CVE-2026-32597 json
PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
published 2026-03-12 7 mo ago modified 2026-09-10 59 d ago also EUVD-2026-11728 , GHSA-752w-5fwx-jx9f , PYSEC-2026-120
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 22%
- public exploits
- 0
- none known
Summary
PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.
Patch / fix
- pypi pyjwt 2.12.0
- Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:2.12.1-1.el8ap, 0:4.6.28-3.el8ap
- Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:2.12.1-1.el9ap, 0:4.6.28-3.el9ap
- Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 0:2.12.1-1.el9ap, 0:4.7.11-2.el9ap
- Red Hat Red Hat Enterprise Linux 10 0:4.16.0-13.el10_1.4, 0:4.16.0-21.el10_2.1
- Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:4.16.0-5.el10_0.9
- Red Hat Red Hat Enterprise Linux 8 0:4.2.1-129.el8_10.25
- Red Hat Red Hat Enterprise Linux 9 0:4.10.0-98.el9_7.12, 0:4.10.0-110.el9_8.2
- Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:4.10.0-43.el9_2.21
- Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support 0:4.10.0-62.el9_4.24
- Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:4.10.0-86.el9_6.16
- Red Hat Red Hat AI Inference Server 3.3 1775680192, 1775680262, 1775749857
- Red Hat Red Hat Ansible Automation Platform 2.5 1777394109, 1777403872
- Red Hat Red Hat Ansible Automation Platform 2.6 1777296732, 1777299023, 1777311120, 1777311601, 1777387242, 1777391447, 1777398576
- Red Hat Red Hat Enterprise Linux AI 3.3 1776773390, 1776773505, 1776871984, 1776871985, 1776871987, 1776872005, 1776938871
- Red Hat Red Hat OpenShift AI 2.25 1776338381, 1776343111, 1780069069, 1783615165, 1783615385, 1783615414, 1783615432, 1783616068, 1783664916, 1783664921, 1783696507, 1783696512, 1783998551, 1783998585
- Red Hat Red Hat OpenShift AI 3.3 1778264363, 1778600187, 1782472374
- Red Hat Red Hat Quay 3.10 1775169155
- Red Hat Red Hat Quay 3.12 1775253092
- Red Hat Red Hat Quay 3.15 1775169219
- Red Hat Red Hat Quay 3.16 1779204086
- Red Hat Red Hat Quay 3.9 1775169218
- Red Hat Red Hat Satellite 6.18 1780414237
- Red Hat Red Hat Trusted Artifact Signer 1.4 1775815407
- pyjwt Debian 12 2.6.0-1+deb12u1
- pyjwt Debian 13 2.10.1-2+deb13u1
- pyjwt Debian 14 2.12.1-1
debian advisories DEBIAN-CVE-2026-32597
- pyjwt Ubuntu 22.04 LTS 2.3.0-1ubuntu0.3
- pyjwt Ubuntu 24.04 LTS 2.7.0-1ubuntu0.1
- pyjwt Ubuntu 25.10 2.10.1-2ubuntu0.1
- pyjwt Ubuntu Pro 16.04 LTS 1.3.0-1ubuntu0.1+esm1
- pyjwt Ubuntu Pro 18.04 LTS 1.5.3+ds1-1ubuntu0.1+esm1
- pyjwt Ubuntu Pro 20.04 LTS 1.7.1-2ubuntu2.1+esm1
ubuntu advisories UBUNTU-CVE-2026-32597
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- fence-agents RHEL 9 4.10.0-110.el9_8.2
- fence-virt RHEL 9 4.10.0-110.el9_8.2
- fence-virtd RHEL 9 4.10.0-110.el9_8.2
- fence-virtd-cpg RHEL 9 4.10.0-110.el9_8.2
- fence-virtd-tcp RHEL 9 4.10.0-110.el9_8.2
- fence-agents-all RHEL 9 4.10.0-110.el9_8.2
- fence-agents-apc RHEL 9 4.10.0-110.el9_8.2
- fence-agents-aws RHEL 9 4.10.0-110.el9_8.2
red hat advisories RHSA-2026:22330RHSA-2026:21517RHSA-2026:21431RHSA-2026:19355RHSA-2026:19138RHSA-2026:17083
- python-PyJWT SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +9 more 2.4.0-150200.3.11.1
- python-PyJWT SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +10 more 2.8.0-150400.8.10.1
- python-PyJWT SLE Module for Public Cloud 12 1.5.3-3.19.1
- python-PyJWT Linux Micro 6.1 2.12.1-slfo.1.1_1.1
- python-PyJWT SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 2.12.1-160000.1.1
- python-PyJWT Linux Micro 6.0 2.9.0-2.1
suse advisories SUSE-SU-2026:1400-1SUSE-SU-2026:1389-1SUSE-SU-2026:1199-1SUSE-SU-2026:20879-1SUSE-SU-2026:20839-1SUSE-SU-2026:20934-1
- python-social-auth-core openSUSE Tumbleweed 4.8.7-1.1
- python-PyJWT openSUSE Leap 16.0 2.12.1-160000.1.1
- python-PyJWT openSUSE Tumbleweed 2.12.1-1.1
opensuse advisories openSUSE-SU-2026:10681-1openSUSE-SU-2026:20431-1openSUSE-SU-2026:10397-1
- python3-jwt AlmaLinux 8 1.6.1-2.el8_10.1
- fence-agents-apc AlmaLinux 10 4.16.0-13.el10_1.4
- fence-agents-eps AlmaLinux 10 4.16.0-13.el10_1.4
- fence-agents-rsa AlmaLinux 10 4.16.0-13.el10_1.4
- fence-agents-rsb AlmaLinux 10 4.16.0-13.el10_1.4
- fence-agents-sbd AlmaLinux 10 4.16.0-13.el10_1.4
- fence-agents-wti AlmaLinux 10 4.16.0-13.el10_1.4
- fence-agents-ilo2 AlmaLinux 10 4.16.0-13.el10_1.4
almalinux advisories ALSA-2026:93440ALSA-2026:13916ALSA-2026:12176
- python-jwt Rocky Linux 8 1.6.1-2.el8_10.1
- fence-agents Rocky Linux 9 4.10.0-110.el9_8.2
- fence-agents Rocky Linux 10 4.16.0-21.el10_2.1
- fence-agents Rocky Linux 10 4.16.0-13.el10_1.4
- fence-agents Rocky Linux 9 4.10.0-98.el9_7.12
- fence-agents Rocky Linux 8 4.2.1-129.el8_10.25
rocky linux advisories RLSA-2026:93440RLSA-2026:19355RLSA-2026:19138RLSA-2026:13916RLSA-2026:13672RLSA-2026:12176
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-32597 updated cvss 7.5
pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
-
Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-ocp-rag-rhel9, openshift-lightspeed/lightspeed-service-api-rhel9, openshift-lightspeed/lightspeed-to-dataverse-exporter-rhel9affected: workaround, no fix available, no fix planned “Will not fix”
-
Red Hat AI Inference Server rhaiis/vllm-cpu-rhel9, rhaiis/vllm-tpu-rhel9, rhaiis-preview/vllm-cuda-rhel9affected: workaround, no fix available
-
Red Hat Ansible Automation Platform 2 ansible-automation-platform-25/gateway-rhel9, ansible-automation-platform-26/controller-rhel9, ansible-automation-platform/automation-dashboard-rhel9, ansible-automation-platform-25/lightspeed-chatbot-rhel8affected: workaround, no fix available, no fix planned “Will not fix”
-
Red Hat Ceph Storage 4 python2-jwtaffected: workaround, no fix available “Fix deferred”
-
Red Hat OpenShift AI (RHOAI) rhoai/odh-llama-stack-core-rhel9 Red Hat Satellite 6 satellite/foreman-mcp-server-rhel9 Red Hat Trusted Artifact Signer rhtas/segment-reporting-rhel9affected: workaround, no fix available
-
Red Hat AI Inference Server 3.3 rhaiis 1775680192, rhaiis 1775680262, rhaiis 1775749857fixed: vendor fix RHSA-2026:8748
-
Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25 1777394109, ansible-automation-platform-25 1777403872fixed: vendor fix RHSA-2026:13553
-
Red Hat Ansible Automation Platform 2.5 for RHEL 8 python3.12-pyjwt 2.12.1-1.el8ap, python3.12-pyjwt+crypto 2.12.1-1.el8ap, automation-controller-venv-tower 4.6.28-3.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 python3.12-pyjwt 2.12.1-1.el9ap, python3.12-pyjwt+crypto 2.12.1-1.el9ap, automation-controller-venv-tower 4.6.28-3.el9apfixed: vendor fix RHSA-2026:13512
show 28 moreshow fewer
-
Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26 1777296732, ansible-automation-platform-26 1777299023, ansible-automation-platform-26 1777311120, ansible-automation-platform-26 1777311601, ansible-automation-platform-26 1777387242, ansible-automation-platform-26 1777391447, +1 morefixed: vendor fix RHSA-2026:13545
