PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade fence-agents-cisco-mdsUpgrade fence-agents-emersonUpgrade fence-agents-commonUpgrade fence-agents-apc-snmpUpgrade fence-agents-nutanix-ahvUpgrade fence-agents-ibm-powervsUpgrade fence-agents-scsiUpgrade fence-agents-kdumpUpgrade fence-agents-azure-armUpgrade fence-agents-sbdUpgrade fence-agents-ibmbladeUpgrade fence-agents-computeUpgrade fence-agents-bladecenterUpgrade fence-agents-ipduUpgrade fence-agents-mpathUpgrade fence-agents-epsUpgrade fence-agents-vmware-soapUpgrade fence-agents-aliyunUpgrade fence-agents-kubevirtUpgrade fence-agents-rsbUpgrade fence-agents-heuristics-pingUpgrade fence-agents-intelmodularUpgrade fence-agents-amt-wsUpgrade fence-agents-allUpgrade fence-agents-virshUpgrade fence-agents-eaton-snmpUpgrade fence-agents-ilo-mpUpgrade fence-agents-rhevmUpgrade fence-agents-ibm-vpcUpgrade fence-agents-apcUpgrade fence-agents-rsaUpgrade fence-agents-hpbladeUpgrade fence-agents-ipmilanUpgrade fence-agents-vmware-restUpgrade fence-agents-openstackUpgrade fence-agents-redfishUpgrade fence-agents-brocadeUpgrade fence-agents-drac5Upgrade fence-agents-lparUpgrade fence-agents-ifmibUpgrade fence-agents-awsUpgrade fence-agents-cisco-ucsUpgrade fence-agents-ilo-moonshotUpgrade fence-agents-wtiUpgrade fence-agents-gceUpgrade fence-agents-zvmUpgrade fence-agents-ilo-sshUpgrade fence-agents-ilo2 | May 3, 2026 | Apr 30, 2026 |
| Debian | — | Upgrade pyjwt | May 6, 2026 | May 6, 2026 |
| Oracle_linux | — | Upgrade fence-virtUpgrade fence-virtd-libvirtUpgrade fence-agents-openstackUpgrade fence-agents-eaton-snmpUpgrade fence-agents-ibm-powervsUpgrade fence-agents-ifmibUpgrade fence-agents-ibmbladeUpgrade fence-agents-rhevmUpgrade fence-agents-kubevirtUpgrade fence-agents-awsUpgrade fence-agents-intelmodularUpgrade fence-agents-lparUpgrade fence-agents-apc-snmpUpgrade fence-agents-ipduUpgrade fence-agents-cisco-ucsUpgrade fence-agents-ipmilanUpgrade fence-agents-wtiUpgrade fence-agents-ilo-sshUpgrade fence-agents-amt-wsUpgrade fence-virtdUpgrade fence-agents-scsiUpgrade fence-agents-brocadeUpgrade fence-virtd-multicastUpgrade fence-agents-gceUpgrade fence-agents-kdumpUpgrade fence-virtd-serialUpgrade fence-agents-heuristics-pingUpgrade fence-agents-computeUpgrade fence-agents-aliyunUpgrade fence-agents-sbdUpgrade fence-agents-nutanix-ahvUpgrade fence-agents-bladecenterUpgrade fence-agents-ilo-mpUpgrade fence-agents-rsaUpgrade fence-agents-epsUpgrade fence-agents-emersonUpgrade fence-agents-cisco-mdsUpgrade fence-virtd-tcpUpgrade fence-agents-azure-armUpgrade fence-agents-apcUpgrade ha-cloud-supportUpgrade fence-agents-vmware-soapUpgrade fence-virtd-cpgUpgrade fence-agents-redfishUpgrade fence-agents-drac5Upgrade fence-agents-ibm-vpcUpgrade fence-agents-virshUpgrade fence-agents-vmware-restUpgrade fence-agents-ilo-moonshotUpgrade fence-agents-hpbladeUpgrade fence-agents-rsbUpgrade fence-agents-ilo2Upgrade fence-agents-mpathUpgrade fence-agents-commonUpgrade fence-agents-all | May 4, 2026 | Mar 12, 2026 |
