Kingsley Olukanni discovered that PyJWT did not properly handle unknown key identifiers when retrieving signing keys. An attacker could possibly use this issue to amplify requests to the configured key endpoint, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. (CVE-2026-101917) Ekalabya Ghosh discovered that PyJWT did not properly handle certain recursively nested JSON payloads. An attacker could possibly use this issue to cause an application to fail, resulting in a denial of service. (CVE-2026-101918) Pedram Hayati discovered that PyJWT did not properly handle malformed RSA keys in a JSON Web Key Set. An attacker could possibly use this issue to cause authentication failures or a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. (CVE-2026-102274) It was discovered that PyJWT did not properly validate certain OKP private key components. An attacker could possibly use this issue to confuse the identity of public and private keys, and use a stolen sender-constrained token without the legitimate private key. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. (CVE-2026-102275) Update Instructions: Run `sudo pro fix USN-8934-1` to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: python3-jwt - 2.13.0-1ubuntu1.1 No subscription required
Last supporting evidence check: 2026-10-23T10:21:30.036Z UTC
python3-jwt 2.13.0-1ubuntu1.1-2.13.0-1ubuntu1.1
python3-jwt 2.3.0-1ubuntu0.6-2.3.0-1ubuntu0.6
python3-jwt 1.7.1-2ubuntu2.1+esm4-1.7.1-2ubuntu2.1+esm4
python3-jwt 2.7.0-1ubuntu0.4-2.7.0-1ubuntu0.4
python3-jwt 2.10.1-4ubuntu1.3-2.10.1-4ubuntu1.3