gpp_maybe Security update for python-pyjwt

SUSE-SLE-Module-Python3-15-SP7-2026-2626

This update for python-PyJWT fixes the following issues - CVE-2026-48522: `PyJWKClient` passes URI arguments directly to `urllib.request.urlopen()` and allows for SSRF and token forgery (bsc#1266798). - CVE-2026-48523: verifier-side algorithm allow-list bypass when `jwt.decode()` or `jwt.decode_complete()` are called with a PyJWK key (bsc#1266799). - CVE-2026-48524: unlimited processing of JWTs with unknown kid values by `PyJWKClient.get_signing_key()` leads to unbounded JWKS endpoint requests and DoS (bsc#1266800). - CVE-2026-48525: unbounded Base64URL decoding of unused payload segment in `b64=false` detached JWS allows for DoS (bsc#1266801). - CVE-2026-48526: no validation of use of JSON Web Keys in HMAC algorithm when decoding JSON Web Tokens allows for forged HS256 tokens (bsc#1266802).

Release Date

Jun 25 2026
References

Bugzilla: 1266798, 1266799, 1266800, 1266801, 1266802
CVEs: CVE-2026-48522, CVE-2026-48523, CVE-2026-48524, CVE-2026-48525, CVE-2026-48526
Type

security
Severity

important

cloud_download Downloads

To download packages, you need to log in and have a valid subscription.

Python 3 Module 15.7 s390x

Packages

python-PyJWT
JSON Web Token implementation in Python

2.8.0-150400.8.13.1 lock src

python311-PyJWT
JSON Web Token implementation in Python

2.8.0-150400.8.13.1 lock rpm

Python 3 Module 15.7 ppc64le

Packages

python-PyJWT
JSON Web Token implementation in Python

2.8.0-150400.8.13.1 lock src

python311-PyJWT
JSON Web Token implementation in Python

2.8.0-150400.8.13.1 lock rpm

Python 3 Module 15.7 aarch64

Packages

python-PyJWT
JSON Web Token implementation in Python

2.8.0-150400.8.13.1 lock src

python311-PyJWT
JSON Web Token implementation in Python

2.8.0-150400.8.13.1 lock rpm

Python 3 Module 15.7 x86_64

Packages

python-PyJWT
JSON Web Token implementation in Python

2.8.0-150400.8.13.1 lock src

python311-PyJWT
JSON Web Token implementation in Python

2.8.0-150400.8.13.1 lock rpm