{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "jpadilla pyjwt: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/jpadilla--pyjwt/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/jpadilla--pyjwt/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102273/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102273/",
   "title": "CVE-2026-102273 · jpadilla pyjwt · disclosed",
   "content_text": "PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric algorithms and passes a public JWK container as the raw key. As a result, public asymmetric key material is accepted as the HMAC secret. Consequently, an attacker who knows the public key can forge a token with arbitrary authenticated claims. This issue is fixed in version 2.14.0.",
   "date_published": "2026-09-28T20:38:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102273/fixed/amazon-linux-2023",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102273/",
   "title": "CVE-2026-102273 · jpadilla pyjwt · fixed in Amazon Linux 2023 (python3-jwt 2.4.0-1.amzn2023.0.6 and 1 more)",
   "content_text": "Fixed versions: python3-jwt 2.4.0-1.amzn2023.0.6, python3-jwt+crypto 2.4.0-1.amzn2023.0.6.",
   "date_published": "2026-09-28T20:38:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102273/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102273/",
   "title": "CVE-2026-102273 · jpadilla pyjwt · fixed in Chainguard (authentik-2026.5 2026.5.7-r4 and 69 more)",
   "content_text": "Fixed versions: authentik-2026.5 2026.5.7-r4, authentik-fips-2026.5 2026.5.7-r7, azureml-inference-server-http-fips 1.5.1-r9, datadog-agent-7.77-core-integrations 7.77.3-r26, datadog-agent-7.79-core-integrations 7.79.2-r20, datadog-agent-7.80-core-integrations 7.80.4-r19, datadog-agent-7.81-core-integrations 7.81.3-r8, datadog-agent-7.82-core-integrations 7.82.3-r5, datadog-agent-7.83-core-integrations 7.83.3-r2, datadog-agent-7.84-core-integrations 7.84.1-r1, datadog-agent-fips-7.77-core-integrations 7.77.3-r38, datadog-agent-fips-7.79-core-integrations 7.79.2-r18, datadog-agent-fips-7.80-core-integrations 7.80.4-r21, datadog-agent-fips-7.81-core-integrations 7.81.3-r12, datadog-agent-fips-7.82-core-integrations 7.82.3-r8, datadog-agent-fips-7.83-core-integrations 7.83.3-r3, datadog-agent-fips-7.84-core-integrations 7.84.2-r3, datahub-ingestion 1.7.0.1-r2, datahub-ingestion-fips 1.7.0.1-r1, ggshield 1.55.0-r1, kserve-huggingfaceserver-cuda-13.3 0.21.0-r4, kserve-storage-controller 0.21.0-r1, litellm 1.103.1-r1, mcp-atlassian 0.23.1-r2, metaflow-service-fips 2.6.1-r1, nemo-rl-cuda-13.0-gym 0.7.0-r2, nemo-rl-cuda-13.0-vllm 0.7.0-r2, netbox-fips 4.7.2-r1, open-webui 0.11.4-r1, openstack-cinder-2026.1 28.0.0_git20260904-r4, openstack-designate-2025.2 21.0.1_git20260817-r2, openstack-designate-2026.1 22.0.1_git20260827-r2, openstack-glance-2025.1 30.2.0_git20260912-r2, openstack-glance-2025.1-fips 30.2.0_git20260928-r1, openstack-glance-2025.2-fips 31.1.0_git20260925-r1, openstack-glance-2026.1-fips 32.0.0_git20260930-r1, openstack-heat-2025.2 25.0.1_git20260905-r1, openstack-heat-2026.1 26.0.1_git20260905-r1, openstack-horizon-2025.1 25.3.2_git20260617-r13, openstack-horizon-2025.1-fips 25.3.2_git20260617-r12, openstack-horizon-2025.2 25.5.2_git20260914-r3, openstack-horizon-2025.2-fips 25.5.2_git20260914-r2, openstack-horizon-2026.1 25.7.3_git20260924-r3, openstack-keystone-2025.1-fips 27.0.1_git20260910-r4, openstack-keystone-2025.2-fips 28.0.1_git20260902-r4, openstack-keystone-2026.1 29.0.1_git20260904-r8, openstack-manila-2025.2 21.0.2_git20260923-r1, openstack-manila-2026.1 22.0.1_git20260905-r1, openstack-neutron-2026.1 28.0.2_git20260928-r3, openstack-nova-2025.1 31.3.0_git20260717-r13, openstack-nova-2025.2 32.2.0_git20260715-r14, openstack-octavia-2025.2 17.0.1_git20260904-r1, openstack-octavia-2026.1 18.0.1_git20260904-r1, openstack-placement-2025.1 13.0.0_git20260916-r4, openstack-placement-2025.1-fips 13.0.0_git20260916-r4, openstack-placement-2025.2 14.0.0_git20260916-r5, openstack-placement-2025.2-fips 14.0.0_git20260916-r4, openstack-placement-2026.1 15.0.0_git20260806-r11, openstack-placement-2026.1-fips 15.0.0_git20260812-r9, py3-cassandra-medusa 0.30.1-r1, py3.12-airflow-core-3 3.3.2-r2, py3.12-airflow-postgres-fips-3 3.3.2-r1, py3.13-airflow-core-3 3.3.2-r2, py3.13-airflow-postgres-fips-3 3.3.2-r1, py3.14-airflow-core-3 3.3.2-r2, py3.14-airflow-postgres-fips-3 3.3.2-r1, semgrep 1.178.0-r6, superset-5.0 5.0.0-r36, superset-6.1 6.1.0-r10, superset-fips-6.1 6.1.0-r7.",
   "date_published": "2026-09-28T20:38:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102273/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102273/",
   "title": "CVE-2026-102273 · jpadilla pyjwt · fixed in Debian 14 (pyjwt 2.14.0-1)",
   "content_text": "Fixed versions: pyjwt 2.14.0-1.",
   "date_published": "2026-09-28T20:38:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102273/fixed/pypi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102273/",
   "title": "CVE-2026-102273 · jpadilla pyjwt · fixed upstream (PyPI)",
   "content_text": "Fixed versions: pyjwt 2.14.0.",
   "date_published": "2026-09-28T20:38:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102273/fixed/ubuntu-22.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102273/",
   "title": "CVE-2026-102273 · jpadilla pyjwt · fixed in Ubuntu 22.04 LTS (pyjwt 2.3.0-1ubuntu0.5)",
   "content_text": "Fixed versions: pyjwt 2.3.0-1ubuntu0.5.",
   "date_published": "2026-09-28T20:38:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102273/fixed/ubuntu-24.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102273/",
   "title": "CVE-2026-102273 · jpadilla pyjwt · fixed in Ubuntu 24.04 LTS (pyjwt 2.7.0-1ubuntu0.3)",
   "content_text": "Fixed versions: pyjwt 2.7.0-1ubuntu0.3.",
   "date_published": "2026-09-28T20:38:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102273/fixed/ubuntu-26.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102273/",
   "title": "CVE-2026-102273 · jpadilla pyjwt · fixed in Ubuntu 26.04 LTS (pyjwt 2.10.1-4ubuntu1.2)",
   "content_text": "Fixed versions: pyjwt 2.10.1-4ubuntu1.2.",
   "date_published": "2026-09-28T20:38:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102273/fixed/ubuntu-26.10",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102273/",
   "title": "CVE-2026-102273 · jpadilla pyjwt · fixed in Ubuntu 26.10 (pyjwt 2.13.0-1ubuntu1)",
   "content_text": "Fixed versions: pyjwt 2.13.0-1ubuntu1.",
   "date_published": "2026-09-28T20:38:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102273/fixed/ubuntu-pro-16.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102273/",
   "title": "CVE-2026-102273 · jpadilla pyjwt · fixed in Ubuntu Pro 16.04 LTS (pyjwt 1.3.0-1ubuntu0.1+esm3)",
   "content_text": "Fixed versions: pyjwt 1.3.0-1ubuntu0.1+esm3.",
