| pyasn1 has quadratic-complexity denial of service in binary REAL decodingCVE-2026-119197 · GHSA-MM57-4V3P-RCHX |
pyasn1Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusionCVE-2026-102275 · GHSA-X33G-CR3X-6449Version ranges need review. |
pyjwtAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)CVE-2026-101917 · GHSA-2GX3-RCP4-G85QVersion ranges need review. |
pyjwtAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)CVE-2026-101918 · GHSA-42VR-XJ54-VC7VVersion ranges need review. |
pyjwtAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| PyJWT: Non-canonical signature segments enable raw-token revocation bypassCVE-2026-102269 · GHSA-HXM8-2XGR-2P9MVersion ranges need review. |
pyjwtAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuseCVE-2026-103001 · GHSA-GVP8-978C-RX2QVersion ranges need review. |
pyjwtAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
No fix reported |
|
| PyJWT: Malformed RSA JWK aborts parsing of an entire JWK SetCVE-2026-102274 · GHSA-W6J9-CWV2-H6WQVersion ranges need review. |
pyjwtAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token headerCVE-2026-102265 · GHSA-8WJV-2P76-3863Version ranges need review. |
pyjwtAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.CVE-2026-102270 · GHSA-JWRC-G2Q2-PQ5PVersion ranges need review. |
pyjwtAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of serviceCVE-2026-59885 · GHSA-8PPF-4F7H-5PPJVersion ranges need review. |
pyasn1Exploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keysCVE-2026-48523 · GHSA-JQ35-7PRP-9V3FVersion ranges need review. |
pyjwtMigration Toolkit for Applications 8/mta/mta-solution-server-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| pyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callbackCVE-2026-27448 · GHSA-VP96-HXJ8-P424Version ranges need review. |
pyopensslRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/lightspeed-rhel8 |
PyPIRed Hat |
Low
|
Fix reported |
|
| cryptography has incomplete DNS name constraint enforcement on peer namesCVE-2026-34073 · GHSA-M959-CC7F-WV43Version ranges need review. |
cryptographyLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID MatchingCVE-2026-4539 · GHSA-5239-WWWM-4PMQVersion ranges need review. |
pygmentsExternal Secrets Operator for Red Hat OpenShift/external-secrets-operator/bitwarden-sdk-server-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT CurvesCVE-2026-26007 · GHSA-R6PH-V2QM-Q3C2Version ranges need review. |
cryptographyExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDsCVE-2026-59884 · GHSA-M4P7-R5RC-7G4JVersion ranges need review. |
pyasn1Exploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWSCVE-2026-48525 · GHSA-W7VC-732C-9M39Version ranges need review. |
pyjwtMigration Toolkit for Applications 8/mta/mta-solution-server-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token forgery via file://, ftp://, data: schemesCVE-2026-48522 · GHSA-993G-76C3-P5M4Version ranges need review. |
pyjwtMigration Toolkit for Applications 8/mta/mta-solution-server-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)CVE-2026-48524 · GHSA-FHV5-28VV-H8M8Version ranges need review. |
pyjwtMigration Toolkit for Applications 8/mta/mta-solution-server-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fixCVE-2026-45409 · GHSA-65PC-FJ4G-8RJXVersion ranges need review. |
idnaConfidential Cluster Operator/confidential-clusters-beta/attestation-key-register-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
