Summary
It was discovered that PyJWT did not validate the critical header
parameter, contrary to the RFC specification expectations. A remote
attacker could possibly use this issue to bypass certain authentication
checks and restrictions.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | pyjwt | 2.3.0-1ubuntu0.3 |
| Ubuntu · 24.04 LTS 24.04:LTS | pyjwt | 2.7.0-1ubuntu0.1 |
| Ubuntu · 25.10 | pyjwt | 2.10.1-2ubuntu0.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | pyjwt | 1.3.0-1ubuntu0.1+esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | pyjwt | 1.5.3+ds1-1ubuntu0.1+esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | pyjwt | 1.7.1-2ubuntu2.1+esm1 |
References
-
report
https://ubuntu.com/security/CVE-2026-32597