Vulnerability · Published Mar 12, 2026 · Assigned by GitHub_M
CVE-2026-32597PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
High 7.5
In plain English
A high-severity insufficient verification of data authenticity in pyjwt from jpadilla. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.3%top 79.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | fence-agents-aliyun | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-all | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:10 | fence-agents-amt-ws | 4.16.0-13.el10_1.4 | ALSA-2026:13916 |
| AlmaLinux:8 | fence-agents-amt-ws | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:10 | fence-agents-apc | 4.16.0-13.el10_1.4 | ALSA-2026:13916 |
| AlmaLinux:8 | fence-agents-apc | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:10 | fence-agents-apc-snmp | 4.16.0-13.el10_1.4 | ALSA-2026:13916 |
| AlmaLinux:8 | fence-agents-apc-snmp | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-aws | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-azure-arm | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:10 | fence-agents-bladecenter | 4.16.0-13.el10_1.4 | ALSA-2026:13916 |
| AlmaLinux:8 | fence-agents-bladecenter | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:10 | fence-agents-brocade | 4.16.0-13.el10_1.4 | ALSA-2026:13916 |
| AlmaLinux:8 | fence-agents-brocade | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:10 | fence-agents-cisco-mds | 4.16.0-13.el10_1.4 | ALSA-2026:13916 |
| AlmaLinux:8 | fence-agents-cisco-mds | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:10 | fence-agents-cisco-ucs | 4.16.0-13.el10_1.4 | ALSA-2026:13916 |
| AlmaLinux:8 | fence-agents-cisco-ucs | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-common | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-compute | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:10 | fence-agents-drac5 | 4.16.0-13.el10_1.4 | ALSA-2026:13916 |
| AlmaLinux:8 | fence-agents-drac5 | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:10 | fence-agents-eaton-snmp | 4.16.0-13.el10_1.4 | ALSA-2026:13916 |
| AlmaLinux:8 | fence-agents-eaton-snmp | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:10 | fence-agents-emerson | 4.16.0-13.el10_1.4 | ALSA-2026:13916 |
| AlmaLinux:8 | fence-agents-emerson | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:10 | fence-agents-eps | 4.16.0-13.el10_1.4 | ALSA-2026:13916 |
| AlmaLinux:8 | fence-agents-eps | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-gce | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:10 | fence-agents-heuristics-ping | 4.16.0-13.el10_1.4 | ALSA-2026:13916 |
| AlmaLinux:8 | fence-agents-heuristics-ping | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:10 | fence-agents-hpblade | 4.16.0-13.el10_1.4 | ALSA-2026:13916 |
| AlmaLinux:8 | fence-agents-hpblade | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:10 | fence-agents-ibm-powervs | 4.16.0-13.el10_1.4 | ALSA-2026:13916 |
| AlmaLinux:8 | fence-agents-ibm-powervs | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:10 | fence-agents-ibm-vpc | 4.16.0-13.el10_1.4 | ALSA-2026:13916 |
| AlmaLinux:8 | fence-agents-ibm-vpc | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:10 | fence-agents-ibmblade | 4.16.0-13.el10_1.4 | ALSA-2026:13916 |
| AlmaLinux:8 | fence-agents-ibmblade | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:10 | fence-agents-ifmib | 4.16.0-13.el10_1.4 | ALSA-2026:13916 |
| AlmaLinux:8 | fence-agents-ifmib | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:10 | fence-agents-ilo-moonshot | 4.16.0-13.el10_1.4 | ALSA-2026:13916 |
| AlmaLinux:8 | fence-agents-ilo-moonshot | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:10 | fence-agents-ilo-mp | 4.16.0-13.el10_1.4 | ALSA-2026:13916 |
| AlmaLinux:8 | fence-agents-ilo-mp | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:10 | fence-agents-ilo-ssh | 4.16.0-13.el10_1.4 | ALSA-2026:13916 |
| AlmaLinux:8 | fence-agents-ilo-ssh | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:10 | fence-agents-ilo2 | 4.16.0-13.el10_1.4 | ALSA-2026:13916 |
| AlmaLinux:8 | fence-agents-ilo2 | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:10 | fence-agents-intelmodular | 4.16.0-13.el10_1.4 | ALSA-2026:13916 |
| AlmaLinux:8 | fence-agents-intelmodular | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:10 | fence-agents-ipdu | 4.16.0-13.el10_1.4 | ALSA-2026:13916 |
| AlmaLinux:8 | fence-agents-ipdu | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:10 | fence-agents-ipmilan | 4.16.0-13.el10_1.4 | ALSA-2026:13916 |
| AlmaLinux:8 | fence-agents-ipmilan | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-kdump | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-kubevirt | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:10 | fence-agents-lpar | 4.16.0-13.el10_1.4 | ALSA-2026:13916 |
| AlmaLinux:8 | fence-agents-lpar | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:10 | fence-agents-mpath | 4.16.0-13.el10_1.4 | ALSA-2026:13916 |
