← Packages
python-pyjwt
Implementation of JSON Web Token validation for Python
- Current
- 2.14.0
- Candidate
- 2.15.1Stale
- License
- MIT
RuntimeDeps
| Dependency | Observed source | Current requirement | Candidate requirement |
|---|---|---|---|
4.16.0 | |||
3.14.9 |
Optional RuntimeDeps
| Dependency | Observed source | Current requirement | Candidate requirement |
|---|---|---|---|
50.0.2 |
Dependency conditions
- Applies when (any)
- python_version < "3.11"
- Applies when (any)
- extra == "crypto"
Advisory · 2
Provider matches do not establish RPM applicability. Local patches, bundled dependencies and binary artifacts are not evaluated.
- Summary
- PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)OSVOSV
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.413%FIRST
- Returned advisory
- GHSA-42vr-xj54-vc7vOSV
- Returned advisory
- PYSEC-2026-4141OSV
- Aliases
- GHSA-42vr-xj54-vc7v, PYSEC-2026-4141OSV
- KEV
- NoCISA
- Summary
- PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusionOSV
- EPSS model date
- 2026-11-09FIRST
- EPSS probability
- 0.167%FIRST
- Returned advisory
- GHSA-x33g-cr3x-6449OSV
- Returned advisory
- PYSEC-2026-4183OSV
- Aliases
- GHSA-x33g-cr3x-6449, PYSEC-2026-4183OSV
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:NOSV
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:NOSV
Description
PyJWT is a Python implementation of JSON Web Token draft 01. This library provides a means of representing signed content using JSON data structures, including claims to be transferred between two parties encoded as digitally signed and encrypted JSON objects.
Changelog
PR · 10
Checks
| Monitor | Observation | Last checked |
|---|---|---|
Stale Repository refresh: git fetch exited 128 (authentication) | ||
Stale Source last confirmed at 2026-11-10T13:32:55+00:00; repository refresh overdue. | ||
Checked | ||
Checked | ||
Not configured No reliable monitor identity/configuration. | — | |
Checked Compared same-provider, same-project SPDX metadata for this version pair. | Last attempted | |
Checked | Last attempted | |
Checked Current source component only; local patches, build options, bundled dependencies and binary artifacts are not evaluated. | Last attempted | |
Checked |