https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Wed, 16 Sep 2026 08:36:35 +0000 https://vulnerability.circl.lu/sighting/3ef057f2-e179-43cf-ab1a-9820a17898a2/export {"uuid": "3ef057f2-e179-43cf-ab1a-9820a17898a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48528", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mt2ucpfdae2e", "content": "CVE-2026-48528 - metacat\nMetacat's data sharing software, used by researchers, has a security weakness that allows hackers to access and manipulate sensitive data without a password. This puts protected\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#metacat #nceas #CVE #infosec", "creation_timestamp": "2026-08-14T19:10:04.499949Z"} {"uuid": "3ef057f2-e179-43cf-ab1a-9820a17898a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48528", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mt2ucpfdae2e", "content": "CVE-2026-48528 - metacat\nMetacat's data sharing software, used by researchers, has a security weakness that allows hackers to access and manipulate sensitive data without a password. This puts protected\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#metacat #nceas #CVE #infosec", "creation_timestamp": "2026-08-14T19:10:04.499949Z"} https://vulnerability.circl.lu/sighting/3ef057f2-e179-43cf-ab1a-9820a17898a2/export Fri, 14 Aug 2026 19:10:04 +0000 https://vulnerability.circl.lu/sighting/d471a3c7-d95a-4b56-9269-2bd086a25e8d/export {"uuid": "d471a3c7-d95a-4b56-9269-2bd086a25e8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48526", "type": "seen", "source": "https://bsky.app/profile/malwareobserver.bsky.social/post/3mqnvav64vs2k", "content": "\ud83d\udc1b VULNERABILITIES CVE Notify: \ud83d\udea8 [CVE-2026-48526](https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx)\nPyJWT...\nhttps://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx #ZeroDay #PatchManagement #Vulnerability", "creation_timestamp": "2026-07-15T04:31:56.806110Z"} {"uuid": "d471a3c7-d95a-4b56-9269-2bd086a25e8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48526", "type": "seen", "source": "https://bsky.app/profile/malwareobserver.bsky.social/post/3mqnvav64vs2k", "content": "\ud83d\udc1b VULNERABILITIES CVE Notify: \ud83d\udea8 [CVE-2026-48526](https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx)\nPyJWT...\nhttps://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx #ZeroDay #PatchManagement #Vulnerability", "creation_timestamp": "2026-07-15T04:31:56.806110Z"} https://vulnerability.circl.lu/sighting/d471a3c7-d95a-4b56-9269-2bd086a25e8d/export Wed, 15 Jul 2026 04:31:56 +0000 https://vulnerability.circl.lu/sighting/da57e5f2-9c59-4c58-955f-19e9d10bb0a9/export {"uuid": "da57e5f2-9c59-4c58-955f-19e9d10bb0a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48526", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mplsgpiwjt23", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-48526 \u0432 PyJWT: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/A2202E3E-EA1D-451F-ABFE-48B728EDDF9C", "creation_timestamp": "2026-07-01T15:10:59.991836Z"} {"uuid": "da57e5f2-9c59-4c58-955f-19e9d10bb0a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48526", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mplsgpiwjt23", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-48526 \u0432 PyJWT: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/A2202E3E-EA1D-451F-ABFE-48B728EDDF9C", "creation_timestamp": "2026-07-01T15:10:59.991836Z"} https://vulnerability.circl.lu/sighting/da57e5f2-9c59-4c58-955f-19e9d10bb0a9/export Wed, 01 Jul 2026 15:10:59 +0000 https://vulnerability.circl.lu/sighting/74336064-0ad3-4e93-95ac-16eb137fee70/export {"uuid": "74336064-0ad3-4e93-95ac-16eb137fee70", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48529", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mp7l26lvbx2l", "content": "CVE-2026-48529 - GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion\nCVE ID : CVE-2026-48529\n \n Published : June 26, 2026, 4:33 p.m. | 1\u00a0hour, 11\u00a0minutes ago\n \n Description : GitHub MCP Server is GitHub's official MCP