CVE-2026-48524

Katalog CVE

CVSS 3.7 · Low EPSS 0,32%

Kerentanan Improper Cleanup on Thrown Exception pada pyjwt project pyjwt. Skor CVSS 3.1 3.7 (Low) menurut github.com.

Deskripsi (NVD)

PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests. The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint behavior (rate limiting, transient errors) which is beyond the attacker's control. This vulnerability is fixed in 2.13.0.

Rincian

Terbit di NVD

28 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

3.7 (Low), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-460: Improper Cleanup on Thrown Exception
CWE-755: Improper Handling of Exceptional Conditions

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 23,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8 mitigasi · advisory vendor