   "date_published": "2026-09-28T20:38:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102273/fixed/ubuntu-pro-18.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102273/",
   "title": "CVE-2026-102273 · jpadilla pyjwt · fixed in Ubuntu Pro 18.04 LTS (pyjwt 1.5.3+ds1-1ubuntu0.1+esm3)",
   "content_text": "Fixed versions: pyjwt 1.5.3+ds1-1ubuntu0.1+esm3.",
   "date_published": "2026-09-28T20:38:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102273/fixed/ubuntu-pro-20.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102273/",
   "title": "CVE-2026-102273 · jpadilla pyjwt · fixed in Ubuntu Pro 20.04 LTS (pyjwt 1.7.1-2ubuntu2.1+esm3)",
   "content_text": "Fixed versions: pyjwt 1.7.1-2ubuntu2.1+esm3.",
   "date_published": "2026-09-28T20:38:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102273/fixed/wolfi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102273/",
   "title": "CVE-2026-102273 · jpadilla pyjwt · fixed in Wolfi (datadog-agent-7.77-core-integrations 7.77.3-r26 and 9 more)",
   "content_text": "Fixed versions: datadog-agent-7.77-core-integrations 7.77.3-r26, datadog-agent-7.79-core-integrations 7.79.2-r20, datadog-agent-7.80-core-integrations 7.80.4-r19, datadog-agent-7.81-core-integrations 7.81.3-r8, ggshield 1.55.0-r1, kserve-storage-controller 0.21.0-r1, open-webui 0.11.4-r1, py3-cassandra-medusa 0.30.1-r1, semgrep 1.178.0-r6, superset-6.1 6.1.0-r10.",
   "date_published": "2026-09-28T20:38:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102272/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102272/",
   "title": "CVE-2026-102272 · jpadilla pyjwt · disclosed",
   "content_text": "PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge authenticated tokens. This issue is fixed in version 2.14.0.",
   "date_published": "2026-09-28T20:36:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102272/fixed/amazon-linux-2023",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102272/",
   "title": "CVE-2026-102272 · jpadilla pyjwt · fixed in Amazon Linux 2023 (python3-jwt 2.4.0-1.amzn2023.0.6 and 1 more)",
   "content_text": "Fixed versions: python3-jwt 2.4.0-1.amzn2023.0.6, python3-jwt+crypto 2.4.0-1.amzn2023.0.6.",
   "date_published": "2026-09-28T20:36:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102272/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102272/",
   "title": "CVE-2026-102272 · jpadilla pyjwt · fixed in Chainguard (authentik-2026.5 2026.5.7-r4 and 68 more)",
   "content_text": "Fixed versions: authentik-2026.5 2026.5.7-r4, authentik-fips-2026.5 2026.5.7-r7, azureml-inference-server-http-fips 1.5.1-r9, datadog-agent-7.77-core-integrations 7.77.3-r26, datadog-agent-7.79-core-integrations 7.79.2-r20, datadog-agent-7.81-core-integrations 7.81.3-r8, datadog-agent-7.82-core-integrations 7.82.3-r5, datadog-agent-7.83-core-integrations 7.83.3-r2, datadog-agent-7.84-core-integrations 7.84.1-r1, datadog-agent-fips-7.77-core-integrations 7.77.3-r38, datadog-agent-fips-7.79-core-integrations 7.79.2-r18, datadog-agent-fips-7.80-core-integrations 7.80.4-r21, datadog-agent-fips-7.81-core-integrations 7.81.3-r12, datadog-agent-fips-7.82-core-integrations 7.82.3-r8, datadog-agent-fips-7.83-core-integrations 7.83.3-r3, datadog-agent-fips-7.84-core-integrations 7.84.2-r3, datahub-ingestion 1.7.0.1-r2, datahub-ingestion-fips 1.7.0.1-r1, ggshield 1.55.0-r1, kserve-huggingfaceserver-cuda-13.3 0.21.0-r4, kserve-storage-controller 0.21.0-r1, litellm 1.103.1-r1, mcp-atlassian 0.23.1-r2, metaflow-service-fips 2.6.1-r1, nemo-rl-cuda-13.0-gym 0.7.0-r2, nemo-rl-cuda-13.0-vllm 0.7.0-r2, netbox-fips 4.7.2-r1, open-webui 0.11.4-r1, openstack-cinder-2026.1 28.0.0_git20260904-r4, openstack-designate-2025.2 21.0.1_git20260817-r2, openstack-designate-2026.1 22.0.1_git20260827-r2, openstack-glance-2025.1 30.2.0_git20260912-r2, openstack-glance-2025.1-fips 30.2.0_git20260928-r1, openstack-glance-2025.2-fips 31.1.0_git20260925-r1, openstack-glance-2026.1-fips 32.0.0_git20260930-r1, openstack-heat-2025.2 25.0.1_git20260905-r1, openstack-heat-2026.1 26.0.1_git20260905-r1, openstack-horizon-2025.1 25.3.2_git20260617-r13, openstack-horizon-2025.2 25.5.2_git20260914-r3, openstack-horizon-2025.2-fips 25.5.2_git20260914-r2, openstack-horizon-2026.1 25.7.3_git20260924-r3, openstack-keystone-2025.1-fips 27.0.1_git20260910-r4, openstack-keystone-2025.2-fips 28.0.1_git20260902-r4, openstack-keystone-2026.1 29.0.1_git20260904-r8, openstack-manila-2025.2 21.0.2_git20260923-r1, openstack-manila-2026.1 22.0.1_git20260905-r1, openstack-neutron-2026.1 28.0.2_git20260928-r3, openstack-nova-2025.1 31.3.0_git20260717-r13, openstack-nova-2025.2 32.2.0_git20260715-r14, openstack-nova-2026.1 33.0.1_git20260819-r12, openstack-octavia-2025.2 17.0.1_git20260904-r1, openstack-octavia-2026.1 18.0.1_git20260904-r1, openstack-placement-2025.1 13.0.0_git20260916-r4, openstack-placement-2025.1-fips 13.0.0_git20260916-r4, openstack-placement-2025.2 14.0.0_git20260916-r5, openstack-placement-2025.2-fips 14.0.0_git20260916-r4, openstack-placement-2026.1 15.0.0_git20260806-r11, openstack-placement-2026.1-fips 15.0.0_git20260812-r9, py3-cassandra-medusa 0.30.1-r1, py3.12-airflow-core-3 3.3.2-r2, py3.12-airflow-postgres-fips-3 3.3.2-r1, py3.13-airflow-core-3 3.3.2-r2, py3.13-airflow-postgres-fips-3 3.3.2-r1, py3.14-airflow-core-3 3.3.2-r2, py3.14-airflow-postgres-fips-3 3.3.2-r1, semgrep 1.178.0-r6, superset-5.0 5.0.0-r36, superset-6.1 6.1.0-r10, superset-fips-6.1 6.1.0-r7.",
   "date_published": "2026-09-28T20:36:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102272/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102272/",
   "title": "CVE-2026-102272 · jpadilla pyjwt · fixed in Debian 14 (pyjwt 2.14.0-1)",
   "content_text": "Fixed versions: pyjwt 2.14.0-1.",
   "date_published": "2026-09-28T20:36:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102272/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102272/",
   "title": "CVE-2026-102272 · jpadilla pyjwt · fixed in openSUSE Tumbleweed (python-PyJWT 2.15.1-1.1)",
   "content_text": "Fixed versions: python-PyJWT 2.15.1-1.1.",
   "date_published": "2026-09-28T20:36:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102272/fixed/pypi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102272/",
   "title": "CVE-2026-102272 · jpadilla pyjwt · fixed upstream (PyPI)",
   "content_text": "Fixed versions: pyjwt 2.14.0.",
   "date_published": "2026-09-28T20:36:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102272/fixed/ubuntu-22.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102272/",
   "title": "CVE-2026-102272 · jpadilla pyjwt · fixed in Ubuntu 22.04 LTS (pyjwt 2.3.0-1ubuntu0.5)",
   "content_text": "Fixed versions: pyjwt 2.3.0-1ubuntu0.5.",
   "date_published": "2026-09-28T20:36:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102272/fixed/ubuntu-24.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102272/",