Server. Fr...", "creation_timestamp": "2026-06-26T18:26:46.636903Z"} {"uuid": "74336064-0ad3-4e93-95ac-16eb137fee70", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48529", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mp7l26lvbx2l", "content": "CVE-2026-48529 - GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion\nCVE ID : CVE-2026-48529\n \n Published : June 26, 2026, 4:33 p.m. | 1\u00a0hour, 11\u00a0minutes ago\n \n Description : GitHub MCP Server is GitHub's official MCP Server. Fr...", "creation_timestamp": "2026-06-26T18:26:46.636903Z"} https://vulnerability.circl.lu/sighting/74336064-0ad3-4e93-95ac-16eb137fee70/export Fri, 26 Jun 2026 18:26:46 +0000 https://vulnerability.circl.lu/sighting/62914447-c3dd-45c7-ac7b-a90bbeb04a1c/export {"uuid": "62914447-c3dd-45c7-ac7b-a90bbeb04a1c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48529", "type": "published-proof-of-concept", "source": "https://github.com/github/github-mcp-server/security/advisories/GHSA-pjp5-fpmr-3349", "content": "", "creation_timestamp": "2026-06-25T22:35:05.042006Z"} {"uuid": "62914447-c3dd-45c7-ac7b-a90bbeb04a1c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-48529", "type": "published-proof-of-concept", "source": "https://github.com/github/github-mcp-server/security/advisories/GHSA-pjp5-fpmr-3349", "content": "", "creation_timestamp": "2026-06-25T22:35:05.042006Z"} https://vulnerability.circl.lu/sighting/62914447-c3dd-45c7-ac7b-a90bbeb04a1c/export Thu, 25 Jun 2026 22:35:05 +0000 https://vulnerability.circl.lu/sighting/2bbef858-e386-4134-bc11-91b87c1e74e8/export {"uuid": "2bbef858-e386-4134-bc11-91b87c1e74e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48524", "type": "seen", "source": "https://gist.github.com/alon710/71d181c729157a76bf49cfdfcfefeae5", "content": "# CVE-2026-48524: CVE-2026-48524: Remote Cache Eviction and Authentication Denial of Service in PyJWT\n\n> **CVSS Score:** 3.7\n> **Published:** 2026-06-15\n> **Full Report:** https://cvereports.com/reports/CVE-2026-48524\n\n## Summary\nA logic flaw in PyJWT's PyJWKClient class allows remote unauthenticated attackers to trigger a complete authentication outage. By transmitting a volume of JWTs containing randomized, non-existent Key ID (kid) values, attackers force synchronous outbound JWKS resolution queries. When these queries fail or time out, a defect in the error cleanup code overwrites the local cache of valid signing keys with None, causing a denial of service.\n\n## TL;DR\nUnauthenticated attackers can send JWTs with randomized KIDs to force connection errors on the target's upstream JWKS endpoint. A flaw in the error cleanup sequence then writes None to the cache, evicting all legitimate signing keys and preventing legitimate users from authenticating.\n\n## Technical Details\n\n- **CWE ID**: CWE-460\n- **Attack Vector**: Network\n- **CVSS v3.1**: 3.7\n- **EPSS Score**: 0.00205\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: none\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications utilizing the pyjwt Python package prior to version 2.13.0 with PyJWKClient enabled for dynamic key retrieval.\n- **pyjwt**: < 2.13.0 (Fixed in: `2.13.0`)\n\n## Mitigation\n\n- Upgrade PyJWT to version 2.13.0 or higher\n- Implement rate limiting at the API Gateway or WAF level to throttle incoming requests with unique, unverified JWT headers\n- Validate the format and structure of the 'kid' header before initiating client database or remote lookup actions\n- Apply strict outbound connection limits and low timeouts on requests to dynamic JWKS endpoints\n\n**Remediation Steps:**\n1. Identify all deployment environments running Python-based JWT authentication layers.\n2. Check the installed PyJWT version using 'pip show pyjwt'.\n3. Upgrade the package to a safe version: 'pip install --upgrade \"pyjwt>=2.13.0\"'.\n4. Restart the application server instances to reload the newly patched dependency into memory.\n5. Set up application telemetry to alert on spikes of 'PyJWKClientConnectionError' or unhandled connection timeouts.