PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade fence-agents-apcUpgrade fence-agents-hpbladeUpgrade fence-agents-drac5Upgrade fence-agents-ifmibUpgrade fence-agents-ilo-moonshotUpgrade fence-agents-cisco-ucsUpgrade fence-agents-lparUpgrade fence-agents-ilo-sshUpgrade fence-agents-zvmUpgrade fence-agents-gceUpgrade fence-agents-awsUpgrade fence-agents-vmware-restUpgrade fence-agents-redfishUpgrade fence-agents-wtiUpgrade fence-agents-brocadeUpgrade fence-agents-openstackUpgrade fence-agents-rsaUpgrade fence-agents-ilo2Upgrade fence-agents-ibm-vpcUpgrade fence-agents-ipmilanUpgrade fence-agents-sbdUpgrade fence-agents-apc-snmpUpgrade fence-agents-aliyunUpgrade fence-agents-computeUpgrade fence-agents-ipduUpgrade fence-agents-rhevmUpgrade fence-agents-kdumpUpgrade fence-agents-nutanix-ahvUpgrade fence-agents-commonUpgrade fence-agents-scsiUpgrade fence-agents-azure-armUpgrade fence-agents-intelmodularUpgrade fence-agents-ibm-powervsUpgrade fence-agents-rsbUpgrade fence-agents-eaton-snmpUpgrade fence-agents-emersonUpgrade fence-agents-virshUpgrade fence-agents-kubevirtUpgrade fence-agents-mpathUpgrade fence-agents-bladecenterUpgrade fence-agents-amt-wsUpgrade fence-agents-heuristics-pingUpgrade fence-agents-cisco-mdsUpgrade fence-agents-epsUpgrade fence-agents-vmware-soapUpgrade fence-agents-allUpgrade fence-agents-ilo-mpUpgrade fence-agents-ibmblade | May 3, 2026 | Apr 30, 2026 |
| Debian | — | Upgrade pyjwt | May 6, 2026 | May 6, 2026 |
| Oracle_linux | — | Upgrade fence-virtd-serialUpgrade fence-virtdUpgrade fence-agents-heuristics-pingUpgrade fence-agents-kubevirtUpgrade fence-agents-rhevmUpgrade fence-agents-gceUpgrade fence-agents-kdumpUpgrade fence-agents-scsiUpgrade fence-agents-wtiUpgrade fence-agents-computeUpgrade fence-agents-ifmibUpgrade fence-agents-amt-wsUpgrade fence-virtd-multicastUpgrade fence-agents-brocadeUpgrade fence-agents-ilo-sshUpgrade fence-agents-ipmilanUpgrade fence-agents-aliyunUpgrade fence-agents-ibmbladeUpgrade fence-agents-cisco-ucsUpgrade fence-virtUpgrade fence-agents-ipduUpgrade fence-agents-intelmodularUpgrade fence-agents-lparUpgrade fence-agents-ibm-powervsUpgrade fence-agents-openstackUpgrade fence-agents-awsUpgrade fence-virtd-libvirtUpgrade fence-agents-apc-snmpUpgrade fence-agents-eaton-snmpUpgrade fence-agents-cisco-mdsUpgrade fence-agents-allUpgrade fence-agents-commonUpgrade fence-agents-bladecenterUpgrade fence-agents-redfishUpgrade fence-agents-drac5Upgrade fence-virtd-cpgUpgrade fence-agents-vmware-soapUpgrade fence-agents-ilo2Upgrade fence-agents-sbdUpgrade fence-agents-apcUpgrade ha-cloud-supportUpgrade fence-agents-hpbladeUpgrade fence-agents-ilo-moonshotUpgrade fence-agents-virshUpgrade fence-virtd-tcpUpgrade fence-agents-vmware-restUpgrade fence-agents-rsaUpgrade fence-agents-mpathUpgrade fence-agents-epsUpgrade fence-agents-nutanix-ahvUpgrade fence-agents-ilo-mpUpgrade fence-agents-ibm-vpcUpgrade fence-agents-azure-armUpgrade fence-agents-rsbUpgrade fence-agents-emerson | May 4, 2026 | Mar 12, 2026 |
