{"id":"CVE-2026-32597","title":"PyJWT is a JSON Web Token implementation in Python","summary":"PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not …","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwe":["CWE-345","CWE-863","CWE-347"],"vendor":"pyjwt_project","product":"pyjwt","affected":["pyjwt < 2.12.0"],"patched":["pyjwt 2.12.0"],"published":"2026-03-13","updated":"2026-09-10","sourceUpdated":"2026-09-10T13:18:12.027","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-32597","references":[{"url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f","label":"security-advisories@github.com"},{"url":"https://lists.debian.org/debian-lts-announce/2026/05/msg00008.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2026:10140","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:10141","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:10184","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:12176","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:13508","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:13512","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:13545","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:13553","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:13672","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:13916","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:17083","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:19138","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:19355","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:19375","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:19712","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:21431","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:21517","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:22330","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:24977","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:26226","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:37275","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42644","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:6568","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:6720","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:6912","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:6926","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:8437","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:8746","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:8747","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:8748","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-32597","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447194","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32597.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32597"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32597"},{"url":"https://github.com/jpadilla/pyjwt"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pyjwt/PYSEC-2026-120.yaml"}],"tags":["nvd","cve.org","exploit-available","csaf","vex","red-hat","osv","pip"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-03-13T14:48:42.534762Z"},"epss":0.00269,"epssPercentile":0.19233,"ingestedAt":"2026-07-01T15:50:58.690Z","aliases":["GHSA-752w-5fwx-jx9f","PYSEC-2026-120"],"ecosystem":"pip","slug":"CVE-2026-32597","body":"## Overview\n\nPyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.\n\n## Affected\n\n- `pyjwt < 2.12.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `pyjwt 2.12.0`\n\n## Vendor advisories\n\n- **RHSA-2026:13512** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2026-05-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:13512)\n- **RHSA-2026:13508** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-05-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:13508)\n- **RHSA-2026:17083** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-05-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:17083)\n- **RHSA-2026:13916** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-05-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:13916)\n- **RHSA-2026:19138** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-05-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:19138)\n- **RHSA-2026:12176** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux HighAvailability (v. 8), Red Hat Enterprise Linux ResilientStorage (v. 8) · released 2026-04-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:12176)\n- **RHSA-2026:22330** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux High Availability E4S (v.9.2), Red Hat Enterprise Linux Resilient Storage E4S (v.9.2) · released 2026-06-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:22330)\n- **RHSA-2026:21517** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.4), Red Hat Enterprise Linux High Availability EUS (v.9.4), Red Hat Enterprise Linux Resilient Storage EUS (v.9.4) · released 2026-05-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:21517)\n- **RHSA-2026:21431** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-05-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:21431)\n- **RHSA-2026:13672** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-05-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:13672)\n- **RHSA-2026:19355** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-05-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:19355)\n- **Red Hat VEX** · Important · affected: OpenShift Lightspeed, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI), Red Hat Satellite 6, Red Hat Trusted Artifact Signer · no fix planned: OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat AI Inference Server, Red Hat OpenShift AI (RHOAI), … · updated 2026-09-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32597.json)\n\n## Package