CVE catalog

CVE-2026-101917

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes without a negative cache or minimum

[CVE catalog]

Severity
Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.43% · Oct 25, 2026

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or varying kid values absent from the cached JWKS. As a result, each cache miss causes PyJWKClient to refresh the JWKS. Consequently, attacker traffic can amplify outbound requests to the configured JWKS endpoint. This issue is fixed in version 2.14.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpyjwtsid2.15.1-1fixed
Debianpyjwtforky2.15.1-1fixed
Debianpyjwttrixie2.10.1-2+deb13u1vulnerable
Debianpyjwttrixie-security2.10.1-2+deb13u1vulnerable
Debianpyjwtbookworm2.6.0-1+deb12u1vulnerable
Debianpyjwtbookworm-security2.6.0-1+deb12u1vulnerable
PyPIpyjwtNot reported2.14.0fixed
PyPIpyjwtNot reported2.14.0fixed
CpepyjwtNot reported2.14.0fixed
Opensusepython-PyJWTtumbleweed2.15.1-1.1fixed
Susepython-PyJWTlinux enterprise server 16.02.12.1-160000.3.1fixed
Susepython-PyJWTlinux enterprise server for sap applications 16.02.12.1-160000.3.1fixed
Ubuntupyjwtpro1.7.0-2vulnerable
Ubuntupyjwtpro1.7.1-1vulnerable
Ubuntupyjwtpro1.7.1-2ubuntu1vulnerable
Ubuntupyjwtpro1.7.1-2ubuntu2vulnerable
Ubuntupyjwtpro1.7.1-2ubuntu2.1vulnerable
Ubuntupyjwtpro1.7.1-2ubuntu2.1+esm1vulnerable
Ubuntupyjwtpro1.7.1-2ubuntu2.1+esm2vulnerable
Ubuntupyjwtpro1.7.1-2ubuntu2.1+esm3vulnerable
Ubuntupyjwtpro1.7.1-2ubuntu2.1+esm4fixed
Ubuntupyjwt22.041.7.1-2ubuntu2vulnerable
Ubuntupyjwt22.042.1.0-1vulnerable
Ubuntupyjwt22.042.3.0-1vulnerable
Ubuntupyjwt22.042.3.0-1ubuntu0.1vulnerable
Ubuntupyjwt22.042.3.0-1ubuntu0.2vulnerable
Ubuntupyjwt22.042.3.0-1ubuntu0.3vulnerable
Ubuntupyjwt22.042.3.0-1ubuntu0.4vulnerable
Ubuntupyjwt22.042.3.0-1ubuntu0.5vulnerable
Ubuntupyjwt22.042.3.0-1ubuntu0.6fixed
Ubuntupyjwt24.042.7.0-1vulnerable
Ubuntupyjwt24.042.7.0-1ubuntu0.1vulnerable
Ubuntupyjwt24.042.7.0-1ubuntu0.2vulnerable
Ubuntupyjwt24.042.7.0-1ubuntu0.3vulnerable
Ubuntupyjwt24.042.7.0-1ubuntu0.4fixed
Ubuntupyjwt26.102.10.1-4ubuntu1vulnerable
Ubuntupyjwt26.102.12.1-1vulnerable
Ubuntupyjwt26.102.13.0-1vulnerable
Ubuntupyjwt26.102.13.0-1ubuntu1vulnerable
Ubuntupyjwt26.102.13.0-1ubuntu1.1fixed
Ubuntupyjwt26.042.10.1-2vulnerable
Ubuntupyjwt26.042.10.1-3vulnerable
Ubuntupyjwt26.042.10.1-3build1vulnerable
Ubuntupyjwt26.042.10.1-4vulnerable
Ubuntupyjwt26.042.10.1-4ubuntu1vulnerable
Ubuntupyjwt26.042.10.1-4ubuntu1.1vulnerable
Ubuntupyjwt26.042.10.1-4ubuntu1.2vulnerable
Ubuntupyjwt26.042.10.1-4ubuntu1.3fixed
Ubuntupyjwt22.041.7.1-2ubuntu2vulnerable
Ubuntupyjwt22.042.1.0-1vulnerable
Ubuntupyjwt22.042.3.0-1vulnerable
Ubuntupyjwt22.042.3.0-1ubuntu0.1vulnerable
Ubuntupyjwt22.042.3.0-1ubuntu0.2vulnerable
Ubuntupyjwt22.042.3.0-1ubuntu0.3vulnerable
Ubuntupyjwt22.042.3.0-1ubuntu0.4vulnerable
Ubuntupyjwt22.042.3.0-1ubuntu0.5vulnerable
Ubuntupyjwt22.042.3.0-1ubuntu0.6fixed
Ubuntupyjwt24.042.7.0-1vulnerable
Ubuntupyjwt24.042.7.0-1ubuntu0.1vulnerable
Ubuntupyjwt24.042.7.0-1ubuntu0.2vulnerable
Ubuntupyjwt24.042.7.0-1ubuntu0.3vulnerable
Ubuntupyjwt24.042.7.0-1ubuntu0.4fixed
Ubuntupyjwt26.102.10.1-4ubuntu1vulnerable
Ubuntupyjwt26.102.12.1-1vulnerable
Ubuntupyjwt26.102.13.0-1vulnerable
Ubuntupyjwt26.102.13.0-1ubuntu1vulnerable
Ubuntupyjwt26.102.13.0-1ubuntu1.1fixed
Ubuntupyjwt26.042.10.1-2vulnerable
Ubuntupyjwt26.042.10.1-3vulnerable
Ubuntupyjwt26.042.10.1-3build1vulnerable
Ubuntupyjwt26.042.10.1-4vulnerable
Ubuntupyjwt26.042.10.1-4ubuntu1vulnerable
Ubuntupyjwt26.042.10.1-4ubuntu1.1vulnerable
Ubuntupyjwt26.042.10.1-4ubuntu1.2vulnerable
Ubuntupyjwt26.042.10.1-4ubuntu1.3fixed
Opensusepython-PyJWTleap 16.02.12.1-160000.3.1fixed
Susepython-PyJWTlinux micro 6.12.12.1-slfo.1.1_3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpyjwtsourcesid2.14.0-1not yet assignedNot reportedNot reported
Debianpyjwtsourceforky2.14.0-1not yet assignedNot reportedNot reported
Debianpyjwtsourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debianpyjwtsourcebookworm(unfixed)not yet assignedNot reportedNot reported
PyPIpyjwtPyPINot reported2.14.0Not reportedGHSA-2GX3-RCP4-G85QNot reported
PyPIpyjwtPyPINot reported2.14.0Not reportedPYSEC-2026-4140Not reported
CpepyjwtcpeNot reported2.14.0Not reportedNVD-CVE-2026-101917Not reported
Opensusepython-PyJWTrpmtumbleweed2.15.1-1.1Not reportedOPENSUSE-SU-2026:11994-1Not reported
Susepython-PyJWTrpmlinux enterprise server 16.02.12.1-160000.3.1Not reportedSUSE-SU-2026:24219-1Not reported
Susepython-PyJWTrpmlinux enterprise server for sap applications 16.02.12.1-160000.3.1Not reportedSUSE-SU-2026:24219-1Not reported
Ubuntupyjwtdebpro1.7.1-2ubuntu2.1+esm4Not reportedUSN-8934-1Not reported
Ubuntupyjwtdeb22.042.3.0-1ubuntu0.6Not reportedUSN-8934-1Not reported
Ubuntupyjwtdeb24.042.7.0-1ubuntu0.4Not reportedUSN-8934-1Not reported
Ubuntupyjwtdeb26.102.13.0-1ubuntu1.1Not reportedUSN-8934-1Not reported
Ubuntupyjwtdeb26.042.10.1-4ubuntu1.3Not reportedUSN-8934-1Not reported
Ubuntupyjwtdeb22.042.3.0-1ubuntu0.6Not reportedUBUNTU-CVE-2026-101917Not reported
Ubuntupyjwtdeb24.042.7.0-1ubuntu0.4Not reportedUBUNTU-CVE-2026-101917Not reported
Ubuntupyjwtdeb26.102.13.0-1ubuntu1.1Not reportedUBUNTU-CVE-2026-101917Not reported
Ubuntupyjwtdeb26.042.10.1-4ubuntu1.3Not reportedUBUNTU-CVE-2026-101917Not reported
Opensusepython-PyJWTrpmleap 16.02.12.1-160000.3.1Not reportedOPENSUSE-SU-2026:22074-1Not reported
Susepython-PyJWTrpmlinux micro 6.12.12.1-slfo.1.1_3.1Not reportedSUSE-SU-2026:24377-1Not reported

