{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:480e0747-9b23-55d9-bb2f-3dad89d0bd57", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "pyjwt", "purl": "pkg:pypi/pyjwt@2.8.0.post6+tuxcare", "type": "library", "bom-ref": "pkg:pypi/pyjwt@2.8.0.post6+tuxcare", "version": "2.8.0.post6+tuxcare", "pedigree": { "ancestors": [ { "name": "pyjwt", "purl": "pkg:pypi/pyjwt@2.8.0", "type": "library", "version": "2.8.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-29217", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:201aafc8-8ce3-5598-92c2-a8e577e7d04a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-29217 affects version 2.8.0.post6+tuxcare of pyjwt." } }, { "id": "CVE-2025-45768", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:727b668a-e23c-5453-a250-102c1e53a7f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-45768 is fixed in version 2.8.0.post6+tuxcare of pyjwt." } }, { "id": "CVE-2026-101917", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:5b6956d5-326d-54f0-991f-93eb546d90e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101917 is fixed in version 2.8.0.post6+tuxcare of pyjwt." } }, { "id": "CVE-2026-101918", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:77a9356d-7ec0-5ab4-bd8d-94e8ce195725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101918 is fixed in version 2.8.0.post6+tuxcare of pyjwt." } }, { "id": "CVE-2026-102265", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:9dcc09c3-b4a0-54eb-9b1f-4782c1c8c0e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-102265 is fixed in version 2.8.0.post6+tuxcare of pyjwt." } }, { "id": "CVE-2026-102266", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:022a6131-7bb0-5ea1-b9cb-b7e21e0bb831", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-102266 does not affect version 2.8.0.post6+tuxcare of pyjwt. Not affected: the CVE-2026-102266 fix (jpadilla/pyjwt f91ed44) changes the isinstance(key, PyJWK) branch of _verify_signature, introduced in 2.9.0 (ab8176a). This branch has a single path that always calls prepare_key, and HMACAlgorithm.prepare_key rejects empty keys (CVE-2026-48526 backport). Empty-oct-JWK forgery probe rejected on all routes (raw, from_jwk, PyJWK, PyJWKSet, PyJWKClient) incl. released .post6+tuxcare from Nexus.", "justification": "code_not_present" } }, { "id": "CVE-2026-102267", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:43a12434-f9d0-53e7-aa2f-e13e8a192a57", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-102267 is fixed in version 2.8.0.post6+tuxcare of pyjwt." } }, { "id": "CVE-2026-102268", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:26b4a6c6-7365-5aa3-80a1-1d158067818f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-102268 is fixed in version 2.8.0.post6+tuxcare of pyjwt." } }, { "id": "CVE-2026-102269", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:284cc826-c754-579e-93c6-41a10a4caf5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-102269 is fixed in version 2.8.0.post6+tuxcare of pyjwt." } }, { "id": "CVE-2026-102270", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:3d8d82a8-b888-5768-9086-43d71d02e273", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-102270 is fixed in version 2.8.0.post6+tuxcare of pyjwt." } }, { "id": "CVE-2026-102271", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:d12c8288-9b42-5bab-a170-7f42ee9c091b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-102271 is fixed in version 2.8.0.post6+tuxcare of pyjwt." } }, { "id": "CVE-2026-102272", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:5b8e0720-ff17-50a0-baa7-497f5960118d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-102272 is fixed in version 2.8.0.post6+tuxcare of pyjwt." } }, { "id": "CVE-2026-102273", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:861421b4-7199-58a1-a0e9-bcefd3a1db1d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-102273 is fixed in version 2.8.0.post6+tuxcare of pyjwt." } }, { "id": "CVE-2026-102274", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:6ccb136d-d97e-5d81-8b3e-ae9265da677b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-102274 is fixed in version 2.8.0.post6+tuxcare of pyjwt." } }, { "id": "CVE-2026-102275", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:df10807c-43c8-523a-b4c4-4b76e40a2044", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-102275 is fixed in version 2.8.0.post6+tuxcare of pyjwt." } }, { "id": "CVE-2026-103001", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:9747306c-0dc6-580b-93ee-af7b86089df5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-103001 