What’s Vulnerable › Vulnerabilities

CVE-2026-32597: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-03-13 · updated 2026-09-10
• Weakness: CWE-345

Description

PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.

Affected products

• jpadilla pyjwt: before 2.12.0 — fixed in 2.12.0

How to fix

Upgrade to a fixed version: jpadilla pyjwt 2.12.0. Check the vendor advisory for mitigations.

References

• https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f
• https://lists.debian.org/debian-lts-announce/2026/05/msg00008.html
• https://access.redhat.com/errata/RHSA-2026:10140
• https://access.redhat.com/errata/RHSA-2026:10141
• https://access.redhat.com/errata/RHSA-2026:10184
• https://access.redhat.com/errata/RHSA-2026:12176
• https://access.redhat.com/errata/RHSA-2026:13508
• https://access.redhat.com/errata/RHSA-2026:13512
• https://access.redhat.com/errata/RHSA-2026:13545
• https://access.redhat.com/errata/RHSA-2026:13553
• https://access.redhat.com/errata/RHSA-2026:13672
• https://access.redhat.com/errata/RHSA-2026:13916

Get alerted when CVE-2026-32597 or the next vulnerability affects your stack