CVE-2026-48525
Fixed in a distro release EPSS <1%CVSS 5.3
PyJWT is a JSON Web Token implementation in Python. From 2.8.0 to 2.12.1, when verifying detached JWS tokens using the unencoded-payload option ("b64": false, RFC 7797), PyJWT performs Base64URL decoding of the compact-serialization payload segment before enforcing the detached-payload rules. For b64=false, PyJWT later discards that decoded payload and replaces it with the caller-provided detached_payload. In practice, this turns the middle segment into an attacker-controlled “work amplifier”: a remote client can supply an arbitrarily large Base64URL payload segment that forces CPU work + memory allocations even if the signature is invalid. This creates an unauthenticated DoS vector against any endpoint that verifies detached JWS using PyJWT. This vulnerability is fixed in 2.13.0.
Products: jpadilla pyjwt
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | pyjwt | 2.13.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2023 | python3-jwt | 2.4.0-1.amzn2023.0.5 |
| Amazon Linux 2023 | python3-jwt+crypto | 2.4.0-1.amzn2023.0.5 |
| Chainguard | airflow-2 | 2.11.2-r25 |
| Chainguard | airflow-core-2 | 2.11.2-r10 |
| Chainguard | airflow-core-3 | 3.2.2-r5 |
| Chainguard | airflow-postgres-fips-3 | 3.2.2-r3 |
| Chainguard | awx | 24.6.1-r41 |
| Chainguard | datadog-agent-7.71-core-integrations | no fix |
| Chainguard | datadog-agent-7.72-core-integrations | no fix |
| Chainguard | datadog-agent-7.73-core-integrations | 7.73.3-r23 |
| Chainguard | datadog-agent-7.74-core-integrations | 7.74.1-r24 |
| Chainguard | datadog-agent-7.75-core-integrations | no fix |
| Chainguard | datadog-agent-7.76 | no fix |
| Chainguard | datadog-agent-7.76-core-integrations | 7.76.3-r26 |
| Chainguard | datadog-agent-7.77-core-integrations | 7.77.3-r16 |
| Chainguard | datadog-agent-7.78-core-integrations | 7.78.4-r10 |
| Chainguard | datadog-agent-7.79-core-integrations | 7.79.2-r6 |
| Chainguard | datadog-agent-7.80-core-integrations | 7.80.4-r3 |
| Chainguard | datadog-agent-fips-7.71-core-integrations | no fix |
| Chainguard | datadog-agent-fips-7.72-core-integrations | no fix |
| Chainguard | datadog-agent-fips-7.73-core-integrations | 7.73.3-r21 |
| Chainguard | datadog-agent-fips-7.74-core-integrations | 7.74.1-r26 |
| Chainguard | datadog-agent-fips-7.75-core-integrations | no fix |
| Chainguard | datadog-agent-fips-7.76-core-integrations | 7.76.3-r24 |
| Chainguard | datadog-agent-fips-7.77-core-integrations | 7.77.3-r17 |
| Chainguard | datadog-agent-fips-7.78-core-integrations | 7.78.4-r8 |
| Chainguard | datadog-agent-fips-7.79-core-integrations | 7.79.2-r2 |
| Chainguard | datadog-agent-fips-7.80-core-integrations | 7.80.4-r4 |
| Chainguard | ggshield | 1.52.2-r1 |
| Chainguard | kserve | 0.20.0-r7 |
| Chainguard | kserve-localmodel | 0.20.0-r7 |
| Chainguard | kserve-storage-controller | no fix |
| Chainguard | kserve-storage-controller | 0.19.0-r2 |
| Chainguard | litellm | 1.89.0-r4 |
| Chainguard | metaflow-service-fips | 2.5.0-r5 |
| Chainguard | netbox | 4.6.3-r2 |
| Chainguard | netbox-fips | 4.6.3-r2 |
| Chainguard | openstack-glance-2025.1 | 30.2.0_git20260616-r1 |
| Chainguard | openstack-glance-2025.1-fips | 30.2.0_git20260511-r5 |
| Chainguard | openstack-glance-2025.2 | 31.1.0_git20260617-r1 |
| Chainguard | openstack-glance-2025.2-fips | 31.1.0_git20260617-r0 |
| Chainguard | openstack-glance-2026.1 | 32.0.0_git20260617-r1 |
| Chainguard | openstack-glance-2026.1-fips | 32.0.0_git20260617-r1 |
| Chainguard | openstack-horizon-2025.1 | 25.3.2_git20260617-r1 |
| Chainguard | openstack-horizon-2025.1-fips | 25.3.2_git20260617-r0 |
| Chainguard | openstack-horizon-2025.2 | 25.5.2_git20260617-r2 |
| Chainguard | openstack-horizon-2025.2-fips | 25.5.2_git20260617-r1 |
| Chainguard | openstack-horizon-2026.1 | 25.7.3_git20260624-r1 |
| Chainguard | openstack-horizon-2026.1-fips | 25.7.3_git20260611-r3 |
| Chainguard | openstack-keystone-2025.1 | 27.0.1_git20260618-r4 |
| Chainguard | openstack-keystone-2025.1-fips | 27.0.1_git20260618-r2 |
| Chainguard | openstack-keystone-2025.2 | 28.0.1_git20260618-r3 |
| Chainguard | openstack-keystone-2025.2-fips | 28.0.1_git20260616-r1 |
| Chainguard | openstack-keystone-2026.1 | 29.0.1_git20260616-r4 |
| Chainguard | openstack-keystone-2026.1-fips | 29.0.1_git20260603-r6 |
| Chainguard | openstack-placement-2025.1 | 13.0.0_git20260617-r2 |
| Chainguard | openstack-placement-2025.1-fips | 13.0.0_git20260617-r1 |