   "title": "CVE-2026-102272 · jpadilla pyjwt · fixed in Ubuntu 24.04 LTS (pyjwt 2.7.0-1ubuntu0.3)",
   "content_text": "Fixed versions: pyjwt 2.7.0-1ubuntu0.3.",
   "date_published": "2026-09-28T20:36:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102272/fixed/ubuntu-26.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102272/",
   "title": "CVE-2026-102272 · jpadilla pyjwt · fixed in Ubuntu 26.04 LTS (pyjwt 2.10.1-4ubuntu1.2)",
   "content_text": "Fixed versions: pyjwt 2.10.1-4ubuntu1.2.",
   "date_published": "2026-09-28T20:36:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102272/fixed/ubuntu-26.10",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102272/",
   "title": "CVE-2026-102272 · jpadilla pyjwt · fixed in Ubuntu 26.10 (pyjwt 2.13.0-1ubuntu1)",
   "content_text": "Fixed versions: pyjwt 2.13.0-1ubuntu1.",
   "date_published": "2026-09-28T20:36:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102272/fixed/ubuntu-pro-16.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102272/",
   "title": "CVE-2026-102272 · jpadilla pyjwt · fixed in Ubuntu Pro 16.04 LTS (pyjwt 1.3.0-1ubuntu0.1+esm3)",
   "content_text": "Fixed versions: pyjwt 1.3.0-1ubuntu0.1+esm3.",
   "date_published": "2026-09-28T20:36:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102272/fixed/ubuntu-pro-18.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102272/",
   "title": "CVE-2026-102272 · jpadilla pyjwt · fixed in Ubuntu Pro 18.04 LTS (pyjwt 1.5.3+ds1-1ubuntu0.1+esm3)",
   "content_text": "Fixed versions: pyjwt 1.5.3+ds1-1ubuntu0.1+esm3.",
   "date_published": "2026-09-28T20:36:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102272/fixed/ubuntu-pro-20.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102272/",
   "title": "CVE-2026-102272 · jpadilla pyjwt · fixed in Ubuntu Pro 20.04 LTS (pyjwt 1.7.1-2ubuntu2.1+esm3)",
   "content_text": "Fixed versions: pyjwt 1.7.1-2ubuntu2.1+esm3.",
   "date_published": "2026-09-28T20:36:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102272/fixed/wolfi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102272/",
   "title": "CVE-2026-102272 · jpadilla pyjwt · fixed in Wolfi (datadog-agent-7.77-core-integrations 7.77.3-r26 and 8 more)",
   "content_text": "Fixed versions: datadog-agent-7.77-core-integrations 7.77.3-r26, datadog-agent-7.79-core-integrations 7.79.2-r20, datadog-agent-7.81-core-integrations 7.81.3-r8, ggshield 1.55.0-r1, kserve-storage-controller 0.21.0-r1, open-webui 0.11.4-r1, py3-cassandra-medusa 0.30.1-r1, semgrep 1.178.0-r6, superset-6.1 6.1.0-r10.",
   "date_published": "2026-09-28T20:36:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102271/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102271/",
   "title": "CVE-2026-102271 · jpadilla pyjwt · disclosed",
   "content_text": "PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a DER public key as the shared verification key. As a result, PyJWT uses public DER bytes as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.",
   "date_published": "2026-09-28T20:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102271/fixed/amazon-linux-2023",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102271/",
   "title": "CVE-2026-102271 · jpadilla pyjwt · fixed in Amazon Linux 2023 (python3-jwt 2.4.0-1.amzn2023.0.6 and 1 more)",
   "content_text": "Fixed versions: python3-jwt 2.4.0-1.amzn2023.0.6, python3-jwt+crypto 2.4.0-1.amzn2023.0.6.",
   "date_published": "2026-09-28T20:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102271/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102271/",
   "title": "CVE-2026-102271 · jpadilla pyjwt · fixed in Chainguard (airflow-2 2.11.2-r25 and 75 more)",
   "content_text": "Fixed versions: airflow-2 2.11.2-r25, airflow-core-2 2.11.2-r10, authentik-2026.5 2026.5.7-r4, authentik-fips-2026.5 2026.5.7-r7, azureml-inference-server-http 1.5.1-r10, azureml-inference-server-http-fips 1.5.1-r9, datadog-agent-7.77-core-integrations 7.77.3-r26, datadog-agent-7.79-core-integrations 7.79.2-r20, datadog-agent-7.80-core-integrations 7.80.4-r19, datadog-agent-7.81-core-integrations 7.81.3-r8, datadog-agent-7.82-core-integrations 7.82.3-r5, datadog-agent-7.83-core-integrations 7.83.3-r2, datadog-agent-7.84-core-integrations 7.84.1-r1, datadog-agent-fips-7.77-core-integrations 7.77.3-r38, datadog-agent-fips-7.79-core-integrations 7.79.2-r18, datadog-agent-fips-7.80-core-integrations 7.80.4-r21, datadog-agent-fips-7.81-core-integrations 7.81.3-r12, datadog-agent-fips-7.82-core-integrations 7.82.3-r8, datadog-agent-fips-7.83-core-integrations 7.83.3-r3, datadog-agent-fips-7.84-core-integrations 7.84.2-r3, datahub-ingestion 1.7.0.1-r2, datahub-ingestion-fips 1.7.0.1-r1, ggshield 1.55.0-r1, kserve-huggingfaceserver-cuda-13.3 0.21.0-r4, kserve-storage-controller 0.21.0-r1, litellm 1.103.1-r1, mcp-atlassian 0.23.1-r2, metaflow-service-fips 2.6.1-r1, nemo-rl-cuda-13.0-gym 0.7.0-r2, nemo-rl-cuda-13.0-vllm 0.7.0-r2, netbox-fips 4.7.2-r1, open-webui 0.11.4-r1, openstack-cinder-2026.1 28.0.0_git20260904-r4, openstack-designate-2025.2 21.0.1_git20260817-r2, openstack-designate-2026.1 22.0.1_git20260827-r2, openstack-glance-2025.1 30.2.0_git20260912-r2, openstack-glance-2025.1-fips 30.2.0_git20260928-r1, openstack-glance-2025.2-fips 31.1.0_git20260925-r1, openstack-glance-2026.1-fips 32.0.0_git20260930-r1, openstack-heat-2025.2 25.0.1_git20260905-r1, openstack-heat-2026.1 26.0.1_git20260905-r1, openstack-horizon-2025.1 25.3.2_git20260617-r13, openstack-horizon-2025.1-fips 25.3.2_git20260617-r12, openstack-horizon-2025.2 25.5.2_git20260914-r3, openstack-horizon-2025.2-fips 25.5.2_git20260914-r2, openstack-horizon-2026.1 25.7.3_git20260924-r3, openstack-keystone-2025.1-fips 27.0.1_git20260910-r4, openstack-keystone-2025.2 28.0.1_git20260902-r5, openstack-keystone-2025.2-fips 28.0.1_git20260902-r4, openstack-keystone-2026.1 29.0.1_git20260904-r8, openstack-manila-2025.2 21.0.2_git20260923-r1, openstack-manila-2026.1 22.0.1_git20260905-r1, openstack-neutron-2026.1 28.0.2_git20260928-r3, openstack-nova-2025.1 31.3.0_git20260717-r13, openstack-nova-2025.2 32.2.0_git20260715-r14, openstack-nova-2026.1 33.0.1_git20260819-r12, openstack-octavia-2025.2 17.0.1_git20260904-r1, openstack-octavia-2026.1 18.0.1_git20260904-r1, openstack-placement-2025.1 13.0.0_git20260916-r4, openstack-placement-2025.1-fips 13.0.0_git20260916-r4, openstack-placement-2025.2 14.0.0_git20260916-r5, openstack-placement-2025.2-fips 14.0.0_git20260916-r4, openstack-placement-2026.1 15.0.0_git20260806-r11, openstack-placement-2026.1-fips 15.0.0_git20260812-r9, py3-cassandra-medusa 0.30.1-r1, py3.12-airflow-core-3 3.3.2-r2, py3.12-airflow-postgres-fips-3 3.3.2-r1, py3.13-airflow-core-3 3.3.2-r2, py3.13-airflow-postgres-fips-3 3.3.2-r1, py3.14-airflow-core-3 3.3.2-r2, py3.14-airflow-postgres-fips-3 3.3.2-r1, semgrep 1.178.0-r6, superset-5.0 5.0.0-r36, superset-6.0 6.0.0-r17, superset-6.1 6.1.0-r10, superset-fips-6.1 6.1.0-r7.",