\n\n## References\n\n- [GitHub Security Advisory GHSA-fhv5-28vv-h8m8](https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8)\n- [Official CVE Record CVE-2026-48524](https://www.cve.org/CVERecord?id=CVE-2026-48524)\n- [PyJWT Commit Fix 95791b1759b8aa4f2203575d344d5c78564cdc81](https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-48524) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-15T23:21:16.000000Z"} {"uuid": "2bbef858-e386-4134-bc11-91b87c1e74e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48524", "type": "seen", "source": "https://gist.github.com/alon710/71d181c729157a76bf49cfdfcfefeae5", "content": "# CVE-2026-48524: CVE-2026-48524: Remote Cache Eviction and Authentication Denial of Service in PyJWT\n\n> **CVSS Score:** 3.7\n> **Published:** 2026-06-15\n> **Full Report:** https://cvereports.com/reports/CVE-2026-48524\n\n## Summary\nA logic flaw in PyJWT's PyJWKClient class allows remote unauthenticated attackers to trigger a complete authentication outage. By transmitting a volume of JWTs containing randomized, non-existent Key ID (kid) values, attackers force synchronous outbound JWKS resolution queries. When these queries fail or time out, a defect in the error cleanup code overwrites the local cache of valid signing keys with None, causing a denial of service.\n\n## TL;DR\nUnauthenticated attackers can send JWTs with randomized KIDs to force connection errors on the target's upstream JWKS endpoint. A flaw in the error cleanup sequence then writes None to the cache, evicting all legitimate signing keys and preventing legitimate users from authenticating.\n\n## Technical Details\n\n- **CWE ID**: CWE-460\n- **Attack Vector**: Network\n- **CVSS v3.1**: 3.7\n- **EPSS Score**: 0.00205\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: none\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications utilizing the pyjwt Python package prior to version 2.13.0 with PyJWKClient enabled for dynamic key retrieval.\n- **pyjwt**: < 2.13.0 (Fixed in: `2.13.0`)\n\n## Mitigation\n\n- Upgrade PyJWT to version 2.13.0 or higher\n- Implement rate limiting at the API Gateway or WAF level to throttle incoming requests with unique, unverified JWT headers\n- Validate the format and structure of the 'kid' header before initiating client database or remote lookup actions\n- Apply strict outbound connection limits and low timeouts on requests to dynamic JWKS endpoints\n\n**Remediation Steps:**\n1. Identify all deployment environments running Python-based JWT authentication layers.\n2. Check the installed PyJWT version using 'pip show pyjwt'.\n3. Upgrade the package to a safe version: 'pip install --upgrade \"pyjwt>=2.13.0\"'.\n4. Restart the application server instances to reload the newly patched dependency into memory.\n5. Set up application telemetry to alert on spikes of 'PyJWKClientConnectionError' or unhandled connection timeouts.\n\n## References\n\n- [GitHub Security Advisory GHSA-fhv5-28vv-h8m8](https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8)\n- [Official CVE Record CVE-2026-48524](https://www.cve.org/CVERecord?id=CVE-2026-48524)\n- [PyJWT Commit Fix 95791b1759b8aa4f2203575d344d5c78564cdc81](https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-48524) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-15T23:21:16.000000Z"} https://vulnerability.circl.lu/sighting/2bbef858-e386-4134-bc11-91b87c1e74e8/export Mon, 15 Jun 2026 23:21:16 +0000 https://vulnerability.circl.lu/sighting/a2ea3a98-567c-415e-9c9e-4aaf731fe340/export {"uuid": "a2ea3a98-567c-415e-9c9e-4aaf731fe340", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48525", "type": "seen", "source": "https://gist.github.com/alon710/5176e235b1faf51aeac2691145abc27f", "content": "# CVE-2026-48525: CVE-2026-48525: Uncontrolled Resource Consumption in PyJWT Detached JWS Verification\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-06-15\n> **Full Report:** https://cvereports.com/reports/CVE-2026-48525\n\n## Summary\nPyJWT versions 2.8.0 through 2.12.1 are vulnerable to an unauthenticated Denial of Service (DoS) attack. When verifying detached JSON Web Signatures (JWS) using the unencoded-payload option (RFC 7797, b64=false), the library eagerly decodes the payload segment before verifying the header configuration or the cryptographic signature. This behavior enables a remote, unauthenticated attacker to inject an arbitrarily large payload segment, triggering excessive CPU and memory resource consumption prior to signature validation.