pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects

A flaw was found in PyJWT. When retrieving cryptographic keys from a JSON Web Key Set JWKS endpoint, PyJWKClient fails to validate HTTP redirect destinations against trusted domain boundaries. A remote attacker who can influence the response of a trusted endpoint can redirect key requests to an...

pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects

A flaw was found in PyJWT. When retrieving cryptographic keys from a JSON Web Key Set JWKS endpoint, PyJWKClient fails to validate HTTP redirect destinations against trusted domain boundaries. A remote attacker who can influence the response of a trusted endpoint can redirect key requests to an...

pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects

A flaw was found in PyJWT. When retrieving cryptographic keys from a JSON Web Key Set JWKS endpoint, PyJWKClient fails to validate HTTP redirect destinations against trusted domain boundaries. A remote attacker who can influence the response of a trusted endpoint can redirect key requests to an...

pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects

A flaw was found in PyJWT. When retrieving cryptographic keys from a JSON Web Key Set JWKS endpoint, PyJWKClient fails to validate HTTP redirect destinations against trusted domain boundaries. A remote attacker who can influence the response of a trusted endpoint can redirect key requests to an...

pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects

A flaw was found in PyJWT. When retrieving cryptographic keys from a JSON Web Key Set JWKS endpoint, PyJWKClient fails to validate HTTP redirect destinations against trusted domain boundaries. A remote attacker who can influence the response of a trusted endpoint can redirect key requests to an...

pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects

A flaw was found in PyJWT. When retrieving cryptographic keys from a JSON Web Key Set JWKS endpoint, PyJWKClient fails to validate HTTP redirect destinations against trusted domain boundaries. A remote attacker who can influence the response of a trusted endpoint can redirect key requests to an...

pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects

A flaw was found in PyJWT. When retrieving cryptographic keys from a JSON Web Key Set JWKS endpoint, PyJWKClient fails to validate HTTP redirect destinations against trusted domain boundaries. A remote attacker who can influence the response of a trusted endpoint can redirect key requests to an...

CVE-2026-102267

A flaw was found in PyJWT. When retrieving cryptographic keys from a JSON Web Key Set JWKS endpoint, PyJWKClient fails to validate HTTP redirect destinations against trusted domain boundaries. A remote attacker who can influence the response of a trusted endpoint can redirect key requests to an...

PT-2026-102359

Name of the Vulnerable Software and Affected Versions PyJWT versions prior to 2.14.0 Description The PyJWKClient component fails to revalidate redirect destinations against the JWKS trust boundary. When a trusted JWKS endpoint returns a redirect influenced by an attacker, the client follows it an...

GHSA-F5MR-Q85P-6HH6 Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage

Impact Three security vulnerabilities were identified in the OIDC Discovery client: 1. Blind Server-Side Request Forgery SSRF via Cross-Host Redirects: Fulcio uses an HTTP client to fetch OIDC discovery metadata /.well-known/openid-configuration. Prior to this fix, if a configured issuer returned...

SUSE CVE-2026-25542

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.43.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, trusted resources verification policies match a resource source string refSource.URI against spec.resources.pattern...

CVE-2026-25542

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.43.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, trusted resources verification policies match a resource source string refSource.URI against spec.resources.pattern...

EUVD-2017-17792

Malware in sbrugna...

CVE-2024-50354

gnark is a fast zk-SNARK library that offers a high-level API to design circuits. In gnark 0.11.0 and earlier, deserialization of Groth16 verification keys allocate excessive memory, consuming a lot of resources and triggering a crash with the error fatal error: runtime: out of memory...

Denial Of Service (DoS)

github.com/consensys/gnark is vulnerable to a Denial of Service DoS. The vulnerability is due to improper memory allocation handling during the deserialization of Groth16 verification keys, allowing attackers to trigger excessive memory allocation, leading to high memory consumption and potential...

SUSE CVE-2024-50354

gnark is a fast zk-SNARK library that offers a high-level API to design circuits. In gnark 0.11.0 and earlier, deserialization of Groth16 verification keys allocate excessive memory, consuming a lot of resources and triggering a crash with the error fatal error: runtime: out of memory...

CVE-2024-50354

gnark is a fast zk-SNARK library that offers a high-level API to design circuits. In gnark 0.11.0 and earlier, deserialization of Groth16 verification keys allocate excessive memory, consuming a lot of resources and triggering a crash with the error fatal error: runtime: out of memory...

CVE-2024-50354 Out-of-memory during deserialization with crafted inputs

gnark is a fast zk-SNARK library that offers a high-level API to design circuits. In gnark 0.11.0 and earlier, deserialization of Groth16 verification keys allocate excessive memory, consuming a lot of resources and triggering a crash with the error fatal error: runtime: out of memory...

CVE-2024-50354 Out-of-memory during deserialization with crafted inputs

gnark is a fast zk-SNARK library that offers a high-level API to design circuits. In gnark 0.11.0 and earlier, deserialization of Groth16 verification keys allocate excessive memory, consuming a lot of resources and triggering a crash with the error fatal error: runtime: out of memory...

CVE-2024-50354: Uncontrolled Resource Consumption

gnark is a fast zk-SNARK library that offers a high-level API to design circuits. In gnark 0.11.0 and earlier, deserialization of Groth16 verification keys allocate excessive memory, consuming a lot of resources and triggering a crash with the error fatal error: runtime: out of memory...