cve-2022-39227-jwt-auth-bypass-demo

CVE-2022-39227 JWT Authentication Bypass Demo Project Goal This project demonstrates the CVE-2022-39227 vulnerability in a controlled local lab environment. This vulnerability affects the python-jwt library versions 3.3.4 and allows an attacker to forge JWT claims without knowing the secret key b...

Astra Linux – Vulnerability in python-jwcrypto

JWCrypto implements the JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker could cause a denial-of-service attack by passing in a malicious JWE Token with a high compression ratio. When the server processed this token, it would consume a lot of memory...

Amazon Linux 2023 : python3-jwcrypto (ALAS2023-2026-3158)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3158 advisory. A flaw was found in jwcrypto. The JWK.importkey function validates the keyops JWK member for duplicate values using an algorithm with On^2 time complexity, and the length of keyops is not bounded. A...

Important: python-jwcrypto

Issue Overview: A flaw was found in jwcrypto. The JWK.importkey function validates the keyops JWK member for duplicate values using an algorithm with On^2 time complexity, and the length of keyops is not bounded. A remote, unauthenticated attacker can supply a JWK with a large keyops array to an...

python313-jwcrypto-1.6.1-1.1 on GA media (moderate)

python313-jwcrypto-1.6.1-1.1 on GA media Announcement ID: openSUSE-SU-2026:11972-1 Rating: moderate Cross-References: CVE-2026-92091 CVSS scores: CVE-2026-92091 SUSE : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2026-92091 SUSE : 6.3...

PT-2026-105681

These are all security issues fixed in the python313-jwcrypto-1.6.1-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11972-1 python313-jwcrypto-1.6.1-1.1 on GA media

These are all security issues fixed in the python313-jwcrypto-1.6.1-1.1 package on the GA media of openSUSE Tumbleweed...

Rocky Linux 8 [CIQ] Security Update: custodia / python3-custodia / python3-jwcrypto / python3-pyusb / etc Multiple Vulnerabilities (crlba-2019_4268)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlba-20194268 advisory. Bug Fixes: IPA upgrade fails for latest ipa package when adtrust is installed BZ1773516 This advisory is provided by Ctrl IQ, Inc for Rocky Linux systems...

Rocky Linux 10.2 [CIQ] Security Update: python3-jwcrypto (crlsa-2026_19042)

The Rocky Linux 10.2 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-202619042 advisory. JWCrypto: python-cryptography: python: JWCrypto: Memory exhaustion via crafted compressed JWE tokens CVE-2026-39373 Tenable has extracted the preceding...

Rocky Linux 9 [CIQ] Security Update: python3-jwcrypto (crlsa-2024_2559)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20242559 advisory. python-jwcrypto: malicious JWE token can cause denial of service CVE-2024-28102 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 9 [CIQ] Security Update: python3-jwcrypto (crlsa-2024_9281)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20249281 advisory. JWCrypto: denail of service Via specifically crafted JWE CVE-2023-6681 Tenable has extracted the preceding description block directly from the CIQ security advisory...

Rocky Linux 9 [CIQ] Security Update: python3-jwcrypto (crlsa-2026_19197)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-202619197 advisory. JWCrypto: python-cryptography: python: JWCrypto: Memory exhaustion via crafted compressed JWE tokens CVE-2026-39373 Tenable has extracted the preceding description...

Rocky Linux 8 [CIQ] Security Update: bind-dyndb-ldap / bind-dyndb-ldap-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_3267)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20243267 advisory. JWCrypto: denail of service Via specifically crafted JWE CVE-2023-6681 python-jwcrypto: malicious JWE token can cause denial of service CVE-2024-28102...

OESA-2026-4066 python-jwcrypto security update

Implements JWK, JWS, JWE specifications with python-cryptography Security Fixes: A flaw was found in jwcrypto. The JWK.importkey function validates the keyops JWK member for duplicate values using an algorithm with On^2 time complexity, and the length of keyops is not bounded. A remote,...

Linux Distros Unpatched Vulnerability : CVE-2026-92091

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in jwcrypto. The JWK.importkey function validates the keyops JWK member for duplicate values using an algorithm with On^2 time complexity, and...

Security update for python-jwcrypto (moderate)

openSUSE Security Update: Security update for python-jwcrypto Announcement ID: openSUSE-SU-2026:0328-1 Rating: moderate References: 1277639 Cross-References: CVE-2026-80179 CVSS scores: CVE-2026-80179 SUSE: 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N Affected Products:...

SUSE CVE-2026-92091

A flaw was found in jwcrypto. The JWK.importkey function validates the keyops JWK member for duplicate values using an algorithm with On^2 time complexity, and the length of keyops is not bounded. A remote, unauthenticated attacker can supply a JWK with a large keyops array to an application that...

[SECURITY] Fedora 44 Update: python-jwcrypto-1.6.0-1.fc44

Implements JWK, JWS, JWE specifications using python-cryptography...

[SECURITY] Fedora 45 Update: python-jwcrypto-1.6.0-1.fc45

Implements JWK, JWS, JWE specifications using python-cryptography...

acme2certifier (>=0.45.0.dev1, <=0.46.2), acmen (>=0.5.0, <=0.5.1) +120 more potentially affected by CVE-2026-92091 via jwcrypto (>=1.0.0, <=1.6.0)

jwcrypto PYPI version =1.0.0, =0.45.0.dev1, =0.5.0, =0.1.0, =1.0.0, =1.0.0rc2, =1.8.2b1, =0.1.0, =0.1.0, =0.1.0, =0.11.0rc1, =2.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.4 and more Source cves: CVE-2026-92091 Source advisory: SNYK:PYTHON-JWCRYPTO-19865670...