SUSE-SU-2026:24126-1: python-PyJWT&distro=SUSE Linux Micro 6.2 SUSE Linux Enterprise

Vulnerability summary

SUSE-SU-2026:24126-1 is a vulnerability in python-PyJWT&distro=SUSE Linux Micro 6.2 SUSE Linux Enterprise with no CVSS score yet.

Timeline

1. 09-10-2026
   PublishedVulnerability first disclosed.
2. 13-10-2026
   Last modifiedVulnerability information updated.

Description

Security update for python-PyJWT This update for python-PyJWT fixes the following issues: - CVE-2026-101917: attacker traffic can amplify outbound requests to the configured JWKS endpoint (bsc#1283060). - CVE-2026-101918: unauthenticated request can raise an exception that may produce an HTTP 500 response (bsc#1283061). - CVE-2026-102267: forwarded credentials may be disclosed or verification keys may be substituted (bsc#1283064). - CVE-2026-102268: an attacker who knows the public key can forge authenticated HMAC tokens (bsc#1283065). - CVE-2026-102269: raw-token revocation checks can fail to recognize an equivalent modified token (bsc#1283066). - CVE-2026-102270: an attacker can cause intensive CPU consumption (bsc#1283067). - CVE-2026-102271: an attacker who knows the public key can forge authenticated HMAC tokens (bsc#1283068). - CVE-2026-102274: Malformed RSA JWK aborts parsing of an entire JWK Set (bsc#1283071). - CVE-2026-102275: an attacker may use a stolen sender-constrained token without the legitimate private key (bsc#1283072). - CVE-2026-103001: reused mutable options mapping can cause verification checks bypass on subsequent decode calls (bsc#1283829).

No weakness data has been published for this record.