   "date_published": "2026-09-28T20:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102271/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102271/",
   "title": "CVE-2026-102271 · jpadilla pyjwt · fixed in Debian 14 (pyjwt 2.14.0-1)",
   "content_text": "Fixed versions: pyjwt 2.14.0-1.",
   "date_published": "2026-09-28T20:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102271/fixed/opensuse-leap-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102271/",
   "title": "CVE-2026-102271 · jpadilla pyjwt · fixed in openSUSE Leap 16.0 (python-PyJWT 2.12.1-160000.3.1)",
   "content_text": "Fixed versions: python-PyJWT 2.12.1-160000.3.1.",
   "date_published": "2026-09-28T20:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102271/fixed/pypi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102271/",
   "title": "CVE-2026-102271 · jpadilla pyjwt · fixed upstream (PyPI)",
   "content_text": "Fixed versions: pyjwt 2.14.0.",
   "date_published": "2026-09-28T20:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102271/fixed/suse-linux-enterprise-server-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102271/",
   "title": "CVE-2026-102271 · jpadilla pyjwt · fixed in SUSE Linux Enterprise Server 16.0 (python-PyJWT 2.12.1-160000.3.1)",
   "content_text": "Fixed versions: python-PyJWT 2.12.1-160000.3.1.",
   "date_published": "2026-09-28T20:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102271/fixed/suse-linux-enterprise-server-for-sap-applications-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102271/",
   "title": "CVE-2026-102271 · jpadilla pyjwt · fixed in SUSE Linux Enterprise Server for SAP applications 16.0 (python-PyJWT 2.12.1-160000.3.1)",
   "content_text": "Fixed versions: python-PyJWT 2.12.1-160000.3.1.",
   "date_published": "2026-09-28T20:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102271/fixed/suse-linux-micro-6.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102271/",
   "title": "CVE-2026-102271 · jpadilla pyjwt · fixed in SUSE Linux Micro 6.0 (python-PyJWT 2.9.0-159998.1.1)",
   "content_text": "Fixed versions: python-PyJWT 2.9.0-159998.1.1.",
   "date_published": "2026-09-28T20:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102271/fixed/suse-linux-micro-6.2",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102271/",
   "title": "CVE-2026-102271 · jpadilla pyjwt · fixed in SUSE Linux Micro 6.2 (python-PyJWT 2.12.1-160000.3.1)",
   "content_text": "Fixed versions: python-PyJWT 2.12.1-160000.3.1.",
   "date_published": "2026-09-28T20:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102271/fixed/ubuntu-22.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102271/",
   "title": "CVE-2026-102271 · jpadilla pyjwt · fixed in Ubuntu 22.04 LTS (pyjwt 2.3.0-1ubuntu0.5)",
   "content_text": "Fixed versions: pyjwt 2.3.0-1ubuntu0.5.",
   "date_published": "2026-09-28T20:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102271/fixed/ubuntu-24.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102271/",
   "title": "CVE-2026-102271 · jpadilla pyjwt · fixed in Ubuntu 24.04 LTS (pyjwt 2.7.0-1ubuntu0.3)",
   "content_text": "Fixed versions: pyjwt 2.7.0-1ubuntu0.3.",
   "date_published": "2026-09-28T20:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102271/fixed/ubuntu-26.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102271/",
   "title": "CVE-2026-102271 · jpadilla pyjwt · fixed in Ubuntu 26.04 LTS (pyjwt 2.10.1-4ubuntu1.2)",
   "content_text": "Fixed versions: pyjwt 2.10.1-4ubuntu1.2.",
   "date_published": "2026-09-28T20:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102271/fixed/ubuntu-26.10",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102271/",
   "title": "CVE-2026-102271 · jpadilla pyjwt · fixed in Ubuntu 26.10 (pyjwt 2.13.0-1ubuntu1)",
   "content_text": "Fixed versions: pyjwt 2.13.0-1ubuntu1.",
   "date_published": "2026-09-28T20:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102271/fixed/ubuntu-pro-16.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102271/",
   "title": "CVE-2026-102271 · jpadilla pyjwt · fixed in Ubuntu Pro 16.04 LTS (pyjwt 1.3.0-1ubuntu0.1+esm3)",
   "content_text": "Fixed versions: pyjwt 1.3.0-1ubuntu0.1+esm3.",
   "date_published": "2026-09-28T20:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102271/fixed/ubuntu-pro-18.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102271/",
   "title": "CVE-2026-102271 · jpadilla pyjwt · fixed in Ubuntu Pro 18.04 LTS (pyjwt 1.5.3+ds1-1ubuntu0.1+esm3)",
   "content_text": "Fixed versions: pyjwt 1.5.3+ds1-1ubuntu0.1+esm3.",
   "date_published": "2026-09-28T20:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102271/fixed/ubuntu-pro-20.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102271/",
   "title": "CVE-2026-102271 · jpadilla pyjwt · fixed in Ubuntu Pro 20.04 LTS (pyjwt 1.7.1-2ubuntu2.1+esm3)",
   "content_text": "Fixed versions: pyjwt 1.7.1-2ubuntu2.1+esm3.",
   "date_published": "2026-09-28T20:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102271/fixed/wolfi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102271/",
   "title": "CVE-2026-102271 · jpadilla pyjwt · fixed in Wolfi (datadog-agent-7.77-core-integrations 7.77.3-r26 and 10 more)",
   "content_text": "Fixed versions: datadog-agent-7.77-core-integrations 7.77.3-r26, datadog-agent-7.79-core-integrations 7.79.2-r20, datadog-agent-7.80-core-integrations 7.80.4-r19, datadog-agent-7.81-core-integrations 7.81.3-r8, ggshield 1.55.0-r1, kserve-storage-controller 0.21.0-r1, open-webui 0.11.4-r1, py3-cassandra-medusa 0.30.1-r1, semgrep 1.178.0-r6, superset-6.0 6.0.0-r17, superset-6.1 6.1.0-r10.",
   "date_published": "2026-09-28T20:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102268/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102268/",
   "title": "CVE-2026-102268 · jpadilla pyjwt · disclosed",
   "content_text": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a mutated public-key PEM as raw key bytes. As a result, HMACAlgorithm.prepare_key treats the unrecognized asymmetric public key as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.",
   "date_published": "2026-09-28T20:26:13Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102268/fixed/amazon-linux-2023",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102268/",
   "title": "CVE-2026-102268 · jpadilla pyjwt · fixed in Amazon Linux 2023 (python3-jwt 2.4.0-1.amzn2023.0.6 and 1 more)",
   "content_text": "Fixed versions: python3-jwt 2.4.0-1.amzn2023.0.6, python3-jwt+crypto 2.4.0-1.amzn2023.0.6.",
