SUSE-SU-2026:5064-1

    Dashboard / Vulnerabilities / SUSE-SU-2026:5064-1

    SUSE-SU-2026:5064-1

    Published: 3 Nov 2026Last Modified: 3 Nov 2026

    Summary: Security update for python-PyJWT

    Details: This update for python-PyJWT fixes the following issues: - CVE-2026-101917: attacker traffic can amplify outbound requests to the configured JWKS endpoint (bsc#1283060). - CVE-2026-101918: unauthenticated request can raise an exception that may produce an HTTP 500 response (bsc#1283061). - CVE-2026-102267: forwarded credentials may be disclosed or verification keys may be substituted (bsc#1283064). - CVE-2026-102268: an attacker who knows the public key can forge authenticated HMAC tokens (bsc#1283065). - CVE-2026-102269: raw-token revocation checks can fail to recognize an equivalent modified token (bsc#1283066). - CVE-2026-102270: an attacker can cause intensive CPU consumption (bsc#1283067). - CVE-2026-102271: an attacker who knows the public key can forge authenticated HMAC tokens (bsc#1283068). - CVE-2026-102275: an attacker may use a stolen sender-constrained token without the legitimate private key (bsc#1283072).

    References: https://www.suse.com/support/update/announcement/2026/suse-su-20265064-1/, https://bugzilla.suse.com/1283060, https://bugzilla.suse.com/1283061, https://bugzilla.suse.com/1283064, https://bugzilla.suse.com/1283065, https://bugzilla.suse.com/1283066, https://bugzilla.suse.com/1283067, https://bugzilla.suse.com/1283068, https://bugzilla.suse.com/1283072, https://www.suse.com/security/cve/CVE-2026-101917, https://www.suse.com/security/cve/CVE-2026-101918, https://www.suse.com/security/cve/CVE-2026-102267, https://www.suse.com/security/cve/CVE-2026-102268, https://www.suse.com/security/cve/CVE-2026-102269, https://www.suse.com/security/cve/CVE-2026-102270, https://www.suse.com/security/cve/CVE-2026-102271, https://www.suse.com/security/cve/CVE-2026-102275

    Affected packages

    Package

    Name: python-PyJWT

    Purl: pkg:rpm/suse/python-PyJWT&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Public%20Cloud%2015%20SP4

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.8.0-150400.8.20.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    SUSE-SU-2026:5064-1 | CVE-DB