Notes

[bookworm] pyjwt: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [python3-jwt]Affected

    Source package: [pyjwt]

    Details (4)

    • 2.6.0-1+deb12u1 · all · bookworm

      Affected

      nvd · pyjwt · debian · bookworm; nvd · pyjwt · debian · 12

    • 2.6.0-1+deb12u1 · all · bookworm

      Affected

      nvd · pyjwt · debian · bookworm; nvd · pyjwt · debian · 12

    • 2.6.0-1+deb12u1 · all · bookworm-security

      Affected

      nvd · pyjwt · debian · bookworm; nvd · pyjwt · debian · 12

    • 2.6.0-1+deb12u1 · all · bookworm-security

      Affected

      nvd · pyjwt · debian · bookworm; nvd · pyjwt · debian · 12

[Debian 13 (Trixie)]

  • [python3-jwt]Affected

    Source package: [pyjwt]

    Details (4)

    • 2.10.1-2+deb13u1 · all · trixie

      Affected

      nvd · pyjwt · debian · 13

    • 2.10.1-2+deb13u1 · all · trixie

      Affected

      nvd · pyjwt · debian · 13

    • 2.10.1-2+deb13u1 · all · trixie-security

      Affected

      nvd · pyjwt · debian · 13

    • 2.10.1-2+deb13u1 · all · trixie-security

      Affected

      nvd · pyjwt · debian · 13

  • [python-jwt-doc]Affected

    Source package: [pyjwt]

    Details (4)

    • 2.10.1-2+deb13u1 · all · trixie

      Affected

      nvd · pyjwt · debian · 13

    • 2.10.1-2+deb13u1 · all · trixie

      Affected

      nvd · pyjwt · debian · 13

    • 2.10.1-2+deb13u1 · all · trixie-security

      Affected

      nvd · pyjwt · debian · 13

    • 2.10.1-2+deb13u1 · all · trixie-security

      Affected

      nvd · pyjwt · debian · 13

[openSUSE Tumbleweed]

  • [python313-PyJWT]Unknown

    Source package: [python-PyJWT]

    Details (1)

    • 2.13.0-1.2 · noarch · tumbleweed

      Unknown · Fixed: 2.15.1-1.1

      Version impact unknown

      nvd · python-PyJWT · opensuse · tumbleweed

  • [python314-PyJWT]Unknown

    Source package: [python-PyJWT]

    Details (1)

    • 2.13.0-1.2 · noarch · tumbleweed

      Unknown · Fixed: 2.15.1-1.1

      Version impact unknown

      nvd · python-PyJWT · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]