advisory (CVE-2026-32597)\n\nAffected packages:\n\n- `pyjwt < 2.12.0`\n\nPatched in:\n\n- `pyjwt 2.12.0`\n\nSource: https://osv.dev/vulnerability/GHSA-752w-5fwx-jx9f","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":201602,"id":"CVE-2026-32597","ts":1789399520134,"field":"exploit_available","old":"false","new":"true"},{"seq":200334,"id":"CVE-2026-32597","ts":1789397105353,"field":"exploit_available","old":"true","new":"false"},{"seq":198258,"id":"CVE-2026-32597","ts":1789391751517,"field":"exploit_available","old":"false","new":"true"},{"seq":196051,"id":"CVE-2026-32597","ts":1789383403412,"field":"exploit_available","old":"true","new":"false"},{"seq":194980,"id":"CVE-2026-32597","ts":1789380316647,"field":"exploit_available","old":"false","new":"true"},{"seq":193767,"id":"CVE-2026-32597","ts":1789378271597,"field":"exploit_available","old":"true","new":"false"},{"seq":192554,"id":"CVE-2026-32597","ts":1789376237138,"field":"exploit_available","old":"false","new":"true"},{"seq":191341,"id":"CVE-2026-32597","ts":1789373135681,"field":"exploit_available","old":"true","new":"false"},{"seq":190126,"id":"CVE-2026-32597","ts":1789369125375,"field":"exploit_available","old":"false","new":"true"},{"seq":188913,"id":"CVE-2026-32597","ts":1789368041094,"field":"exploit_available","old":"true","new":"false"},{"seq":187696,"id":"CVE-2026-32597","ts":1789364998642,"field":"exploit_available","old":"false","new":"true"},{"seq":186483,"id":"CVE-2026-32597","ts":1789363011405,"field":"exploit_available","old":"true","new":"false"},{"seq":185269,"id":"CVE-2026-32597","ts":1789360971839,"field":"exploit_available","old":"false","new":"true"},{"seq":184056,"id":"CVE-2026-32597","ts":1789357946111,"field":"exploit_available","old":"true","new":"false"},{"seq":182308,"id":"CVE-2026-32597","ts":1789354099994,"field":"exploit_available","old":"false","new":"true"},{"seq":181101,"id":"CVE-2026-32597","ts":1789352951967,"field":"exploit_available","old":"true","new":"false"},{"seq":179894,"id":"CVE-2026-32597","ts":1789350003600,"field":"exploit_available","old":"false","new":"true"},{"seq":178687,"id":"CVE-2026-32597","ts":1789347823440,"field":"exploit_available","old":"true","new":"false"},{"seq":177480,"id":"CVE-2026-32597","ts":1789346183770,"field":"exploit_available","old":"false","new":"true"},{"seq":176273,"id":"CVE-2026-32597","ts":1789342754489,"field":"exploit_available","old":"true","new":"false"},{"seq":176057,"id":"CVE-2026-32597","ts":1789342362465,"field":"exploit_available","old":"false","new":"true"},{"seq":175597,"id":"CVE-2026-32597","ts":1789338392562,"field":"exploit_available","old":"true","new":"false"},{"seq":174392,"id":"CVE-2026-32597","ts":1789334606878,"field":"exploit_available","old":"false","new":"true"},{"seq":173187,"id":"CVE-2026-32597","ts":1789333222089,"field":"exploit_available","old":"true","new":"false"},{"seq":172001,"id":"CVE-2026-32597","ts":1789330890600,"field":"exploit_available","old":"false","new":"true"},{"seq":170815,"id":"CVE-2026-32597","ts":1789328401666,"field":"exploit_available","old":"true","new":"false"},{"seq":169610,"id":"CVE-2026-32597","ts":1789326913063,"field":"exploit_available","old":"false","new":"true"},{"seq":168405,"id":"CVE-2026-32597","ts":1789323450022,"field":"exploit_available","old":"true","new":"false"},{"seq":167200,"id":"CVE-2026-32597","ts":1789319378225,"field":"exploit_available","old":"false","new":"true"},{"seq":165995,"id":"CVE-2026-32597","ts":1789318296250,"field":"exploit_available","old":"true","new":"false"},{"seq":164790,"id":"CVE-2026-32597","ts":1789315547421,"field":"exploit_available","old":"false","new":"true"},{"seq":163585,"id":"CVE-2026-32597","ts":1789313265820,"field":"exploit_available","old":"true","new":"false"},{"seq":162380,"id":"CVE-2026-32597","ts":1789311716543,"field":"exploit_available","old":"false","new":"true"},{"seq":161175,"id":"CVE-2026-32597","ts":1789308273412,"field":"exploit_available","old":"true","new":"false"},{"seq":160680,"id":"CVE-2026-32597","ts":1789304198254,"field":"exploit_available","old":"false","new":"true"},{"seq":158518,"id":"CVE-2026-32597","ts":1789299290698,"field":"exploit_available","old":"true","new":"false"},{"seq":157482,"id":"CVE-2026-32597","ts":1789296470842,"field":"exploit_available","old":"false","new":"true"},{"seq":156277,"id":"CVE-2026-32597","ts":1789294393263,"field":"exploit_available","old":"true","new":"false"},{"seq":155072,"id":"CVE-2026-32597","ts":1789292647049,"field":"exploit_available","old":"false","new":"true"},{"seq":153867,"id":"CVE-2026-32597","ts":1789289356535,"field":"exploit_available","old":"true","new":"false"},{"seq":153079,"id":"CVE-2026-32597","ts":1789285268780,"field":"exploit_available","old":"false","new":"true"},{"seq":148013,"id":"CVE-2026-32597","ts":1789270883942,"field":"exploit_available","old":"true","new":"false"},{"seq":146053,"id":"CVE-2026-32597","ts":1789269180948,"field":"exploit_available","old":"false","new":"true"},{"seq":144956,"id":"CVE-2026-32597","ts":1789266113859,"field":"exploit_available","old":"true","new":"false"},{"seq":143860,"id":"CVE-2026-32597","ts":1789262452047,"field":"exploit_available","old":"false","new":"true"},{"seq":142696,"id":"CVE-2026-32597","ts":1789261196834,"field":"exploit_available","old":"true","new":"false"},{"seq":141532,"id":"CVE-2026-32597","ts":1789258621823,"field":"exploit_available","old":"false","new":"true"},{"seq":140334,"id":"CVE-2026-32597","ts":1789256413522,"field":"exploit_available","old":"true","new":"false"},{"seq":139136,"id":"CVE-2026-32597","ts":1789254594582,"field":"exploit_available","old":"false","new":"true"},{"seq":137938,"id":"CVE-2026-32597","ts":1789251595768,"field":"exploit_available","old":"true","new":"false"}]}