\n\n## TL;DR\nPyJWT eagerly decodes JWS payload segments before validating the b64=false header configuration, enabling an unauthenticated remote Denial of Service attack via large, dummy payload strings.\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.3 (Medium)\n- **Exploit Status**: PoC Analysis / None\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- PyJWT library installations\n- **PyJWT**: >= 2.8.0, <= 2.12.1 (Fixed in: `2.13.0`)\n\n## Mitigation\n\n- Upgrade to PyJWT version 2.13.0 or higher.\n- Limit the maximum size of incoming HTTP request headers at the web server or reverse proxy level.\n- Implement Web Application Firewall (WAF) rules to inspect and drop JWS payloads exceeding normal length thresholds.\n\n**Remediation Steps:**\n1. Identify all Python environments and requirements files referencing PyJWT.\n2. Update the dependency specification to require 'pyjwt>=2.13.0'.\n3. Rebuild container images and run dependency security scanning tools to verify the update.\n4. Deploy the updated application to production environments.\n\n## References\n\n- [GitHub Security Advisory](https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39)\n- [GitHub Fix Commit](https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81)\n- [CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-48525)\n- [Wiz Vulnerability Database entry](https://www.wiz.io/vulnerability-database/cve/cve-2026-48525)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-48525) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-15T20:01:21.000000Z"} {"uuid": "a2ea3a98-567c-415e-9c9e-4aaf731fe340", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48525", "type": "seen", "source": "https://gist.github.com/alon710/5176e235b1faf51aeac2691145abc27f", "content": "# CVE-2026-48525: CVE-2026-48525: Uncontrolled Resource Consumption in PyJWT Detached JWS Verification\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-06-15\n> **Full Report:** https://cvereports.com/reports/CVE-2026-48525\n\n## Summary\nPyJWT versions 2.8.0 through 2.12.1 are vulnerable to an unauthenticated Denial of Service (DoS) attack. When verifying detached JSON Web Signatures (JWS) using the unencoded-payload option (RFC 7797, b64=false), the library eagerly decodes the payload segment before verifying the header configuration or the cryptographic signature. This behavior enables a remote, unauthenticated attacker to inject an arbitrarily large payload segment, triggering excessive CPU and memory resource consumption prior to signature validation.\n\n## TL;DR\nPyJWT eagerly decodes JWS payload segments before validating the b64=false header configuration, enabling an unauthenticated remote Denial of Service attack via large, dummy payload strings.\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.3 (Medium)\n- **Exploit Status**: PoC Analysis / None\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- PyJWT library installations\n- **PyJWT**: >= 2.8.0, <= 2.12.1 (Fixed in: `2.13.0`)\n\n## Mitigation\n\n- Upgrade to PyJWT version 2.13.0 or higher.\n- Limit the maximum size of incoming HTTP request headers at the web server or reverse proxy level.\n- Implement Web Application Firewall (WAF) rules to inspect and drop JWS payloads exceeding normal length thresholds.\n\n**Remediation Steps:**\n1. Identify all Python environments and requirements files referencing PyJWT.\n2. Update the dependency specification to require 'pyjwt>=2.13.0'.\n3. Rebuild container images and run dependency security scanning tools to verify the update.\n4. Deploy the updated application to production environments.