Skip to content
OpenAdvisories
High ELSA-2026-93440 1 CVE

Important: python-jwt security update (Oracle Linux 8)

Published Nov 1, 2026 · Updated Nov 1, 2026

Ecosystem: Oracle Linux

Summary

[1.6.1-2.1]
- Fix CVE-2026-32597

Resolves: RHEL-271640

Fixed packages 1

ReleasePackageFixed in
Oracle Linux · 8 python3-jwt 0:1.6.1-2.el8_10.1

Vulnerabilities 1

  • High 7.5
    CVE-2026-32597

    PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

    PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the librar…

    jpadilla pyjwt open-webui airflow-3 Debian Ubuntu Azure Linux Wolfi PyPI