   "date_published": "2026-09-28T20:26:13Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102268/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102268/",
   "title": "CVE-2026-102268 · jpadilla pyjwt · fixed in Chainguard (airflow-2 2.11.2-r25 and 70 more)",
   "content_text": "Fixed versions: airflow-2 2.11.2-r25, airflow-core-2 2.11.2-r10, authentik-2026.5 2026.5.7-r4, authentik-fips-2026.5 2026.5.7-r7, datadog-agent-7.77-core-integrations 7.77.3-r26, datadog-agent-7.79-core-integrations 7.79.2-r20, datadog-agent-7.81-core-integrations 7.81.3-r8, datadog-agent-7.82-core-integrations 7.82.3-r5, datadog-agent-7.83-core-integrations 7.83.3-r2, datadog-agent-7.84-core-integrations 7.84.1-r1, datadog-agent-fips-7.77-core-integrations 7.77.3-r38, datadog-agent-fips-7.79-core-integrations 7.79.2-r18, datadog-agent-fips-7.80-core-integrations 7.80.4-r21, datadog-agent-fips-7.81-core-integrations 7.81.3-r12, datadog-agent-fips-7.82-core-integrations 7.82.3-r8, datadog-agent-fips-7.83-core-integrations 7.83.3-r3, datadog-agent-fips-7.84-core-integrations 7.84.2-r3, datahub-ingestion 1.7.0.1-r2, datahub-ingestion-fips 1.7.0.1-r1, ggshield 1.55.0-r1, kserve-huggingfaceserver-cuda-13.3 0.21.0-r4, kserve-storage-controller 0.21.0-r1, litellm 1.103.1-r1, mcp-atlassian 0.23.1-r2, metaflow-service-fips 2.6.1-r1, nemo-rl-cuda-13.0-gym 0.7.0-r2, nemo-rl-cuda-13.0-vllm 0.7.0-r2, netbox-fips 4.7.2-r1, open-webui 0.11.4-r1, openstack-cinder-2026.1 28.0.0_git20260904-r4, openstack-designate-2025.2 21.0.1_git20260817-r2, openstack-designate-2026.1 22.0.1_git20260827-r2, openstack-glance-2025.1 30.2.0_git20260912-r2, openstack-glance-2025.1-fips 30.2.0_git20260928-r1, openstack-glance-2025.2-fips 31.1.0_git20260925-r1, openstack-glance-2026.1-fips 32.0.0_git20260930-r1, openstack-heat-2025.2 25.0.1_git20260905-r1, openstack-heat-2026.1 26.0.1_git20260905-r1, openstack-horizon-2025.1 25.3.2_git20260617-r13, openstack-horizon-2025.1-fips 25.3.2_git20260617-r12, openstack-horizon-2025.2 25.5.2_git20260914-r3, openstack-horizon-2025.2-fips 25.5.2_git20260914-r2, openstack-keystone-2025.1-fips 27.0.1_git20260910-r4, openstack-keystone-2025.2-fips 28.0.1_git20260902-r4, openstack-keystone-2026.1 29.0.1_git20260904-r8, openstack-manila-2025.2 21.0.2_git20260923-r1, openstack-manila-2026.1 22.0.1_git20260905-r1, openstack-neutron-2026.1 28.0.2_git20260928-r3, openstack-nova-2025.1 31.3.0_git20260717-r13, openstack-nova-2025.2 32.2.0_git20260715-r14, openstack-nova-2026.1 33.0.1_git20260819-r12, openstack-octavia-2025.2 17.0.1_git20260904-r1, openstack-octavia-2026.1 18.0.1_git20260904-r1, openstack-placement-2025.1 13.0.0_git20260916-r4, openstack-placement-2025.1-fips 13.0.0_git20260916-r4, openstack-placement-2025.2 14.0.0_git20260916-r5, openstack-placement-2025.2-fips 14.0.0_git20260916-r4, openstack-placement-2026.1 15.0.0_git20260806-r11, openstack-placement-2026.1-fips 15.0.0_git20260812-r9, py3-cassandra-medusa 0.30.1-r1, py3.12-airflow-core-3 3.3.2-r2, py3.12-airflow-postgres-fips-3 3.3.2-r1, py3.13-airflow-core-3 3.3.2-r2, py3.13-airflow-postgres-fips-3 3.3.2-r1, py3.14-airflow-core-3 3.3.2-r2, py3.14-airflow-postgres-fips-3 3.3.2-r1, semgrep 1.178.0-r6, superset-5.0 5.0.0-r36, superset-6.0 6.0.0-r17, superset-6.1 6.1.0-r10, superset-fips-6.1 6.1.0-r7.",
   "date_published": "2026-09-28T20:26:13Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102268/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102268/",
   "title": "CVE-2026-102268 · jpadilla pyjwt · fixed in Debian 14 (pyjwt 2.14.0-1)",
   "content_text": "Fixed versions: pyjwt 2.14.0-1.",
   "date_published": "2026-09-28T20:26:13Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102268/fixed/opensuse-leap-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102268/",
   "title": "CVE-2026-102268 · jpadilla pyjwt · fixed in openSUSE Leap 16.0 (python-PyJWT 2.12.1-160000.3.1)",
   "content_text": "Fixed versions: python-PyJWT 2.12.1-160000.3.1.",
   "date_published": "2026-09-28T20:26:13Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102268/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102268/",
   "title": "CVE-2026-102268 · jpadilla pyjwt · fixed in openSUSE Tumbleweed (python-PyJWT 2.15.1-1.1)",
   "content_text": "Fixed versions: python-PyJWT 2.15.1-1.1.",
   "date_published": "2026-09-28T20:26:13Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102268/fixed/pypi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102268/",
   "title": "CVE-2026-102268 · jpadilla pyjwt · fixed upstream (PyPI)",
   "content_text": "Fixed versions: pyjwt 2.14.0.",
   "date_published": "2026-09-28T20:26:13Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102268/fixed/suse-linux-enterprise-server-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102268/",
   "title": "CVE-2026-102268 · jpadilla pyjwt · fixed in SUSE Linux Enterprise Server 16.0 (python-PyJWT 2.12.1-160000.3.1)",
   "content_text": "Fixed versions: python-PyJWT 2.12.1-160000.3.1.",
   "date_published": "2026-09-28T20:26:13Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102268/fixed/suse-linux-enterprise-server-for-sap-applications-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102268/",
   "title": "CVE-2026-102268 · jpadilla pyjwt · fixed in SUSE Linux Enterprise Server for SAP applications 16.0 (python-PyJWT 2.12.1-160000.3.1)",
   "content_text": "Fixed versions: python-PyJWT 2.12.1-160000.3.1.",
   "date_published": "2026-09-28T20:26:13Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102268/fixed/suse-linux-micro-6.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102268/",
   "title": "CVE-2026-102268 · jpadilla pyjwt · fixed in SUSE Linux Micro 6.0 (python-PyJWT 2.9.0-159998.1.1)",
   "content_text": "Fixed versions: python-PyJWT 2.9.0-159998.1.1.",
   "date_published": "2026-09-28T20:26:13Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102268/fixed/suse-linux-micro-6.2",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102268/",
   "title": "CVE-2026-102268 · jpadilla pyjwt · fixed in SUSE Linux Micro 6.2 (python-PyJWT 2.12.1-160000.3.1)",
   "content_text": "Fixed versions: python-PyJWT 2.12.1-160000.3.1.",
   "date_published": "2026-09-28T20:26:13Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102268/fixed/ubuntu-22.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102268/",
   "title": "CVE-2026-102268 · jpadilla pyjwt · fixed in Ubuntu 22.04 LTS (pyjwt 2.3.0-1ubuntu0.5)",
   "content_text": "Fixed versions: pyjwt 2.3.0-1ubuntu0.5.",
   "date_published": "2026-09-28T20:26:13Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102268/fixed/ubuntu-24.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102268/",
   "title": "CVE-2026-102268 · jpadilla pyjwt · fixed in Ubuntu 24.04 LTS (pyjwt 2.7.0-1ubuntu0.3)",
   "content_text": "Fixed versions: pyjwt 2.7.0-1ubuntu0.3.",