| Chainguard | openstack-placement-2025.2 | 14.0.0_git20260617-r2 |
| Chainguard | openstack-placement-2025.2-fips | 14.0.0_git20260309-r1 |
| Chainguard | openstack-placement-2026.1 | 15.0.0_git20260617-r2 |
| Chainguard | openstack-placement-2026.1-fips | 15.0.0_git20260311-r1 |
| Chainguard | superset-5.0 | 5.0.0-r26 |
| Chainguard | superset-6.0 | 6.0.0-r17 |
| Chainguard | superset-6.1 | 6.1.0-r2 |
| Chainguard | superset-fips-6.1 | 6.1.0-r1 |
| Chainguard | wazuh-manager-framework | 4.14.5-r5 |
| Chainguard | wazuh-manager-framework-fips | 4.14.5-r5 |
| Debian 12 | pyjwt | no fix |
| Debian 13 | pyjwt | no fix |
| Debian 14 | pyjwt | 2.13.0-1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | python-PyJWT | 2.8.0-150400.8.13.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | python-PyJWT | 2.4.0-150200.3.14.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | python-PyJWT | 2.8.0-150400.8.13.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | python-PyJWT | 2.4.0-150200.3.14.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | python-PyJWT | 2.8.0-150400.8.13.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | python-PyJWT | 2.4.0-150200.3.14.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | python-PyJWT | 2.8.0-150400.8.13.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | python-PyJWT | 2.4.0-150200.3.14.1 |
| SUSE Linux Enterprise Micro 5.5 | python-PyJWT | 2.4.0-150200.3.14.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | python-PyJWT | 2.4.0-150200.3.14.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | python-PyJWT | 2.8.0-150400.8.13.1 |
| SUSE Linux Enterprise Module for Python 3 15 SP7 | python-PyJWT | 2.8.0-150400.8.13.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | python-PyJWT | 2.4.0-150200.3.14.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | python-PyJWT | 2.8.0-150400.8.13.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | python-PyJWT | 2.8.0-150400.8.13.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | python-PyJWT | 2.4.0-150200.3.14.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | python-PyJWT | 2.8.0-150400.8.13.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | python-PyJWT | 2.4.0-150200.3.14.1 |
| SUSE Linux Enterprise Server 16.0 | python-PyJWT | 2.12.1-160000.2.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | python-PyJWT | 2.4.0-150200.3.14.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | python-PyJWT | 2.8.0-150400.8.13.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | python-PyJWT | 2.4.0-150200.3.14.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | python-PyJWT | 2.8.0-150400.8.13.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | python-PyJWT | 2.8.0-150400.8.13.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | python-PyJWT | 2.4.0-150200.3.14.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | python-PyJWT | 2.12.1-160000.2.1 |
| SUSE Linux Micro 6.0 | python-PyJWT | 2.9.0-3.1 |
| SUSE Linux Micro 6.1 | python-PyJWT | 2.12.1-slfo.1.1_2.1 |
| SUSE Linux Micro 6.2 | python-PyJWT | 2.12.1-160000.2.1 |
| Ubuntu 22.04 LTS | pyjwt | 2.3.0-1ubuntu0.4 |
| Ubuntu 24.04 LTS | pyjwt | 2.7.0-1ubuntu0.2 |
| Ubuntu 25.10 | pyjwt | no fix |
| Ubuntu 26.04 LTS | pyjwt | 2.10.1-4ubuntu1.1 |
| Ubuntu Pro 16.04 LTS | pyjwt | 1.3.0-1ubuntu0.1+esm2 |
| Ubuntu Pro 18.04 LTS | pyjwt | 1.5.3+ds1-1ubuntu0.1+esm2 |
| Ubuntu Pro 20.04 LTS | pyjwt | 1.7.1-2ubuntu2.1+esm2 |
| Wolfi | datadog-agent-7.72-core-integrations | no fix |
| Wolfi | datadog-agent-7.73-core-integrations | 7.73.3-r23 |
| Wolfi | datadog-agent-7.74-core-integrations | 7.74.1-r24 |
| Wolfi | datadog-agent-7.75-core-integrations | no fix |
| Wolfi | datadog-agent-7.76 | no fix |
| Wolfi | datadog-agent-7.76-core-integrations | 7.76.3-r26 |
| Wolfi | datadog-agent-7.77-core-integrations | 7.77.3-r16 |
| Wolfi | datadog-agent-7.78-core-integrations | 7.78.4-r10 |
| Wolfi | datadog-agent-7.79-core-integrations | 7.79.2-r6 |
| Wolfi | datadog-agent-7.80-core-integrations | 7.80.4-r3 |
| Wolfi | ggshield | 1.52.2-r1 |
| Wolfi | kserve | 0.20.0-r7 |
| Wolfi | kserve-localmodel | 0.20.0-r7 |
| Wolfi | kserve-storage-controller | 0.19.0-r2 |
| Wolfi | kserve-storage-controller | no fix |
| Wolfi | superset-6.0 | 6.0.0-r17 |
| Wolfi | superset-6.1 | 6.1.0-r2 |
| openSUSE Leap 16.0 | python-PyJWT | 2.12.1-160000.2.1 |
| openSUSE Tumbleweed | python-PyJWT | 2.13.0-1.1 |