| Redhat_linux | — | Upgrade fence-virtd-serialUpgrade fence-agents-kubevirtUpgrade python3-pathspecUpgrade python3-pytokens-debuginfoUpgrade automation-controllerUpgrade automation-controller-uiUpgrade fence-agents-debugsourceUpgrade automation-controller-venv-towerUpgrade fence-agents-lparUpgrade automation-gateway-serverUpgrade fence-agents-cisco-ucsUpgrade python3.12-pyjwt+cryptoUpgrade fence-agents-zvmUpgrade python3.12-jwcryptoUpgrade python3-pytokensUpgrade fence-virtUpgrade python3.12-galaxy-importerUpgrade fence-agents-heuristics-pingUpgrade automation-gateway-proxy-debugsourceUpgrade python3.12-pysequoia-debuginfoUpgrade fence-agents-wtiUpgrade receptorctlUpgrade fence-agents-openstackUpgrade ansible-testUpgrade fence-agents-ilo-sshUpgrade fence-virt-debuginfoUpgrade python3.12-galaxy-ngUpgrade automation-controller-cliUpgrade fence-virtd-multicastUpgrade fence-virtd-multicast-debuginfoUpgrade fence-virtd-libvirt-debuginfoUpgrade fence-virtd-tcp-debuginfoUpgrade python3.12-pysequoiaUpgrade fence-agents-awsUpgrade fence-agents-eaton-snmpUpgrade fence-agents-apc-snmpUpgrade fence-agents-commonUpgrade fence-agents-computeUpgrade fence-agents-rsbUpgrade python3.12-django-ansible-base+activitystreamUpgrade python3.12-pulp-containerUpgrade fence-agents-kubevirt-debuginfoUpgrade fence-agents-ibm-vpcUpgrade python3.12-django-ansible-base+resource_registryUpgrade fence-virtd-cpg-debuginfoUpgrade python3.12-django-ansible-base+jwt_consumerUpgrade fence-virtd-libvirtUpgrade fence-agents-aliyun-debuginfoUpgrade fence-agents-ipmilanUpgrade python3.12-pyasn1-modulesUpgrade fence-agents-kdump-debuginfoUpgrade fence-virtdUpgrade automation-eda-controller-base-servicesUpgrade fence-agents-gceUpgrade python3.12-pyOpenSSLUpgrade python3.12-pytokensUpgrade python3.12-blackUpgrade python3.12-cryptographyUpgrade automation-eda-controller-worker-servicesUpgrade fence-virtd-cpgUpgrade ha-cloud-support-debuginfoUpgrade fence-agents-common-debuginfoUpgrade python3.12-django-ansible-base+oauth2_providerUpgrade automation-hubUpgrade fence-agents-brocadeUpgrade fence-agents-ibmbladeUpgrade fence-agents-ifmibUpgrade python3.12-django-ansible-base+rest_filtersUpgrade python3.12-pysequoia-debugsourceUpgrade fence-agents-nutanix-ahvUpgrade automation-controller-serverUpgrade automation-gatewayUpgrade automation-gateway-proxy-serverUpgrade fence-agents-ibm-powervsUpgrade python3.12-pytokens-debuginfoUpgrade fence-agents-ilo-moonshotUpgrade python3.12-django-ansible-base+channel_authUpgrade python3.12-django-ansible-baseUpgrade receptor-debugsourceUpgrade fence-agents-mpathUpgrade fence-agents-kdumpUpgrade fence-agents-aliyunUpgrade ansible-coreUpgrade fence-agents-ilo-mpUpgrade fence-agents-drac5Upgrade python3.12-pathspecUpgrade automation-platform-uiUpgrade fence-agents-epsUpgrade python3.12-django-ansible-base+api_documentationUpgrade fence-agents-rhevmUpgrade