| AlmaLinux:8 | fence-agents-mpath | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:10 | fence-agents-nutanix-ahv | 4.16.0-13.el10_1.4 | ALSA-2026:13916 |
| AlmaLinux:8 | fence-agents-nutanix-ahv | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-openstack | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-redfish | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:10 | fence-agents-rhevm | 4.16.0-13.el10_1.4 | ALSA-2026:13916 |
| AlmaLinux:8 | fence-agents-rhevm | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:10 | fence-agents-rsa | 4.16.0-13.el10_1.4 | ALSA-2026:13916 |
| AlmaLinux:8 | fence-agents-rsa | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:10 | fence-agents-rsb | 4.16.0-13.el10_1.4 | ALSA-2026:13916 |
| AlmaLinux:8 | fence-agents-rsb | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:10 | fence-agents-sbd | 4.16.0-13.el10_1.4 | ALSA-2026:13916 |
| AlmaLinux:8 | fence-agents-sbd | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:10 | fence-agents-scsi | 4.16.0-13.el10_1.4 | ALSA-2026:13916 |
| AlmaLinux:8 | fence-agents-scsi | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:10 | fence-agents-virsh | 4.16.0-13.el10_1.4 | ALSA-2026:13916 |
| AlmaLinux:8 | fence-agents-virsh | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:10 | fence-agents-vmware-rest | 4.16.0-13.el10_1.4 | ALSA-2026:13916 |
| AlmaLinux:8 | fence-agents-vmware-rest | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:10 | fence-agents-vmware-soap | 4.16.0-13.el10_1.4 | ALSA-2026:13916 |
| AlmaLinux:8 | fence-agents-vmware-soap | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:10 | fence-agents-wti | 4.16.0-13.el10_1.4 | ALSA-2026:13916 |
| AlmaLinux:8 | fence-agents-wti | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | fence-agents-zvm | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux:8 | python3-jwt | 1.6.1-2.el8_10.1 | ALSA-2026:93440 |
| Debian:12 | pyjwt | 2.6.0-1+deb12u1 | DEBIAN-CVE-2026-32597 |
| Debian:13 | pyjwt | 2.10.1-2+deb13u1 | DEBIAN-CVE-2026-32597 |
| Debian:14 | pyjwt | 2.12.1-1 | DEBIAN-CVE-2026-32597 |
| PyPI | pyjwt | 2.12.0 | GHSA-752w-5fwx-jx9f |
| PyPI | pyjwt | 2.12.0 | PYSEC-2026-120 |
| Rocky Linux:10 | fence-agents | 0:4.16.0-13.el10_1.4 | RLSA-2026:13916 |
| Rocky Linux:10 | fence-agents | 0:4.16.0-21.el10_2.1 | RLSA-2026:19138 |
| Rocky Linux:8 | fence-agents | 0:4.2.1-129.el8_10.25 | RLSA-2026:12176 |
| Rocky Linux:9 | fence-agents | 0:4.10.0-110.el9_8.2 | RLSA-2026:19355 |
| Rocky Linux:9 | fence-agents | 0:4.10.0-98.el9_7.12 | RLSA-2026:13672 |
| Rocky Linux:8 | python-jwt | 0:1.6.1-2.el8_10.1 | RLSA-2026:93440 |
| Ubuntu:22.04:LTS | pyjwt | 2.3.0-1ubuntu0.3 | UBUNTU-CVE-2026-32597 |
| Ubuntu:24.04:LTS | pyjwt | 2.7.0-1ubuntu0.1 | UBUNTU-CVE-2026-32597 |
| Ubuntu:25.10 | pyjwt | 2.10.1-2ubuntu0.1 | UBUNTU-CVE-2026-32597 |
Affected products (as reported)
Weakness: CWE-345, CWE-863, CWE-347 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
- https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f x_refsource_CONFIRM
- https://lists.debian.org/debian-lts-announce/2026/05/msg00008.html
- https://access.redhat.com/security/cve/CVE-2026-32597 vdb-entry, x_refsource_REDHAT
- RHBZ#2447194 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32597.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:13512 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13508 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17083 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13916 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19138 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:12176 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:22330 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:21517 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:21431 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13672 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19355 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8748 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8746 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8747 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13553 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13545 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:10140 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:10141 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:10184 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42644 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:24977 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:37275 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19712 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6912 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6720 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6568 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19375 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6926 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:26226 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8437 vendor-advisory, x_refsource_REDHAT