Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
python-jwt can cause key‑service request flooding
published 1 month ago
Summary
The python‑jwt library (versions before 2.14.0) refreshes its list of signing keys every time it sees an unknown key identifier, without limiting how often this happens. An attacker can trigger many unknown identifiers and make the application repeatedly call the external key‑list service, potentially overwhelming it. Upgrade python‑jwt to version 2.14.0 or newer to stop the excessive requests.
What to do
- Update python-jwt to version 2.15.1-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | – | python-jwt |
< 2.15.1-1 Fix: upgrade to 2.15.1-1
|
| Azure Linux:3 | azure | python-jwt | <= 2.13.0-1 |
Original advisory text
CVE-2026-101917 affecting package python-jwt for versions less than 2.15.1-1
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or varying kid values absent from the cached JWKS. As a result, each cache miss causes PyJWKClient to refresh the JWKS. Consequently, attacker traffic can amplify outbound requests to the configured JWKS endpoint. This issue is fixed in version 2.14.0.
References
Timeline
Published28 Sep 2026
Updated2 Nov 2026
First seen30 Sep 2026
Sources
AZL-104982 · OSV
Track software like this
Free during beta