What’s Vulnerable › Vulnerabilities

CVE-2016-7036

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-01-23 · updated 2026-06-17
• Weakness: CWE-361

Description

python-jose before 1.3.2 allows attackers to have unspecified impact by leveraging failure to use a constant time comparison for HMAC keys.

Affected products

• Python-Jose Project Python-Jose: through 1.3.1

References

• http://www.securityfocus.com/bid/95845
• https://github.com/mpdavis/python-jose/pull/35/commits/89b46353b9f611e9da38de3d2fedf52331167b93
• https://github.com/mpdavis/python-jose/releases/tag/1.3.2
• http://www.securityfocus.com/bid/95845
• https://github.com/mpdavis/python-jose/pull/35/commits/89b46353b9f611e9da38de3d2fedf52331167b93
• https://github.com/mpdavis/python-jose/releases/tag/1.3.2

Get alerted when CVE-2016-7036 or the next vulnerability affects your stack