does not affect version 2.8.0.post6+tuxcare of pyjwt. not_affected \u2014 The target PyJWT version 2.8.0.post5+tuxcare is not affected by CVE-2026-103001. The vulnerability (caller-supplied options dict mutation causing claim verification bypass when dict is reused across decode operations) was fixed in upstream commit 3d4d822 (2022-04-05) by Aarni Koskela. This fix was already present in the upstream PyJWT 2.8.0 release that TuxCare onboarded. The CVE describes a re...", "justification": "code_not_present" } }, { "id": "CVE-2026-32597", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:df423f0a-b19d-56e2-be24-368e0d35e3b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32597 is fixed in version 2.8.0.post6+tuxcare of pyjwt." } }, { "id": "CVE-2026-48522", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:fc9934e7-9f1b-53bd-9aa5-f6433eb0a3ac", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-48522 does not affect version 2.8.0.post6+tuxcare of pyjwt. already_fixed \u2014 CVE-2026-48522: PyJWKClient URI scheme SSRF vulnerability is already fixed in the target repository. The fix was introduced via commit 67029b7 (Backport CVE-2026-48526 to 2.8.0) on 2026-07-13, which added URI scheme validation to reject non-HTTP(S) schemes (file://, ftp://, data:, etc.) before any fetch operation. While the version number was later reverted from 2.8.0.post2+tuxcare to 2.8.0.pos...", "justification": "code_not_present" } }, { "id": "CVE-2026-48523", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:074a692b-34cb-59cb-bb88-6738218b3cd2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-48523 does not affect version 2.8.0.post6+tuxcare of pyjwt. not_affected \u2014 PyJWT 2.8.0 is not affected by CVE-2026-48523. The vulnerability (algorithm allow-list bypass when decoding JWTs with PyJWK keys) was introduced in commit ab8176abe21e550dbc1c9a6bb7e78ad80853bfb1 (\"Decode with PyJWK #886\") in May 2024, first released in version 2.9.0. Version 2.8.0 predates this feature entirely. While PyJWK exists as a class in 2.8.0, it cannot be used with jwt.decode() becaus...", "justification": "code_not_present" } }, { "id": "CVE-2026-48524", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:a12c0b52-4665-56af-85f7-2d361dc6786b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-48524 is fixed in version 2.8.0.post6+tuxcare of pyjwt." } }, { "id": "CVE-2026-48525", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:3e26bcd4-b23a-5d43-9660-2c9cb5757bd5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-48525 does not affect version 2.8.0.post6+tuxcare of pyjwt. pyjwt 2.8.0 is not affected by CVE-2026-48525. The upstream fix (jpadilla/pyjwt@95791b1) forwards the opt-in 'enforce_minimum_key_length' option into sig_options in api_jwt.py; the vulnerability is that setting that option per call had no effect, letting an undersized RSA key through. Branch tuxcare-current/2.8.0 contains none of that machinery (no enforce_minimum_key_length, no sig_options, no InsecureKeyLengthWarning in jwt/). The CVE-2025-45768 backport (796cc35, PYELSCVE-180) instead enforces a minimum 2048-bit RSA key unconditionally in RSAAlgorithm.prepare_key, which no option can disable. Verified on the released 2.8.0.post3+tuxcare wheel from Nexus with a fresh 1024-bit RSA key: rejected with no options, with enforce_minimum_key_length=False and with verify_signature=False; a 2048-bit key still round-trips. MR !18 was changelog-only and has been closed. Jira PYELSCVE-1216.", "justification": "code_not_present" } }, { "id": "CVE-2026-48526", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:19be7a92-a967-5de9-9bab-c821b7d66c47", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-48526 is fixed in version 2.8.0.post6+tuxcare of pyjwt." } }, { "id": "GHSA-pxh4-856f-4h89", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:6961f816-dc01-51c4-890e-9164f3d0686b", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-pxh4-856f-4h89 does not affect version 2.8.0.post6+tuxcare of pyjwt. not_affected \u2014 PyJWT 2.8.0.post5+tuxcare contains the vulnerable code pattern (HMACAlgorithm.from_jwk accepts empty k and returns b'' without validation at jwt/algorithms.py:365), but the library's documented verification paths are protected by a runtime defense. The prepare_key method (lines 285-326) validates and rejects empty HMAC keys before any cryptographic operations. All library verification flows rou...", "justification": "protected_at_runtime" } } ], "dependencies": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post6+tuxcare" } ] }