   "date_published": "2026-09-28T20:26:13Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102268/fixed/ubuntu-26.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102268/",
   "title": "CVE-2026-102268 · jpadilla pyjwt · fixed in Ubuntu 26.04 LTS (pyjwt 2.10.1-4ubuntu1.2)",
   "content_text": "Fixed versions: pyjwt 2.10.1-4ubuntu1.2.",
   "date_published": "2026-09-28T20:26:13Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102268/fixed/ubuntu-26.10",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102268/",
   "title": "CVE-2026-102268 · jpadilla pyjwt · fixed in Ubuntu 26.10 (pyjwt 2.13.0-1ubuntu1)",
   "content_text": "Fixed versions: pyjwt 2.13.0-1ubuntu1.",
   "date_published": "2026-09-28T20:26:13Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102268/fixed/ubuntu-pro-16.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102268/",
   "title": "CVE-2026-102268 · jpadilla pyjwt · fixed in Ubuntu Pro 16.04 LTS (pyjwt 1.3.0-1ubuntu0.1+esm3)",
   "content_text": "Fixed versions: pyjwt 1.3.0-1ubuntu0.1+esm3.",
   "date_published": "2026-09-28T20:26:13Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102268/fixed/ubuntu-pro-18.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102268/",
   "title": "CVE-2026-102268 · jpadilla pyjwt · fixed in Ubuntu Pro 18.04 LTS (pyjwt 1.5.3+ds1-1ubuntu0.1+esm3)",
   "content_text": "Fixed versions: pyjwt 1.5.3+ds1-1ubuntu0.1+esm3.",
   "date_published": "2026-09-28T20:26:13Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102268/fixed/ubuntu-pro-20.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102268/",
   "title": "CVE-2026-102268 · jpadilla pyjwt · fixed in Ubuntu Pro 20.04 LTS (pyjwt 1.7.1-2ubuntu2.1+esm3)",
   "content_text": "Fixed versions: pyjwt 1.7.1-2ubuntu2.1+esm3.",
   "date_published": "2026-09-28T20:26:13Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102268/fixed/wolfi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102268/",
   "title": "CVE-2026-102268 · jpadilla pyjwt · fixed in Wolfi (datadog-agent-7.77-core-integrations 7.77.3-r26 and 9 more)",
   "content_text": "Fixed versions: datadog-agent-7.77-core-integrations 7.77.3-r26, datadog-agent-7.79-core-integrations 7.79.2-r20, datadog-agent-7.81-core-integrations 7.81.3-r8, ggshield 1.55.0-r1, kserve-storage-controller 0.21.0-r1, open-webui 0.11.4-r1, py3-cassandra-medusa 0.30.1-r1, semgrep 1.178.0-r6, superset-6.0 6.0.0-r17, superset-6.1 6.1.0-r10.",
   "date_published": "2026-09-28T20:26:13Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102267/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102267/",
   "title": "CVE-2026-102267 · jpadilla pyjwt · disclosed",
   "content_text": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.",
   "date_published": "2026-09-28T20:23:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102267/fixed/amazon-linux-2023",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102267/",
   "title": "CVE-2026-102267 · jpadilla pyjwt · fixed in Amazon Linux 2023 (python3-jwt 2.4.0-1.amzn2023.0.6 and 1 more)",
   "content_text": "Fixed versions: python3-jwt 2.4.0-1.amzn2023.0.6, python3-jwt+crypto 2.4.0-1.amzn2023.0.6.",
   "date_published": "2026-09-28T20:23:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102267/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102267/",
   "title": "CVE-2026-102267 · jpadilla pyjwt · fixed in Chainguard (airflow-2 2.11.2-r25 and 71 more)",
   "content_text": "Fixed versions: airflow-2 2.11.2-r25, airflow-core-2 2.11.2-r10, authentik-2026.5 2026.5.7-r4, authentik-fips-2026.5 2026.5.7-r7, datadog-agent-7.77-core-integrations 7.77.3-r26, datadog-agent-7.79-core-integrations 7.79.2-r20, datadog-agent-7.80-core-integrations 7.80.4-r19, datadog-agent-7.81-core-integrations 7.81.3-r8, datadog-agent-7.82-core-integrations 7.82.3-r5, datadog-agent-7.83-core-integrations 7.83.3-r2, datadog-agent-7.84-core-integrations 7.84.1-r1, datadog-agent-fips-7.77-core-integrations 7.77.3-r38, datadog-agent-fips-7.79-core-integrations 7.79.2-r18, datadog-agent-fips-7.80-core-integrations 7.80.4-r21, datadog-agent-fips-7.81-core-integrations 7.81.3-r12, datadog-agent-fips-7.82-core-integrations 7.82.3-r8, datadog-agent-fips-7.83-core-integrations 7.83.3-r3, datadog-agent-fips-7.84-core-integrations 7.84.2-r3, datahub-ingestion 1.7.0.1-r2, datahub-ingestion-fips 1.7.0.1-r1, ggshield 1.55.0-r1, kserve-huggingfaceserver-cuda-13.3 0.21.0-r4, kserve-storage-controller 0.21.0-r1, litellm 1.103.1-r1, mcp-atlassian 0.23.1-r2, metaflow-service-fips 2.6.1-r1, nemo-rl-cuda-13.0-gym 0.7.0-r2, nemo-rl-cuda-13.0-vllm 0.7.0-r2, netbox-fips 4.7.2-r1, open-webui 0.11.4-r1, openstack-cinder-2026.1 28.0.0_git20260904-r4, openstack-designate-2025.2 21.0.1_git20260817-r2, openstack-designate-2026.1 22.0.1_git20260827-r2, openstack-glance-2025.1 30.2.0_git20260912-r2, openstack-glance-2025.1-fips 30.2.0_git20260928-r1, openstack-glance-2025.2-fips 31.1.0_git20260925-r1, openstack-glance-2026.1-fips 32.0.0_git20260930-r1, openstack-heat-2025.2 25.0.1_git20260905-r1, openstack-heat-2026.1 26.0.1_git20260905-r1, openstack-horizon-2025.1 25.3.2_git20260617-r13, openstack-horizon-2025.2 25.5.2_git20260914-r3, openstack-horizon-2025.2-fips 25.5.2_git20260914-r2, openstack-horizon-2026.1 25.7.3_git20260924-r3, openstack-keystone-2025.1-fips 27.0.1_git20260910-r4, openstack-keystone-2025.2 28.0.1_git20260902-r5, openstack-keystone-2025.2-fips 28.0.1_git20260902-r4, openstack-keystone-2026.1 29.0.1_git20260904-r8, openstack-manila-2025.2 21.0.2_git20260923-r1, openstack-manila-2026.1 22.0.1_git20260905-r1, openstack-neutron-2026.1 28.0.2_git20260928-r3, openstack-nova-2025.1 31.3.0_git20260717-r13, openstack-nova-2025.2 32.2.0_git20260715-r14, openstack-octavia-2025.2 17.0.1_git20260904-r1, openstack-octavia-2026.1 18.0.1_git20260904-r1, openstack-placement-2025.1 13.0.0_git20260916-r4, openstack-placement-2025.1-fips 13.0.0_git20260916-r4, openstack-placement-2025.2 14.0.0_git20260916-r5, openstack-placement-2025.2-fips 14.0.0_git20260916-r4, openstack-placement-2026.1 15.0.0_git20260806-r11, openstack-placement-2026.1-fips 15.0.0_git20260812-r9, py3-cassandra-medusa 0.30.1-r1, py3.12-airflow-core-3 3.3.2-r2, py3.12-airflow-postgres-fips-3 3.3.2-r1, py3.13-airflow-core-3 3.3.2-r2, py3.13-airflow-postgres-fips-3 3.3.2-r1, py3.14-airflow-core-3 3.3.2-r2, py3.14-airflow-postgres-fips-3 3.3.2-r1, semgrep 1.178.0-r6, superset-5.0 5.0.0-r36, superset-6.0 6.0.0-r17, superset-6.1 6.1.0-r10, superset-fips-6.1 6.1.0-r7.",
   "date_published": "2026-09-28T20:23:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102267/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102267/",
   "title": "CVE-2026-102267 · jpadilla pyjwt · fixed in Debian 14 (pyjwt 2.14.0-1)",
   "content_text": "Fixed versions: pyjwt 2.14.0-1.",
