P4Verified

PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set

CVE-2026-102274 affects azl3 python-jwt 2.13.0-1 on Azure Linux 3.0. CVSS base score 5.9 (Microsoft Security Response Center). EPSS 0.00352 (percentile 0.2663), scored 2026-10-03. Fixed version: 2.14.0-1. Fixed version: 1.179.0-r0.

Published 2026-10-05 08:15:50.137043+00:00

CVE: CVE-2026-102274
Product: azl3 python-jwt 2.13.0-1 on Azure Linux 3.0
CCR priority: 23.7 /100 (P4)
CVSS: 5.9 /10 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U · Microsoft Security Response Center
EPSS: 0.00352 · percentile 0.2662 · 2026-10-04
KEV: no

Affected products

azl3 python-jwt 2.13.0-1 on Azure Linux 3.0
pyjwt · Fixed version: 2.14.0-1
semgrep · Fixed version: 1.179.0-r0

Provenance

Microsoft MSRC Security Update Guide (CVRF) · Source record · observed 2026-10-04 07:08:49.022374+00:00 UTC
OSV.dev · Source record · observed 2026-10-04 23:49:35.786600+00:00 UTC
OSV.dev · Source record · observed 2026-10-04 23:49:35.786600+00:00 UTC
FIRST EPSS daily exploit-probability · Source record · observed 2026-10-05 08:16:32.814186+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-102274.html