| Redhat_linux | — | Upgrade python3.12-django-ansible-base+feature_flagsUpgrade fence-agents-sbdUpgrade python3.12-django-ansible-base+authenticationUpgrade fence-virtd-debuginfoUpgrade python3.12-cffiUpgrade fence-agents-vmware-restUpgrade python-pytokens-debugsourceUpgrade fence-virtd-serial-debuginfoUpgrade automation-gateway-configUpgrade automation-eda-controller-baseUpgrade fence-agents-bladecenterUpgrade automation-eda-controllerUpgrade fence-agents-allUpgrade fence-agents-debuginfoUpgrade python3.12-cffi-debugsourceUpgrade fence-agents-scsiUpgrade receptorUpgrade python3-wheel-wheelUpgrade python3-blackUpgrade fence-agents-virshUpgrade automation-eda-controller-event-stream-servicesUpgrade fence-agents-azure-arm-debuginfoUpgrade fence-agents-azure-armUpgrade fence-agents-mpathUpgrade automation-gateway-proxyUpgrade fence-agents-cisco-mdsUpgrade ansible-coreUpgrade fence-agents-hpbladeUpgrade fence-agents-aliyunUpgrade fence-agents-apcUpgrade fence-agents-intelmodularUpgrade fence-agents-epsUpgrade automation-platform-uiUpgrade receptor-debuginfoUpgrade fence-agents-ilo-mpUpgrade python3.12-pyjwtUpgrade python3.12-django-ansible-base+rbacUpgrade receptor-debugsourceUpgrade fence-agents-ilo-moonshotUpgrade python3.12-pyasn1Upgrade yamllintUpgrade python3.12-markdownUpgrade fence-agents-amt-wsUpgrade python3.12-django-ansible-baseUpgrade python3.12-django-ansible-base+redis_clientUpgrade fence-agents-ipduUpgrade python3.12-django-ansible-base+api_documentationUpgrade ha-cloud-supportUpgrade ansible-lintUpgrade python3.12-cryptography-debuginfoUpgrade fence-agents-vmware-soapUpgrade fence-agents-ilo2Upgrade python3.12-pulpcoreUpgrade fence-agents-emersonUpgrade fence-agents-kdumpUpgrade python3.12-cryptography-debugsourceUpgrade fence-agents-redfishUpgrade python3.12-cffi-debuginfoUpgrade fence-agents-drac5Upgrade python3.12-dynaconfUpgrade fence-agents-rhevmUpgrade python3.12-django-ansible-base+channel_authUpgrade fence-virtd-tcpUpgrade python3.12-pathspecUpgrade python3.12-pytokens-debugsourceUpgrade automation-gateway-proxy-server-debuginfoUpgrade fence-agents-rsaUpgrade fence-agents-computeUpgrade python3-pytokens-debuginfoUpgrade fence-agents-kdump-debuginfoUpgrade fence-agents-apc-snmpUpgrade python3-pathspecUpgrade fence-agents-debugsourceUpgrade automation-controllerUpgrade python3-pytokensUpgrade fence-agents-kubevirt-debuginfoUpgrade python3.12-galaxy-ngUpgrade fence-virtd-multicastUpgrade python3.12-blackUpgrade fence-agents-rsbUpgrade automation-gatewayUpgrade automation-controller-serverUpgrade python3.12-pysequoia-debugsourceUpgrade python3.12-django-ansible-base+rest_filtersUpgrade python3.12-django-ansible-base+oauth2_providerUpgrade ha-cloud-support-debuginfoUpgrade fence-agents-nutanix-ahvUpgrade fence-virtd-cpgUpgrade fence-agents-common-debuginfoUpgrade fence-agents-brocadeUpgrade automation-hubUpgrade automation-gateway-proxy-serverUpgrade