python3.12-dynaconfUpgrade fence-agents-ipduUpgrade ha-cloud-supportUpgrade fence-agents-vmware-soapUpgrade python3.12-cryptography-debugsourceUpgrade python3.12-cffi-debuginfoUpgrade fence-agents-rsaUpgrade fence-agents-emersonUpgrade automation-gateway-proxy-server-debuginfoUpgrade fence-agents-hpbladeUpgrade automation-eda-controllerUpgrade python3-wheel-wheelUpgrade automation-gateway-configUpgrade python-pytokens-debugsourceUpgrade fence-virtd-serial-debuginfoUpgrade python3.12-pyjwtUpgrade python3.12-pyasn1Upgrade python3.12-django-ansible-base+redis_clientUpgrade fence-agents-ilo2Upgrade fence-agents-redfishUpgrade fence-agents-amt-wsUpgrade python3.12-pytokens-debugsourceUpgrade python3.12-django-ansible-base+rbacUpgrade python3.12-cryptography-debuginfoUpgrade python3.12-markdownUpgrade yamllintUpgrade ansible-lintUpgrade python3.12-django-ansible-base+authenticationUpgrade python3.12-cffi-debugsourceUpgrade automation-eda-controller-baseUpgrade python3.12-django-ansible-base+feature_flagsUpgrade fence-virtd-debuginfoUpgrade fence-agents-vmware-restUpgrade fence-agents-sbdUpgrade fence-agents-debuginfoUpgrade fence-agents-bladecenterUpgrade python3.12-pulpcoreUpgrade fence-agents-intelmodularUpgrade fence-agents-azure-arm-debuginfoUpgrade receptorUpgrade fence-agents-cisco-mdsUpgrade fence-agents-allUpgrade automation-gateway-proxyUpgrade automation-eda-controller-event-stream-servicesUpgrade fence-agents-virshUpgrade fence-agents-scsiUpgrade python3-blackUpgrade fence-agents-apcUpgrade fence-agents-azure-armUpgrade python3.12-cffiUpgrade fence-virtd-tcpUpgrade receptor-debuginfo | May 4, 2026 | Mar 12, 2026 |
| Rocky_linux | — | Upgrade fence-agents-gceUpgrade ha-cloud-support-debuginfoUpgrade fence-agents-common-debuginfoUpgrade fence-virtdUpgrade fence-agents-aliyunUpgrade fence-virtd-multicast-debuginfoUpgrade fence-agents-kubevirtUpgrade fence-virtd-serialUpgrade fence-agents-azure-arm-debuginfoUpgrade ha-cloud-supportUpgrade fence-agents-aliyun-debuginfoUpgrade fence-virtd-debuginfoUpgrade fence-agents-kdump-debuginfoUpgrade fence-agents-azure-armUpgrade fence-virtd-libvirtUpgrade fence-agents-redfishUpgrade fence-virtd-tcp-debuginfoUpgrade fence-virtd-tcpUpgrade fence-agents-computeUpgrade fence-agents-debugsourceUpgrade fence-virtUpgrade fence-virt-debuginfoUpgrade fence-agents-commonUpgrade fence-agents-allUpgrade fence-agents-kubevirt-debuginfoUpgrade fence-virtd-multicastUpgrade fence-virtd-libvirt-debuginfoUpgrade fence-virtd-cpgUpgrade fence-agents-debuginfoUpgrade fence-agents-awsUpgrade fence-virtd-serial-debuginfoUpgrade fence-agents-zvmUpgrade fence-agents-kdumpUpgrade fence-agents-openstackUpgrade fence-virtd-cpg-debuginfo | May 4, 2026 | Apr 30, 2026 |
| Ubuntu | — | Upgrade python3-jwtUpgrade python-jwt (Ubuntu Pro)Upgrade python3-jwt (Ubuntu Pro) | Mar 31, 2026 | Mar 13, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Mar 12, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub