Skip to content
fr Sign in
7.5 High

CVE-2026-32597 PyJWT is a JSON Web Token implementation in Python

Description

PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.

Affected products and versions

Product Affected versions Fixed in
pyjwt 2.12 earliest → < 2.12.0 2.12.0
Red Hat Ansible Automation Platform 2.5 for RHEL 8 Versions not published
Red Hat Ansible Automation Platform 2.5 for RHEL 9 Versions not published
Red Hat Ansible Automation Platform 2.6 for RHEL 9 Versions not published
Red Hat Enterprise Linux AppStream EUS (v. 10.0) Versions not published
Red Hat Enterprise Linux AppStream (v. 10) Versions not published
Red Hat Enterprise Linux AppStream (v. 8) Versions not published
Red Hat Enterprise Linux AppStream E4S (v.9.2) Versions not published
Red Hat Enterprise Linux AppStream EUS (v.9.4) Versions not published
Show the 36 other branches
Product Affected versions Fixed in
Red Hat Enterprise Linux AppStream EUS (v.9.6) Versions not published
Red Hat Enterprise Linux AppStream (v. 9) Versions not published
Red Hat Enterprise Linux HighAvailability (v. 8) Versions not published
Red Hat Enterprise Linux High Availability E4S (v.9.2) Versions not published
Red Hat Enterprise Linux High Availability EUS (v.9.4) Versions not published
Red Hat AI Inference Server 3.3 1775749857 earliest → < 1775749857 1775749857
Red Hat Ansible Automation Platform 2.5 1777403872 earliest → < 1777403872 1777403872
Red Hat Ansible Automation Platform 2.6 1777311601 earliest → < 1777311601 1777311601
Red Hat Enterprise Linux AI 3.3 1776938871 earliest → < 1776938871 1776938871
Red Hat OpenShift AI 2.25 1783615432 earliest → < 1783615432 1783615432
Red Hat OpenShift AI 3.3 1782472374 earliest → < 1782472374 1782472374
Red Hat Quay 3.12 1775253092 earliest → < 1775253092 1775253092
Red Hat Quay 3.15 1775169219 earliest → < 1775169219 1775169219
Red Hat Quay 3.16 1779204086 earliest → < 1779204086 1779204086
Red Hat Quay 3.1 1775169155 earliest → < 1775169155 1775169155
Red Hat Quay 3.9 1775169218 earliest → < 1775169218 1775169218
Red Hat Satellite 6.18 1780414237 earliest → < 1780414237 1780414237
Red Hat Trusted Artifact Signer 1.4 1775815407 earliest → < 1775815407 1775815407
Red Hat Enterprise Linux ResilientStorage (v. 8) Versions not published
Red Hat Enterprise Linux Resilient Storage E4S (v.9.2) Versions not published
Red Hat Enterprise Linux Resilient Storage EUS (v.9.4) Versions not published
OpenShift Lightspeed Versions not published
Red Hat AI Inference Server Versions not published
Red Hat Ansible Automation Platform 2 Versions not published
Red Hat OpenShift AI (RHOAI) Versions not published
Red Hat Satellite 6 Versions not published
Red Hat Trusted Artifact Signer Versions not published
Red Hat Ansible Automation Platform 2.6 for RHEL 10 Versions not published
Red Hat Quay 3.10 1775169155 earliest → < 1775169155 1775169155
Red Hat Enterprise Linux 10 Versions not published
Red Hat Enterprise Linux 10.0 Extended Update Support Versions not published
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Versions not published
Red Hat Enterprise Linux 9.4 Extended Update Support Versions not published
Red Hat Enterprise Linux 9.6 Extended Update Support Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of pyjwt

The 22 CVEs of pyjwt →
CVE-2026-103001 PyJWT is a Python implementation of JSON Web Token standards 6.5 Medium CVE-2026-102265 PyJWT is a Python implementation of JSON Web Token standards 5.3 Medium CVE-2026-102275 PyJWT is a Python implementation of JSON Web Token standards 6.5 Medium CVE-2026-102274 PyJWT is a Python implementation of JSON Web Token standards 5.9 Medium
Track this CVE