui | 0.11.4-r3 |
| Wolfi | semgrep | 1.178.0-r11 |
| Wolfi | superset-6.0 | 6.0.0-r18 |
| Wolfi | superset-6.1 | 6.1.0-r11 |
| openSUSE Leap 16.0 | python-PyJWT | 2.12.1-160000.3.1 |
| openSUSE Tumbleweed | python-PyJWT | 2.15.1-1.1 |