   "date_published": "2026-09-28T20:23:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102267/fixed/opensuse-leap-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102267/",
   "title": "CVE-2026-102267 · jpadilla pyjwt · fixed in openSUSE Leap 16.0 (python-PyJWT 2.12.1-160000.3.1)",
   "content_text": "Fixed versions: python-PyJWT 2.12.1-160000.3.1.",
   "date_published": "2026-09-28T20:23:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102267/fixed/pypi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102267/",
   "title": "CVE-2026-102267 · jpadilla pyjwt · fixed upstream (PyPI)",
   "content_text": "Fixed versions: pyjwt 2.14.0.",
   "date_published": "2026-09-28T20:23:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102267/fixed/suse-linux-enterprise-server-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102267/",
   "title": "CVE-2026-102267 · jpadilla pyjwt · fixed in SUSE Linux Enterprise Server 16.0 (python-PyJWT 2.12.1-160000.3.1)",
   "content_text": "Fixed versions: python-PyJWT 2.12.1-160000.3.1.",
   "date_published": "2026-09-28T20:23:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102267/fixed/suse-linux-enterprise-server-for-sap-applications-16.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102267/",
   "title": "CVE-2026-102267 · jpadilla pyjwt · fixed in SUSE Linux Enterprise Server for SAP applications 16.0 (python-PyJWT 2.12.1-160000.3.1)",
   "content_text": "Fixed versions: python-PyJWT 2.12.1-160000.3.1.",
   "date_published": "2026-09-28T20:23:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102267/fixed/suse-linux-micro-6.0",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102267/",
   "title": "CVE-2026-102267 · jpadilla pyjwt · fixed in SUSE Linux Micro 6.0 (python-PyJWT 2.9.0-159998.1.1)",
   "content_text": "Fixed versions: python-PyJWT 2.9.0-159998.1.1.",
   "date_published": "2026-09-28T20:23:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102267/fixed/suse-linux-micro-6.2",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102267/",
   "title": "CVE-2026-102267 · jpadilla pyjwt · fixed in SUSE Linux Micro 6.2 (python-PyJWT 2.12.1-160000.3.1)",
   "content_text": "Fixed versions: python-PyJWT 2.12.1-160000.3.1.",
   "date_published": "2026-09-28T20:23:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102267/fixed/ubuntu-22.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102267/",
   "title": "CVE-2026-102267 · jpadilla pyjwt · fixed in Ubuntu 22.04 LTS (pyjwt 2.3.0-1ubuntu0.5)",
   "content_text": "Fixed versions: pyjwt 2.3.0-1ubuntu0.5.",
   "date_published": "2026-09-28T20:23:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102267/fixed/ubuntu-24.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102267/",
   "title": "CVE-2026-102267 · jpadilla pyjwt · fixed in Ubuntu 24.04 LTS (pyjwt 2.7.0-1ubuntu0.3)",
   "content_text": "Fixed versions: pyjwt 2.7.0-1ubuntu0.3.",
   "date_published": "2026-09-28T20:23:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102267/fixed/ubuntu-26.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102267/",
   "title": "CVE-2026-102267 · jpadilla pyjwt · fixed in Ubuntu 26.04 LTS (pyjwt 2.10.1-4ubuntu1.2)",
   "content_text": "Fixed versions: pyjwt 2.10.1-4ubuntu1.2.",
   "date_published": "2026-09-28T20:23:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102267/fixed/ubuntu-26.10",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102267/",
   "title": "CVE-2026-102267 · jpadilla pyjwt · fixed in Ubuntu 26.10 (pyjwt 2.13.0-1ubuntu1)",
   "content_text": "Fixed versions: pyjwt 2.13.0-1ubuntu1.",
   "date_published": "2026-09-28T20:23:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102267/fixed/ubuntu-pro-16.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102267/",
   "title": "CVE-2026-102267 · jpadilla pyjwt · fixed in Ubuntu Pro 16.04 LTS (pyjwt 1.3.0-1ubuntu0.1+esm3)",
   "content_text": "Fixed versions: pyjwt 1.3.0-1ubuntu0.1+esm3.",
   "date_published": "2026-09-28T20:23:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102267/fixed/ubuntu-pro-18.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102267/",
   "title": "CVE-2026-102267 · jpadilla pyjwt · fixed in Ubuntu Pro 18.04 LTS (pyjwt 1.5.3+ds1-1ubuntu0.1+esm3)",
   "content_text": "Fixed versions: pyjwt 1.5.3+ds1-1ubuntu0.1+esm3.",
   "date_published": "2026-09-28T20:23:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102267/fixed/ubuntu-pro-20.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102267/",
   "title": "CVE-2026-102267 · jpadilla pyjwt · fixed in Ubuntu Pro 20.04 LTS (pyjwt 1.7.1-2ubuntu2.1+esm3)",
   "content_text": "Fixed versions: pyjwt 1.7.1-2ubuntu2.1+esm3.",
   "date_published": "2026-09-28T20:23:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102267/fixed/wolfi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102267/",
   "title": "CVE-2026-102267 · jpadilla pyjwt · fixed in Wolfi (datadog-agent-7.77-core-integrations 7.77.3-r26 and 10 more)",
   "content_text": "Fixed versions: datadog-agent-7.77-core-integrations 7.77.3-r26, datadog-agent-7.79-core-integrations 7.79.2-r20, datadog-agent-7.80-core-integrations 7.80.4-r19, datadog-agent-7.81-core-integrations 7.81.3-r8, ggshield 1.55.0-r1, kserve-storage-controller 0.21.0-r1, open-webui 0.11.4-r1, py3-cassandra-medusa 0.30.1-r1, semgrep 1.178.0-r6, superset-6.0 6.0.0-r17, superset-6.1 6.1.0-r10.",
   "date_published": "2026-09-28T20:23:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102266/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102266/",
   "title": "CVE-2026-102266 · jpadilla pyjwt · disclosed",
   "content_text": "PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key without applying prepare_key validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As a result, an attacker signs an HMAC token with the same zero-length key accepted by PyJWT. Consequently, forged token can carry arbitrary authenticated claims. This issue is fixed in version 2.14.0.",
   "date_published": "2026-09-28T20:21:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102266/fixed/amazon-linux-2023",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102266/",
   "title": "CVE-2026-102266 · jpadilla pyjwt · fixed in Amazon Linux 2023 (python3-jwt 2.4.0-1.amzn2023.0.6 and 1 more)",
   "content_text": "Fixed versions: python3-jwt 2.4.0-1.amzn2023.0.6, python3-jwt+crypto 2.4.0-1.amzn2023.0.6.",
   "date_published": "2026-09-28T20:21:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102266/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102266/",
   "title": "CVE-2026-102266 · jpadilla pyjwt · fixed in Chainguard (authentik-2026.5 2026.5.7-r4 and 66 more)",
