Skip to content
OpenAdvisories
Medium ALAS2023-2026-1519 1 CVE

Moderate: python-jwt security update (Amazon Linux 2023)

Published Mar 30, 2026 · Updated Apr 1, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-32597: A missing verification step has been discovered in PyJWT. PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 SS4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2023 python3-jwt 0:2.4.0-1.amzn2023.0.3
Amazon Linux · 2023 python3-jwt+crypto 0:2.4.0-1.amzn2023.0.3

Vulnerabilities 1

  • High 7.5
    CVE-2026-32597

    PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

    PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the librar…

    jpadilla pyjwt open-webui airflow-3 Debian Ubuntu Azure Linux Wolfi PyPI

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-32597.html