\n\n## References\n\n- [GitHub Security Advisory](https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39)\n- [GitHub Fix Commit](https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81)\n- [CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-48525)\n- [Wiz Vulnerability Database entry](https://www.wiz.io/vulnerability-database/cve/cve-2026-48525)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-48525) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-15T20:01:21.000000Z"} https://vulnerability.circl.lu/sighting/a2ea3a98-567c-415e-9c9e-4aaf731fe340/export Mon, 15 Jun 2026 20:01:21 +0000 https://vulnerability.circl.lu/sighting/98827e7e-05b8-4739-8cf3-5d2b458033ec/export {"uuid": "98827e7e-05b8-4739-8cf3-5d2b458033ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48525", "type": "seen", "source": "https://gist.github.com/alon710/9d5d358571e9a39984e3ba8848038e82", "content": "# CVE-2026-48525: CVE-2026-48525: Uncontrolled Resource Consumption in PyJWT Detached JWS Verification\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-06-15\n> **Full Report:** https://cvereports.com/reports/CVE-2026-48525\n\n## Summary\nPyJWT versions 2.8.0 through 2.12.1 are vulnerable to an unauthenticated Denial of Service (DoS) attack. When verifying detached JSON Web Signatures (JWS) using the unencoded-payload option (RFC 7797, b64=false), the library eagerly decodes the payload segment before verifying the header configuration or the cryptographic signature. This behavior enables a remote, unauthenticated attacker to inject an arbitrarily large payload segment, triggering excessive CPU and memory resource consumption prior to signature validation.\n\n## TL;DR\nPyJWT eagerly decodes JWS payload segments before validating the b64=false header configuration, enabling an unauthenticated remote Denial of Service attack via large, dummy payload strings.\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.3 (Medium)\n- **Exploit Status**: PoC Analysis / None\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- PyJWT library installations\n- **PyJWT**: >= 2.8.0, <= 2.12.1 (Fixed in: `2.13.0`)\n\n## Mitigation\n\n- Upgrade to PyJWT version 2.13.0 or higher.\n- Limit the maximum size of incoming HTTP request headers at the web server or reverse proxy level.\n- Implement Web Application Firewall (WAF) rules to inspect and drop JWS payloads exceeding normal length thresholds.\n\n**Remediation Steps:**\n1. Identify all Python environments and requirements files referencing PyJWT.\n2. Update the dependency specification to require 'pyjwt>=2.13.0'.\n3. Rebuild container images and run dependency security scanning tools to verify the update.\n4. Deploy the updated application to production environments.\n\n## References\n\n- [GitHub Security Advisory](https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39)\n- [GitHub Fix Commit](https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81)\n- [CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-48525)\n- [Wiz Vulnerability Database entry](https://www.wiz.io/vulnerability-database/cve/cve-2026-48525)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-48525) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-15T19:51:29.000000Z"} {"uuid": "98827e7e-05b8-4739-8cf3-5d2b458033ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48525", "type": "seen", "source": "https://gist.github.com/alon710/9d5d358571e9a39984e3ba8848038e82", "content": "# CVE-2026-48525: CVE-2026-48525: Uncontrolled Resource Consumption in PyJWT Detached JWS Verification\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-06-15\n> **Full Report:** https://cvereports.com/reports/CVE-2026-48525\n\n## Summary\nPyJWT versions 2.8.0 through 2.12.1 are vulnerable to an unauthenticated Denial of Service (DoS) attack. When verifying detached JSON Web Signatures (JWS) using the unencoded-payload option (RFC 7797, b64=false), the library eagerly decodes the payload segment before verifying the header configuration or the cryptographic signature. This behavior enables a remote, unauthenticated attacker to inject an arbitrarily large payload segment, triggering excessive CPU and memory resource consumption prior to signature validation.\n\n## TL;DR\nPyJWT eagerly decodes JWS payload segments before validating the b64=false header configuration, enabling an unauthenticated remote Denial of Service attack via large, dummy payload strings.\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.3 (Medium)\n- **Exploit Status**: PoC Analysis / None\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- PyJWT library installations\n- **PyJWT**: >= 2.8.0, <= 2.12.1 (Fixed in: `2.13.0`)\n\n## Mitigation\n\n- Upgrade to PyJWT version 2.13.0 or higher.