Description
PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a DER public key as the shared verification key. As a result, PyJWT uses public DER bytes as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jpadilla | pyjwt | >= 2.4.0, < 2.14.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pyjwt | 2.14.0-1 | — |
| Debian 13 | pyjwt | No fix yet | — |
| Debian 12 | pyjwt | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | pyjwt | 2.13.0-1ubuntu1 | USN-8916-2 |
| Ubuntu 26.04 LTS | pyjwt | 2.10.1-4ubuntu1.2 | USN-8916-1 |
| Ubuntu 24.04 LTS | pyjwt | 2.7.0-1ubuntu0.3 | USN-8916-1 |
| Ubuntu 22.04 LTS | pyjwt | 2.3.0-1ubuntu0.5 | USN-8916-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | pyjwt | 1.7.1-2ubuntu2.1+esm3 | USN-8916-1 |
| Ubuntu Pro 18.04 LTS | pyjwt | 1.5.3+ds1-1ubuntu0.1+esm3 | USN-8916-1 |
| Ubuntu Pro 16.04 LTS | pyjwt | 1.3.0-1ubuntu0.1+esm3 | USN-8916-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | fence-virt +55 | 4.16.0-21.el10_2.7 | RHSA-2026:98612, RHSA-2026:94501 |
| RHEL 9 | fence-virt +56 | 4.10.0-110.el9_8.8 | RHSA-2026:98503, RHSA-2026:94500 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | fence-virt +55 | 4.16.0-5.el10_0.14 | RHSA-2026:95012 |
| RHEL 9.6 EUS | fence-virt +56 | 4.10.0-86.el9_6.23 | RHSA-2026:94523 |
| RHEL 9.4 E4S | fence-virt +56 | 4.10.0-62.el9_4.31 | RHSA-2026:94557 |
| RHEL 9.2 E4S | fence-virt +56 | 4.10.0-43.el9_2.27 | RHSA-2026:94634 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-server | 2.6.20261019-1.el9ap | RHSA-2026:87004 |
| Red Hat Ansible Automation Platform 2 | automation-platform-ui | 2.6.15-1.el9ap | RHSA-2026:87004 |
| Red Hat Ansible Automation Platform 2 | python3.12-pulpcore | 3.49.71-1.el9ap | RHSA-2026:87004 |
| Red Hat Ansible Automation Platform 2 | python3.12-pyjwt +1 | 2.14.0-1.el9ap | RHSA-2026:87004 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | fence-virt +54 | 4.16.0-21.el10_2.7 | ALSA-2026:94501 |
| AlmaLinux 9 | fence-virt +36 | 4.10.0-110.el9_8.8 | ALSA-2026:94500 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | fence-agents | 4.16.0-21.el10_2.7 | RLSA-2026:94501 |
| Rocky Linux 10 | fence-virt +54 | 4.16.0-34.el10_3.1 | RLSA-2026:98612 |
| Rocky Linux 9 | fence-agents | 4.10.0-110.el9_8.8 | RLSA-2026:94500 |
| Rocky Linux 9 | fence-virt +55 | 4.10.0-122.el9_9.1 | RLSA-2026:98503 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | python-PyJWT | 2.8.0-150400.8.20.1 | SUSE-SU-2026:5064-1 |
| SLES 15 SP5 | python-PyJWT | 2.8.0-150400.8.20.1 | SUSE-SU-2026:5064-1 |
| SLES 15 SP4 | python-PyJWT | 2.8.0-150400.8.20.1 | SUSE-SU-2026:5064-1 |
| SLES 3 | python-PyJWT | 2.8.0-150400.8.20.1 | SUSE-SU-2026:5064-1 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | python-PyJWT | 2.12.1-160000.3.1 | SUSE-SU-2026:24219-1 |
| SLES for SAP 15 SP6 | python-PyJWT | 2.8.0-150400.8.20.1 | SUSE-SU-2026:5064-1 |
| SLES for SAP 15 SP5 | python-PyJWT | 2.8.0-150400.8.20.1 | SUSE-SU-2026:5064-1 |
| SLES for SAP 15 SP4 | python-PyJWT | 2.8.0-150400.8.20.1 | SUSE-SU-2026:5064-1 |
| SLES 16.0 | python-PyJWT | 2.12.1-160000.3.1 | SUSE-SU-2026:24219-1 |
| SLE Micro 6.2 | python-PyJWT | 2.12.1-160000.3.1 | SUSE-SU-2026:24126-1 |
| SLE Micro 6.1 | python-PyJWT | 2.12.1-slfo.1.1_3.1 | SUSE-SU-2026:24377-1 |
| SLE Micro 6.0 | python-PyJWT | 2.9.0-159998.1.1 | SUSE-SU-2026:24134-1 |
| SLE HPC 15 SP5 | python-PyJWT | 2.8.0-150400.8.20.1 | SUSE-SU-2026:5064-1 |
| SLE HPC 15 SP4 | python-PyJWT | 2.8.0-150400.8.20.1 | SUSE-SU-2026:5064-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | python-PyJWT | 2.12.1-160000.3.1 | openSUSE-SU-2026:22074-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | python3-jwt +1 | 2.4.0-1.amzn2023.0.6 | ALAS2023-2026-3298 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-jwt | 2.15.1-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | fence-virt +52 | 4.16.0-21.el10_2.7 | ELSA-2026-94501 |
| Oracle Linux 9 | fence-virt +54 | 4.10.0-110.el9_8.8 | ELSA-2026-94500 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | datadog-agent-7.77-core-integrations | 7.77.3-r26 | — |
| Wolfi rolling | datadog-agent-7.78-core-integrations | No fix yet | — |
| Wolfi rolling | datadog-agent-7.79-core-integrations | 7.79.2-r20 | — |
| Wolfi rolling | datadog-agent-7.80-core-integrations | 7.80.4-r19 | — |
| Wolfi rolling | datadog-agent-7.81-core-integrations | 7.81.3-r8 | — |
| Wolfi rolling | ggshield | 1.55.0-r1 | — |
| Wolfi rolling | kserve-storage-controller | 0.21.0-r1 | — |
| Wolfi rolling | open-webui | 0.11.4-r1 | — |
| Wolfi rolling | py3-cassandra-medusa | 0.30.1-r1 | — |
| Wolfi rolling | semgrep | 1.178.0-r6 | — |
| Wolfi rolling | superset-6.0 | 6.0.0-r17 | — |
| Wolfi rolling | superset-6.1 | 6.1.0-r10 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | pyjwt | >= 2.4.0, < 2.14.0 | 2.14.0 | GHSA-p4g4-x82p-q773 |
Advisories 27
- RHSA-2026:87004 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:98612 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:98503 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:95012 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:94634 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:94557 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:94523 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:94501 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:94500 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RLSA-2026:98612 Critical: fence-agents security update Rocky Linux Security Advisories · Nov 13, 2026
- RLSA-2026:98503 Critical: fence-agents security update Rocky Linux Security Advisories · Nov 13, 2026
- WID-SEC-2026-4111 Red Hat Ansible Automation Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- ALSA-2026:94500 Critical: fence-agents security update AlmaLinux Security Advisories · Nov 4, 2026
- ALSA-2026:94501 Critical: fence-agents security update AlmaLinux Security Advisories · Nov 4, 2026
- RLSA-2026:94500 Critical: fence-agents security update Rocky Linux Security Advisories · Nov 4, 2026
- RLSA-2026:94501 Critical: fence-agents security update Rocky Linux Security Advisories · Nov 4, 2026
- SUSE-SU-2026:5064-1 Security update for python-PyJWT SUSE / openSUSE Security Updates · Nov 3, 2026
- ELSA-2026-94500 Critical: fence-agents security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 3, 2026
- ELSA-2026-94501 Critical: fence-agents security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Nov 3, 2026
- SUSE-SU-2026:24377-1 Security update for python-PyJWT SUSE / openSUSE Security Updates · Oct 27, 2026
- USN-8916-1 pyjwt vulnerabilities Ubuntu Security Notices (USN) · Oct 27, 2026
- USN-8916-2 pyjwt vulnerabilities Ubuntu Security Notices (USN) · Oct 27, 2026
- ALAS2023-2026-3298 Important: python-jwt security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 26, 2026
- SUSE-SU-2026:24219-1 Security update for python-PyJWT SUSE / openSUSE Security Updates · Oct 21, 2026
- openSUSE-SU-2026:22074-1 Security update for python-PyJWT SUSE / openSUSE Security Updates · Oct 19, 2026
- SUSE-SU-2026:24134-1 Security update for python-PyJWT SUSE / openSUSE Security Updates · Oct 15, 2026
- SUSE-SU-2026:24126-1 Security update for python-PyJWT SUSE / openSUSE Security Updates · Oct 13, 2026