   "content_text": "Fixed versions: authentik-2026.5 2026.5.7-r4, authentik-fips-2026.5 2026.5.7-r7, datadog-agent-7.77-core-integrations 7.77.3-r26, datadog-agent-7.79-core-integrations 7.79.2-r20, datadog-agent-7.80-core-integrations 7.80.4-r19, datadog-agent-7.81-core-integrations 7.81.3-r8, datadog-agent-7.82-core-integrations 7.82.3-r5, datadog-agent-7.83-core-integrations 7.83.3-r2, datadog-agent-7.84-core-integrations 7.84.1-r1, datadog-agent-fips-7.77-core-integrations 7.77.3-r38, datadog-agent-fips-7.79-core-integrations 7.79.2-r18, datadog-agent-fips-7.80-core-integrations 7.80.4-r21, datadog-agent-fips-7.81-core-integrations 7.81.3-r12, datadog-agent-fips-7.82-core-integrations 7.82.3-r8, datadog-agent-fips-7.83-core-integrations 7.83.3-r3, datadog-agent-fips-7.84-core-integrations 7.84.2-r3, datahub-ingestion 1.7.0.1-r2, datahub-ingestion-fips 1.7.0.1-r1, ggshield 1.55.0-r1, kserve-huggingfaceserver-cuda-13.3 0.21.0-r4, kserve-storage-controller 0.21.0-r1, litellm 1.103.1-r1, mcp-atlassian 0.23.1-r2, metaflow-service-fips 2.6.1-r1, nemo-rl-cuda-13.0-gym 0.7.0-r2, nemo-rl-cuda-13.0-vllm 0.7.0-r2, netbox-fips 4.7.2-r1, open-webui 0.11.4-r1, openstack-cinder-2026.1 28.0.0_git20260904-r4, openstack-designate-2025.2 21.0.1_git20260817-r2, openstack-designate-2026.1 22.0.1_git20260827-r2, openstack-glance-2025.1 30.2.0_git20260912-r2, openstack-glance-2025.1-fips 30.2.0_git20260928-r1, openstack-glance-2025.2-fips 31.1.0_git20260925-r1, openstack-glance-2026.1-fips 32.0.0_git20260930-r1, openstack-heat-2025.2 25.0.1_git20260905-r1, openstack-heat-2026.1 26.0.1_git20260905-r1, openstack-horizon-2025.1 25.3.2_git20260617-r13, openstack-horizon-2025.1-fips 25.3.2_git20260617-r12, openstack-horizon-2025.2 25.5.2_git20260914-r3, openstack-horizon-2025.2-fips 25.5.2_git20260914-r2, openstack-keystone-2025.1-fips 27.0.1_git20260910-r4, openstack-keystone-2025.2-fips 28.0.1_git20260902-r4, openstack-keystone-2026.1 29.0.1_git20260904-r8, openstack-manila-2025.2 21.0.2_git20260923-r1, openstack-manila-2026.1 22.0.1_git20260905-r1, openstack-neutron-2026.1 28.0.2_git20260928-r3, openstack-nova-2025.1 31.3.0_git20260717-r13, openstack-nova-2025.2 32.2.0_git20260715-r14, openstack-octavia-2025.2 17.0.1_git20260904-r1, openstack-octavia-2026.1 18.0.1_git20260904-r1, openstack-placement-2025.1 13.0.0_git20260916-r4, openstack-placement-2025.1-fips 13.0.0_git20260916-r4, openstack-placement-2025.2 14.0.0_git20260916-r5, openstack-placement-2025.2-fips 14.0.0_git20260916-r4, openstack-placement-2026.1-fips 15.0.0_git20260812-r9, py3-cassandra-medusa 0.30.1-r1, py3.12-airflow-core-3 3.3.2-r2, py3.12-airflow-postgres-fips-3 3.3.2-r1, py3.13-airflow-core-3 3.3.2-r2, py3.13-airflow-postgres-fips-3 3.3.2-r1, py3.14-airflow-core-3 3.3.2-r2, py3.14-airflow-postgres-fips-3 3.3.2-r1, semgrep 1.178.0-r6, superset-5.0 5.0.0-r36, superset-6.1 6.1.0-r10, superset-fips-6.1 6.1.0-r7.",
   "date_published": "2026-09-28T20:21:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102266/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102266/",
   "title": "CVE-2026-102266 · jpadilla pyjwt · fixed in Debian 14 (pyjwt 2.14.0-1)",
   "content_text": "Fixed versions: pyjwt 2.14.0-1.",
   "date_published": "2026-09-28T20:21:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102266/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102266/",
   "title": "CVE-2026-102266 · jpadilla pyjwt · fixed in openSUSE Tumbleweed (python-PyJWT 2.15.1-1.1)",
   "content_text": "Fixed versions: python-PyJWT 2.15.1-1.1.",
   "date_published": "2026-09-28T20:21:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102266/fixed/pypi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102266/",
   "title": "CVE-2026-102266 · jpadilla pyjwt · fixed upstream (PyPI)",
   "content_text": "Fixed versions: pyjwt 2.14.0.",
   "date_published": "2026-09-28T20:21:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102266/fixed/ubuntu-22.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102266/",
   "title": "CVE-2026-102266 · jpadilla pyjwt · fixed in Ubuntu 22.04 LTS (pyjwt 2.3.0-1ubuntu0.5)",
   "content_text": "Fixed versions: pyjwt 2.3.0-1ubuntu0.5.",
   "date_published": "2026-09-28T20:21:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102266/fixed/ubuntu-24.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102266/",
   "title": "CVE-2026-102266 · jpadilla pyjwt · fixed in Ubuntu 24.04 LTS (pyjwt 2.7.0-1ubuntu0.3)",
   "content_text": "Fixed versions: pyjwt 2.7.0-1ubuntu0.3.",
   "date_published": "2026-09-28T20:21:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102266/fixed/ubuntu-26.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102266/",
   "title": "CVE-2026-102266 · jpadilla pyjwt · fixed in Ubuntu 26.04 LTS (pyjwt 2.10.1-4ubuntu1.2)",
   "content_text": "Fixed versions: pyjwt 2.10.1-4ubuntu1.2.",
   "date_published": "2026-09-28T20:21:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102266/fixed/ubuntu-26.10",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102266/",
   "title": "CVE-2026-102266 · jpadilla pyjwt · fixed in Ubuntu 26.10 (pyjwt 2.13.0-1ubuntu1)",
   "content_text": "Fixed versions: pyjwt 2.13.0-1ubuntu1.",
   "date_published": "2026-09-28T20:21:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102266/fixed/ubuntu-pro-16.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102266/",
   "title": "CVE-2026-102266 · jpadilla pyjwt · fixed in Ubuntu Pro 16.04 LTS (pyjwt 1.3.0-1ubuntu0.1+esm3)",
   "content_text": "Fixed versions: pyjwt 1.3.0-1ubuntu0.1+esm3.",
   "date_published": "2026-09-28T20:21:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102266/fixed/ubuntu-pro-18.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102266/",
   "title": "CVE-2026-102266 · jpadilla pyjwt · fixed in Ubuntu Pro 18.04 LTS (pyjwt 1.5.3+ds1-1ubuntu0.1+esm3)",
   "content_text": "Fixed versions: pyjwt 1.5.3+ds1-1ubuntu0.1+esm3.",
   "date_published": "2026-09-28T20:21:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102266/fixed/ubuntu-pro-20.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102266/",
   "title": "CVE-2026-102266 · jpadilla pyjwt · fixed in Ubuntu Pro 20.04 LTS (pyjwt 1.7.1-2ubuntu2.1+esm3)",
   "content_text": "Fixed versions: pyjwt 1.7.1-2ubuntu2.1+esm3.",
   "date_published": "2026-09-28T20:21:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102266/fixed/wolfi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102266/",
   "title": "CVE-2026-102266 · jpadilla pyjwt · fixed in Wolfi (datadog-agent-7.77-core-integrations 7.77.3-r26 and 9 more)",
   "content_text": "Fixed versions: datadog-agent-7.77-core-integrations 7.77.3-r26, datadog-agent-7.79-core-integrations 7.79.2-r20, datadog-agent-7.80-core-integrations 7.80.4-r19, datadog-agent-7.81-core-integrations 7.81.3-r8, ggshield 1.55.0-r1, kserve-storage-controller 0.21.0-r1, open-webui 0.11.4-r1, py3-cassandra-medusa 0.30.1-r1, semgrep 1.178.0-r6, superset-6.1 6.1.0-r10.",
   "date_published": "2026-09-28T20:21:26Z"
  }
 ]
}