\n- Limit the maximum size of incoming HTTP request headers at the web server or reverse proxy level.\n- Implement Web Application Firewall (WAF) rules to inspect and drop JWS payloads exceeding normal length thresholds.\n\n**Remediation Steps:**\n1. Identify all Python environments and requirements files referencing PyJWT.\n2. Update the dependency specification to require 'pyjwt>=2.13.0'.\n3. Rebuild container images and run dependency security scanning tools to verify the update.\n4. Deploy the updated application to production environments.\n\n## References\n\n- [GitHub Security Advisory](https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39)\n- [GitHub Fix Commit](https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81)\n- [CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-48525)\n- [Wiz Vulnerability Database entry](https://www.wiz.io/vulnerability-database/cve/cve-2026-48525)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-48525) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-15T19:51:29.000000Z"} https://vulnerability.circl.lu/sighting/98827e7e-05b8-4739-8cf3-5d2b458033ec/export Mon, 15 Jun 2026 19:51:29 +0000 https://vulnerability.circl.lu/sighting/452c6903-5b4a-4174-95d6-a802c95ef29e/export {"uuid": "452c6903-5b4a-4174-95d6-a802c95ef29e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48525", "type": "seen", "source": "https://gist.github.com/alon710/65e78fc78054322fc9a9e7b7f341ade1", "content": "# CVE-2026-48525: CVE-2026-48525: Uncontrolled Resource Consumption in PyJWT Detached JWS Verification\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-06-15\n> **Full Report:** https://cvereports.com/reports/CVE-2026-48525\n\n## Summary\nPyJWT versions 2.8.0 through 2.12.1 are vulnerable to an unauthenticated Denial of Service (DoS) attack. When verifying detached JSON Web Signatures (JWS) using the unencoded-payload option (RFC 7797, b64=false), the library eagerly decodes the payload segment before verifying the header configuration or the cryptographic signature. This behavior enables a remote, unauthenticated attacker to inject an arbitrarily large payload segment, triggering excessive CPU and memory resource consumption prior to signature validation.\n\n## TL;DR\nPyJWT eagerly decodes JWS payload segments before validating the b64=false header configuration, enabling an unauthenticated remote Denial of Service attack via large, dummy payload strings.\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.3 (Medium)\n- **Exploit Status**: PoC Analysis / None\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- PyJWT library installations\n- **PyJWT**: >= 2.8.0, <= 2.12.1 (Fixed in: `2.13.0`)\n\n## Mitigation\n\n- Upgrade to PyJWT version 2.13.0 or higher.\n- Limit the maximum size of incoming HTTP request headers at the web server or reverse proxy level.\n- Implement Web Application Firewall (WAF) rules to inspect and drop JWS payloads exceeding normal length thresholds.\n\n**Remediation Steps:**\n1. Identify all Python environments and requirements files referencing PyJWT.\n2. Update the dependency specification to require 'pyjwt>=2.13.0'.\n3. Rebuild container images and run dependency security scanning tools to verify the update.\n4. Deploy the updated application to production environments.\n\n## References\n\n- [GitHub Security Advisory](https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39)\n- [GitHub Fix Commit](https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81)\n- [CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-48525)\n- [Wiz Vulnerability Database entry](https://www.wiz.io/vulnerability-database/cve/cve-2026-48525)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-48525) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-15T19:41:20.000000Z"} {"uuid": "452c6903-5b4a-4174-95d6-a802c95ef29e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48525", "type": "seen", "source": "https://gist.github.com/alon710/65e78fc78054322fc9a9e7b7f341ade1", "content": "# CVE-2026-48525: CVE-2026-48525: Uncontrolled Resource Consumption in PyJWT