python3.12-pyjwt+cryptoUpgrade automation-controller-venv-towerUpgrade automation-controller-cliUpgrade receptorctlUpgrade python3.12-galaxy-importerUpgrade ansible-testUpgrade fence-agents-ibm-powervsUpgrade fence-virtd-cpg-debuginfoUpgrade fence-agents-commonUpgrade automation-eda-controller-base-servicesUpgrade fence-agents-zvmUpgrade python3.12-django-ansible-base+activitystreamUpgrade fence-agents-wtiUpgrade python3.12-pyasn1-modulesUpgrade python3.12-django-ansible-base+resource_registryUpgrade python3.12-pysequoiaUpgrade fence-agents-ifmibUpgrade python3.12-pulp-containerUpgrade python3.12-pysequoia-debuginfoUpgrade automation-controller-uiUpgrade fence-agents-lparUpgrade fence-agents-kubevirtUpgrade fence-agents-ibm-vpcUpgrade fence-agents-ibmbladeUpgrade python3.12-django-ansible-base+jwt_consumerUpgrade python3.12-cryptographyUpgrade python3.12-pyOpenSSLUpgrade fence-agents-aliyun-debuginfoUpgrade fence-virtUpgrade python3.12-pytokens-debuginfoUpgrade python3.12-pytokensUpgrade fence-agents-eaton-snmpUpgrade automation-gateway-serverUpgrade fence-agents-heuristics-pingUpgrade fence-agents-cisco-ucsUpgrade automation-gateway-proxy-debugsourceUpgrade python3.12-jwcryptoUpgrade fence-virtdUpgrade fence-agents-ipmilanUpgrade fence-agents-gceNo solution existsUpgrade fence-virtd-libvirtUpgrade automation-eda-controller-worker-servicesUpgrade fence-agents-awsUpgrade fence-agents-ilo-sshUpgrade fence-virtd-tcp-debuginfoUpgrade fence-virtd-serialUpgrade fence-virtd-multicast-debuginfoUpgrade fence-virtd-libvirt-debuginfoUpgrade fence-virt-debuginfoUpgrade fence-agents-openstack | May 4, 2026 | Mar 12, 2026 |
| Rocky_linux | — | Upgrade fence-virtd-cpg-debuginfoUpgrade fence-agents-awsUpgrade fence-virtd-cpgUpgrade fence-agents-zvmUpgrade fence-virt-debuginfoUpgrade fence-agents-allUpgrade fence-agents-kdumpUpgrade fence-agents-kubevirt-debuginfoUpgrade fence-agents-openstackUpgrade fence-agents-debuginfoUpgrade fence-virtd-libvirt-debuginfoUpgrade fence-virtd-multicastUpgrade fence-agents-debugsourceUpgrade fence-agents-commonUpgrade fence-virtUpgrade fence-virtd-serial-debuginfoUpgrade fence-agents-gceUpgrade fence-agents-common-debuginfoUpgrade fence-virtd-multicast-debuginfoUpgrade fence-virtd-tcp-debuginfoUpgrade fence-agents-redfishUpgrade fence-agents-azure-arm-debuginfoUpgrade fence-virtd-debuginfoUpgrade fence-virtdUpgrade fence-agents-aliyunUpgrade fence-virtd-tcpUpgrade fence-agents-aliyun-debuginfoUpgrade fence-agents-computeUpgrade fence-virtd-libvirtUpgrade fence-virtd-serialUpgrade fence-agents-kubevirtUpgrade ha-cloud-supportUpgrade fence-agents-azure-armUpgrade fence-agents-kdump-debuginfoUpgrade ha-cloud-support-debuginfo | May 4, 2026 | Apr 30, 2026 |
| Ubuntu | — | Upgrade python-jwt (Ubuntu Pro)Upgrade python3-jwt (Ubuntu Pro)Upgrade python3-jwt | Mar 31, 2026 | Mar 13, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Mar 12, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub