https://vulnerability.circl.lu/sightings/feed 2026-10-04T15:59:12.806016+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/605ab358-a2cf-4cb4-b6d4-18cf5b434d84/export 2026-10-04T15:59:12.836661+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "605ab358-a2cf-4cb4-b6d4-18cf5b434d84", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-102274", "type": "published-proof-of-concept", "source": "https://t.me/bdufstecru/3499", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 RSAAlgorithm.from_jwk() \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u044f jwt/api_jwk.py \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 PyJWT \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0438\u0441\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0439. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438\n\nBDU:2026-15801\nCVE-2026-102274\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://github.com/jpadilla/pyjwt/commit/8915570a0bfda9f0ff0e34e7fb09bdb9d71580cf\nhttps://github.com/jpadilla/pyjwt/releases/tag/2.14.0", "creation_timestamp": "2026-10-02T14:08:33.000000Z"} 2026-10-02T14:08:33+00:00 https://vulnerability.circl.lu/sighting/d172fd16-5589-485c-afa2-ea3258a5afe1/export 2026-10-04T15:59:12.840003+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "d172fd16-5589-485c-afa2-ea3258a5afe1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-102274", "type": "seen", "source": "https://gist.github.com/alon710/07bd1d4c1cf2f6ee50af1c55a6054731", "content": "# CVE-2026-102274: CVE-2026-102274: Denial of Service via Unhandled Exception in PyJWT JWK Set Parser\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-09-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-102274\n\n## Summary\nA vulnerability in PyJWT's JWK Set parsing logic allows a malformed RSA key to trigger an unhandled ValueError, leading to an application-wide or request-level Denial of Service.\n\n## TL;DR\nAn unhandled ValueError during RSA key recovery in PyJWT (2.9.0 - 2.13.0) crashes the entire JWK Set parser, allowing attackers to trigger a Denial of Service via malformed keys.\n\n## Technical Details\n\n- **CWE ID**: CWE-755\n- **Attack Vector**: Network\n- **CVSS Score**: 5.9 (Medium)\n- **EPSS Score**: 0.00352 (Percentile: 26.40%)\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications using PyJWT versions 2.9.0 through 2.13.0 that process JSON Web Key Sets (JWKS).\n- **pyjwt**: >= 2.9.0, < 2.14.0 (Fixed in: `2.14.0`)\n\n## Mitigation\n\n- Upgrade PyJWT to version 2.14.0 or higher.\n- Restrict JWK Set resolution to trusted, hardcoded Identity Providers.\n- Implement application-level error catching for parsing routines.\n\n**Remediation Steps:**\n1. Identify vulnerable PyJWT installations using SCA tools or pip show.\n2. Update dependency declarations in requirements.txt or pyproject.toml to pyjwt>=2.14.0.\n3. Rebuild and redeploy application containers or virtual environments.\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-102274) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-29T22:30:29.000000Z"} 2026-09-29T22:30:29+00:00 https://vulnerability.circl.lu/sighting/247eb8c2-20f7-44fa-acc6-1a5013d7db40/export 2026-10-04T15:59:12.840160+00:00 Joseph Lee https://cvepremium.circl.lu/user/syspect {"uuid": "247eb8c2-20f7-44fa-acc6-1a5013d7db40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-102274", "type": "published-proof-of-concept", "source": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq", "content": "", "creation_timestamp": "2026-09-08T20:35:49.000000Z"} 2026-09-08T20:35:49+00:00