Detached JWS Verification\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-06-15\n> **Full Report:** https://cvereports.com/reports/CVE-2026-48525\n\n## Summary\nPyJWT versions 2.8.0 through 2.12.1 are vulnerable to an unauthenticated Denial of Service (DoS) attack. When verifying detached JSON Web Signatures (JWS) using the unencoded-payload option (RFC 7797, b64=false), the library eagerly decodes the payload segment before verifying the header configuration or the cryptographic signature. This behavior enables a remote, unauthenticated attacker to inject an arbitrarily large payload segment, triggering excessive CPU and memory resource consumption prior to signature validation.\n\n## TL;DR\nPyJWT eagerly decodes JWS payload segments before validating the b64=false header configuration, enabling an unauthenticated remote Denial of Service attack via large, dummy payload strings.\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.3 (Medium)\n- **Exploit Status**: PoC Analysis / None\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- PyJWT library installations\n- **PyJWT**: >= 2.8.0, <= 2.12.1 (Fixed in: `2.13.0`)\n\n## Mitigation\n\n- Upgrade to PyJWT version 2.13.0 or higher.\n- Limit the maximum size of incoming HTTP request headers at the web server or reverse proxy level.\n- Implement Web Application Firewall (WAF) rules to inspect and drop JWS payloads exceeding normal length thresholds.\n\n**Remediation Steps:**\n1. Identify all Python environments and requirements files referencing PyJWT.\n2. Update the dependency specification to require 'pyjwt>=2.13.0'.\n3. Rebuild container images and run dependency security scanning tools to verify the update.\n4. Deploy the updated application to production environments.\n\n## References\n\n- [GitHub Security Advisory](https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39)\n- [GitHub Fix Commit](https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81)\n- [CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-48525)\n- [Wiz Vulnerability Database entry](https://www.wiz.io/vulnerability-database/cve/cve-2026-48525)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-48525) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-15T19:41:20.000000Z"} https://vulnerability.circl.lu/sighting/452c6903-5b4a-4174-95d6-a802c95ef29e/export Mon, 15 Jun 2026 19:41:20 +0000 https://vulnerability.circl.lu/sighting/5591fa28-478d-4f1a-a859-8aafd95196d5/export {"uuid": "5591fa28-478d-4f1a-a859-8aafd95196d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48524", "type": "seen", "source": "https://gist.github.com/alon710/1f95260cf4713d452e9aa65f49fefae4", "content": "# CVE-2026-48524: CVE-2026-48524: Remote Cache Eviction and Authentication Denial of Service in PyJWT\n\n> **CVSS Score:** 3.7\n> **Published:** 2026-06-15\n> **Full Report:** https://cvereports.com/reports/CVE-2026-48524\n\n## Summary\nA logic flaw in PyJWT's PyJWKClient class allows remote unauthenticated attackers to trigger a complete authentication outage. By transmitting a volume of JWTs containing randomized, non-existent Key ID (kid) values, attackers force synchronous outbound JWKS resolution queries. When these queries fail or time out, a defect in the error cleanup code overwrites the local cache of valid signing keys with None, causing a denial of service.\n\n## TL;DR\nUnauthenticated attackers can send JWTs with randomized KIDs to force connection errors on the target's upstream JWKS endpoint. A flaw in the error cleanup sequence then writes None to the cache, evicting all legitimate signing keys and preventing legitimate users from authenticating.\n\n## Technical Details\n\n- **CWE ID**: CWE-460\n- **Attack Vector**: Network\n- **CVSS v3.1**: 3.7\n- **EPSS Score**: 0.00205\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: none\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications utilizing the pyjwt Python package prior to version 2.13.0 with PyJWKClient enabled for dynamic key retrieval.\n- **pyjwt**: < 2.13.0 (Fixed in: `2.13.0`)\n\n## Mitigation\n\n- Upgrade PyJWT to version 2.13.0 or higher\n- Implement rate limiting at the API Gateway or WAF level to throttle incoming requests with unique, unverified JWT headers\n- Validate the format and structure of the 'kid' header before initiating client database or remote lookup actions\n- Apply strict outbound connection limits and low timeouts on requests to dynamic JWKS endpoints\n\n**Remediation Steps:**\n1. Identify all deployment environments running Python-based JWT authentication layers.\n2. Check the installed PyJWT version using 'pip show pyjwt'.\n3. Upgrade the package to a safe version: 'pip install --upgrade \"pyjwt>=2.13.0\"'.\n4. Restart the application server instances to reload the newly patched dependency into memory.\n5. Set up application telemetry to alert on spikes of 'PyJWKClientConnectionError' or unhandled connection timeouts.\n\n## References\n\n- [GitHub Security Advisory GHSA-fhv5-28vv-h8m8](https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8)\n- [Official CVE Record CVE-2026-48524](https://www.cve.org/CVERecord?id=CVE-2026-48524)\n- [PyJWT Commit Fix 95791b1759b8aa4f2203575d344d5c78564cdc81](https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-48524) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-15T17:41:21.000000Z"} {"uuid": "5591fa28-478d-4f1a-a859-8aafd95196d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48524", "type": "seen", "source": "https://gist.github.com/alon710/1f95260cf4713d452e9aa65f49fefae4", "content": "# CVE-2026-48524: CVE-2026-48524: Remote Cache Eviction and Authentication Denial of Service in PyJWT\n\n> **CVSS Score:** 3.7\n> **Published:** 2026-06-15\n> **Full Report:** https://cvereports.com/reports/CVE-2026-48524\n\n## Summary\nA logic flaw in PyJWT's PyJWKClient class allows remote unauthenticated attackers to trigger a complete authentication outage. By transmitting a volume of JWTs containing randomized, non-existent Key ID (kid) values, attackers force synchronous outbound JWKS resolution queries. When these queries fail or time out, a defect in the error cleanup code overwrites the local cache of valid signing keys with None, causing a denial of service.\n\n## TL;DR\nUnauthenticated attackers can send JWTs with randomized KIDs to force connection errors on the target's upstream JWKS endpoint. A flaw in the error cleanup sequence then writes None to the cache, evicting all legitimate signing keys and preventing legitimate users from authenticating.\n\n## Technical Details\n\n- **CWE ID**: CWE-460\n- **Attack Vector**: Network\n- **CVSS v3.1**: 3.7\n- **EPSS Score**: 0.00205\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: none\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications utilizing the pyjwt Python package prior to version 2.13.0 with PyJWKClient enabled for dynamic key retrieval.\n- **pyjwt**: < 2.13.0 (Fixed in: `2.13.0`)\n\n## Mitigation\n\n- Upgrade PyJWT to version 2.13.0 or higher\n- Implement rate limiting at the API Gateway or WAF level to throttle incoming requests with unique, unverified JWT headers\n- Validate the format and structure of the 'kid' header before initiating client database or remote lookup actions\n- Apply strict outbound connection limits and low timeouts on requests to dynamic JWKS endpoints\n\n**Remediation Steps:**\n1. Identify all deployment environments running Python-based JWT authentication layers.\n2. Check the installed PyJWT version using 'pip show pyjwt'.\n3. Upgrade the package to a safe version: 'pip install --upgrade \"pyjwt>=2.13.0\"'.\n4. Restart the application server instances to reload the newly patched dependency into memory.\n5. Set up application telemetry to alert on spikes of 'PyJWKClientConnectionError' or unhandled connection timeouts.\n\n## References\n\n- [GitHub Security Advisory GHSA-fhv5-28vv-h8m8](https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8)\n- [Official CVE Record CVE-2026-48524](https://www.cve.org/CVERecord?id=CVE-2026-48524)\n- [PyJWT Commit Fix 95791b1759b8aa4f2203575d344d5c78564cdc81](https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-48524) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-15T17:41:21.000000Z"} https://vulnerability.circl.lu/sighting/5591fa28-478d-4f1a-a859-8aafd95196d5/export Mon, 15 Jun 2026 17:41:21 +0000