-
Red Hat Ansible Automation Platform 2.6 for RHEL 9 python3.12-pyjwt 2.12.1-1.el9ap, automation-controller 4.7.11-2.el9ap, python3.12-pyjwt+crypto 2.12.1-1.el9ap, automation-controller-ui 4.7.11-2.el9ap, automation-controller-cli 4.7.11-2.el9ap, automation-controller-server 4.7.11-2.el9ap, +1 morefixed: vendor fix RHSA-2026:13508
-
Red Hat Enterprise Linux AI 3.3 rhelai3 1776773390, rhelai3 1776773505, rhelai3 1776871984, rhelai3 1776871985, rhelai3 1776871987, rhelai3 1776872005, +1 morefixed: vendor fix RHSA-2026:10140
-
Red Hat Enterprise Linux AppStream (v. 8) fence-agents 4.2.1-129.el8_10.25, fence-agents-all 4.2.1-129.el8_10.25, fence-agents-apc 4.2.1-129.el8_10.25, fence-agents-eps 4.2.1-129.el8_10.25, fence-agents-rsa 4.2.1-129.el8_10.25, fence-agents-rsb 4.2.1-129.el8_10.25, +38 morefixed: vendor fix RHSA-2026:12176
-
Red Hat Enterprise Linux AppStream (v. 9) fence-virt 4.10.0-110.el9_8.2, fence-virt 4.10.0-98.el9_7.12, fence-virtd 4.10.0-110.el9_8.2, fence-virtd 4.10.0-98.el9_7.12, fence-agents 4.10.0-110.el9_8.2, fence-agents 4.10.0-98.el9_7.12, +108 morefixed: vendor fix RHSA-2026:13672
-
Red Hat Enterprise Linux AppStream (v. 10) fence-virt 4.16.0-13.el10_1.4, fence-virt 4.16.0-21.el10_2.1, fence-virtd 4.16.0-13.el10_1.4, fence-virtd 4.16.0-21.el10_2.1, fence-agents 4.16.0-13.el10_1.4, fence-agents 4.16.0-21.el10_2.1, +106 morefixed: vendor fix RHSA-2026:13916
-
Red Hat Enterprise Linux AppStream E4S (v.9.2) fence-virt 4.10.0-43.el9_2.21, fence-virtd 4.10.0-43.el9_2.21, fence-agents 4.10.0-43.el9_2.21, fence-virtd-cpg 4.10.0-43.el9_2.21, fence-virtd-tcp 4.10.0-43.el9_2.21, fence-agents-virsh 4.10.0-43.el9_2.21, +8 morefixed: vendor fix RHSA-2026:22330
-
Red Hat Enterprise Linux AppStream EUS (v. 10.0) fence-virt 4.16.0-5.el10_0.9, fence-virtd 4.16.0-5.el10_0.9, fence-agents 4.16.0-5.el10_0.9, fence-virtd-cpg 4.16.0-5.el10_0.9, fence-virtd-tcp 4.16.0-5.el10_0.9, fence-agents-all 4.16.0-5.el10_0.9, +50 morefixed: vendor fix RHSA-2026:17083
-
Red Hat Enterprise Linux AppStream EUS (v.9.4) fence-virt 4.10.0-62.el9_4.24, fence-virtd 4.10.0-62.el9_4.24, fence-agents 4.10.0-62.el9_4.24, fence-virtd-cpg 4.10.0-62.el9_4.24, fence-virtd-tcp 4.10.0-62.el9_4.24, fence-agents-virsh 4.10.0-62.el9_4.24, +8 morefixed: vendor fix RHSA-2026:21517
-
Red Hat Enterprise Linux AppStream EUS (v.9.6) fence-virt 4.10.0-86.el9_6.16, fence-virtd 4.10.0-86.el9_6.16, fence-agents 4.10.0-86.el9_6.16, fence-virtd-cpg 4.10.0-86.el9_6.16, fence-virtd-tcp 4.10.0-86.el9_6.16, fence-agents-all 4.10.0-86.el9_6.16, +51 morefixed: vendor fix RHSA-2026:21431
-
Red Hat Enterprise Linux BaseOS (v. 8) python-jwt 1.6.1-2.el8_10.1, python3-jwt 1.6.1-2.el8_10.1fixed: vendor fix RHSA-2026:93440
-
Red Hat Enterprise Linux BaseOS AUS (v.8.4) python-jwt 1.6.1-2.el8_4.1, python3-jwt 1.6.1-2.el8_4.1fixed: vendor fix RHSA-2026:93626
-
Red Hat Enterprise Linux BaseOS AUS (v.8.6) python-jwt 1.6.1-2.el8_6.1, python3-jwt 1.6.1-2.el8_6.1fixed: vendor fix RHSA-2026:93780
-
Red Hat Enterprise Linux BaseOS E4S (v.8.8) python-jwt 1.6.1-2.el8_8.1, python3-jwt 1.6.1-2.el8_8.1fixed: vendor fix RHSA-2026:93624
-
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) python-jwt 1.6.1-2.el8_4.1, python3-jwt 1.6.1-2.el8_4.1fixed: vendor fix RHSA-2026:93626
-
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) python-jwt 1.6.1-2.el8_6.1, python3-jwt 1.6.1-2.el8_6.1fixed: vendor fix RHSA-2026:93780
-
Red Hat Enterprise Linux BaseOS TUS (v.8.8) python-jwt 1.6.1-2.el8_8.1, python3-jwt 1.6.1-2.el8_8.1fixed: vendor fix RHSA-2026:93624
-
Red Hat Enterprise Linux High Availability E4S (v.9.2) fence-agents-all 4.10.0-43.el9_2.21, fence-agents-apc 4.10.0-43.el9_2.21, fence-agents-aws 4.10.0-43.el9_2.21, fence-agents-eps 4.10.0-43.el9_2.21, fence-agents-gce 4.10.0-43.el9_2.21, fence-agents-rsa 4.10.0-43.el9_2.21, +37 morefixed: vendor fix RHSA-2026:22330
-
Red Hat Enterprise Linux High Availability EUS (v.9.4) fence-agents-all 4.10.0-62.el9_4.24, fence-agents-apc 4.10.0-62.el9_4.24, fence-agents-aws 4.10.0-62.el9_4.24, fence-agents-eps 4.10.0-62.el9_4.24, fence-agents-gce 4.10.0-62.el9_4.24, fence-agents-rsa 4.10.0-62.el9_4.24, +37 morefixed: vendor fix RHSA-2026:21517
-
Red Hat Enterprise Linux HighAvailability (v. 8) fence-agents-aws 4.2.1-129.el8_10.25, fence-agents-gce 4.2.1-129.el8_10.25, fence-agents-aliyun 4.2.1-129.el8_10.25, fence-agents-azure-arm 4.2.1-129.el8_10.25, fence-agents-openstack 4.2.1-129.el8_10.25fixed: vendor fix RHSA-2026:12176
-
Red Hat Enterprise Linux Resilient Storage E4S (v.9.2) fence-agents-all 4.10.0-43.el9_2.21, fence-agents-apc 4.10.0-43.el9_2.21, fence-agents-aws 4.10.0-43.el9_2.21, fence-agents-eps 4.10.0-43.el9_2.21, fence-agents-gce 4.10.0-43.el9_2.21, fence-agents-rsa 4.10.0-43.el9_2.21, +36 morefixed: vendor fix RHSA-2026:22330
-
Red Hat Enterprise Linux Resilient Storage EUS (v.9.4) fence-agents-all 4.10.0-62.el9_4.24, fence-agents-apc 4.10.0-62.el9_4.24, fence-agents-aws 4.10.0-62.el9_4.24, fence-agents-eps 4.10.0-62.el9_4.24, fence-agents-gce 4.10.0-62.el9_4.24, fence-agents-rsa 4.10.0-62.el9_4.24, +36 morefixed: vendor fix RHSA-2026:21517
-
Red Hat Enterprise Linux ResilientStorage (v. 8) fence-agents-aws 4.2.1-129.el8_10.25, fence-agents-gce 4.2.1-129.el8_10.25, fence-agents-aliyun 4.2.1-129.el8_10.25, fence-agents-azure-arm 4.2.1-129.el8_10.25, fence-agents-openstack 4.2.1-129.el8_10.25fixed: vendor fix RHSA-2026:12176
-
Red Hat Enterprise Linux Server HighAvailability (v. 7 ELS) python-jwt 1.5.3-1.el7_9.1 Red Hat Enterprise Linux Server ResilientStorage (v. 7 ELS) python-jwt 1.5.3-1.el7_9.1fixed: vendor fix RHSA-2026:96084
-
Red Hat OpenShift AI 2.25 rhoai 1776338381, rhoai 1776343111, rhoai/odh-vllm-gaudi-rhel9 1780069069, rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9 1783616068, rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9 1783664916, rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9 1783615414, +10 morefixed: vendor fix RHSA-2026:10184
-
Red Hat OpenShift AI 3.3 rhoai 1778264363, rhoai 1778600187, rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9 1782472374, rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9 1789651383, rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9 1789651379, rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9 1789651387, +10 morefixed: vendor fix RHSA-2026:73987
-
Red Hat Quay 3.9 quay 1775169218fixed: vendor fix RHSA-2026:6926
-
Red Hat Quay 3.10 quay 1775169155fixed: vendor fix RHSA-2026:6912
5 more fixed, 18 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 7 mo ago
Exploit prediction
0.30% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | pyjwt | <2.12.0 |
2.12.0 |
Affected products
- jpadilla pyjwt
- Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9
- Red Hat Red Hat Enterprise Linux 10
- Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
- Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support
- Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
- Red Hat Red Hat AI Inference Server 3.3
- Red Hat Red Hat Ansible Automation Platform 2.5
- Red Hat Red Hat Ansible Automation Platform 2.6
- Red Hat Red Hat Enterprise Linux AI 3.3
- Red Hat Red Hat OpenShift AI 2.25
- Red Hat Red Hat OpenShift AI 3.3
- Red Hat Red Hat Quay 3.10
- Red Hat Red Hat Quay 3.12
- Red Hat Red Hat Quay 3.15
- Red Hat Red Hat Quay 3.16
- Red Hat Red Hat Quay 3.9
- Red Hat Red Hat Satellite 6.18
- Red Hat Red Hat Trusted Artifact Signer 1.4
- Red Hat OpenShift Lightspeed
- Red Hat Red Hat AI Inference Server
- Red Hat Red Hat Ansible Automation Platform 2
- Red Hat Red Hat OpenShift AI (RHOAI)
- Red Hat Red Hat Satellite 6
- Red Hat Red Hat Trusted Artifact Signer
Classification
References
-
github.com
/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f
exploit, web, mitigation, vendor-advisory, evidence
-
access.redhat.com
/errata/RHSA-2026:13512
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:13508
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:17083
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:13916
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:19138
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:12176
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:22330
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:21517
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:21431
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:13672
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:19355
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:8748
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:8746
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:8747
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:13553
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:13545
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:10140
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:10141
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:10184
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:42644
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:24977
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:37275
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:19712
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:6912
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:6720
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:6568
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:19375
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:6926
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:26226
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:8437
vendor-advisory
-
lists.debian.org
/debian-lts-announce/2026/05/msg00008.html
web
-
access.redhat.com
/security/cve/CVE-2026-32597
vdb-entry
-
bugzilla.redhat.com
/show_bug.cgi?id=2447194
issue-tracking
- security.access.redhat.com /data/csaf/v2/vex/2026/cve-2026-32597.json
-
nvd.nist.gov
/vuln/detail/CVE-2026-32597
advisory
-
github.com
/jpadilla/pyjwt
package
-
github.com
/pypa/advisory-database/tree/main/vulns/pyjwt/PYSEC-2026-120.yaml
web
Sources
- CVE List CVE-2026-32597
- GitHub Advisory GHSA-752w-5fwx-jx9f
- NVD CVE-2026-32597
- OSV PYSEC-2026-120
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.