{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3be722bf-b8f1-5038-a986-4b6cfeda5e66", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "pyjwt", "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "type": "library", "bom-ref": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "version": "2.8.0.post2+tuxcare", "pedigree": { "ancestors": [ { "name": "pyjwt", "purl": "pkg:pypi/pyjwt@2.8.0", "type": "library", "version": "2.8.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-45768", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } ], "bom-ref": "urn:uuid:ce373c52-76df-5228-be1e-b44eba510eac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-45768 is fixed in version 2.8.0.post2+tuxcare of pyjwt." } }, { "id": "CVE-2026-101917", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } ], "bom-ref": "urn:uuid:2569b3c0-1a87-50ed-aa9b-50e340435059", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101917 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare." } }, { "id": "CVE-2026-101918", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } ], "bom-ref": "urn:uuid:5febd393-ef1e-5068-9cc3-adeb9fa36975", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101918 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post5+tuxcare." } }, { "id": "CVE-2026-102267", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } ], "bom-ref": "urn:uuid:f1bb0404-f412-5b85-9c73-be3d9a53239b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-102267 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare." } }, { "id": "CVE-2026-102268", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } ], "bom-ref": "urn:uuid:b41baf24-fb39-5407-8de3-7c2dee8612fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-102268 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare." } }, { "id": "CVE-2026-102269", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } ], "bom-ref": "urn:uuid:f1145636-a6b7-5092-a5e8-742c8f55baa2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-102269 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare." } }, { "id": "CVE-2026-102270", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } ], "bom-ref": "urn:uuid:9ef2ea2e-976b-59a2-9950-e1e66a34b1b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-102270 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare." } }, { "id": "CVE-2026-102271", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } ], "bom-ref": "urn:uuid:82b0eb93-a79b-5981-ac5c-494cc4e2e04b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-102271 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare." } }, { "id": "CVE-2026-102275", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } ], "bom-ref": "urn:uuid:df868552-1e6e-54e8-8e5e-118c1e6dec80", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-102275 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post5+tuxcare." } }, { "id": "CVE-2026-32597", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } ], "bom-ref": "urn:uuid:e0c36111-f00a-5ea4-aec3-b1cb0b988f00", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-32597 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post3+tuxcare." } }, { "id": "CVE-2026-48522", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } ], "bom-ref": "urn:uuid:ae4e7398-ebf2-5468-a2a3-f7ff4747b2d6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-48522 does not affect version 2.8.0.post2+tuxcare of pyjwt. already_fixed \u2014 CVE-2026-48522: PyJWKClient URI scheme SSRF vulnerability is already fixed in the target repository. The fix was introduced via commit 67029b7 (Backport CVE-2026-48526 to 2.8.0) on 2026-07-13, which added URI scheme validation to reject non-HTTP(S) schemes (file://, ftp://, data:, etc.) before any fetch operation. While the version number was later reverted from 2.8.0.post2+tuxcare to 2.8.0.pos...", "justification": "code_not_present" } }, { "id": "CVE-2026-48524", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } ], "bom-ref": "urn:uuid:a18cf7ed-f525-51f9-b369-cd048fb8a9e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-48524 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post3+tuxcare." } }, { "id": "CVE-2026-48525", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } ], "bom-ref": "urn:uuid:f3d0c255-3387-5dc1-adfe-fe427c0c2fa7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-48525 does not affect version 2.8.0.post2+tuxcare of pyjwt. pyjwt 2.8.0 is not affected by CVE-2026-48525. The upstream fix (jpadilla/pyjwt@95791b1) forwards the opt-in 'enforce_minimum_key_length' option into sig_options in api_jwt.py; the vulnerability is that setting that option per call had no effect, letting an undersized RSA key through. Branch tuxcare-current/2.8.0 contains none of that machinery (no enforce_minimum_key_length, no sig_options, no InsecureKeyLengthWarning in jwt/). The CVE-2025-45768 backport (796cc35, PYELSCVE-180) instead enforces a minimum 2048-bit RSA key unconditionally in RSAAlgorithm.prepare_key, which no option can disable. Verified on the released 2.8.0.post3+tuxcare wheel from Nexus with a fresh 1024-bit RSA key: rejected with no options, with enforce_minimum_key_length=False and with verify_signature=False; a 2048-bit key still round-trips. MR !18 was changelog-only and has been closed. Jira PYELSCVE-1216.", "justification": "code_not_present" } }, { "id": "CVE-2026-48526", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } ], "bom-ref": "urn:uuid:08dc8ae0-7a7d-5adf-b6b6-338d24bfcecb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-48526 is fixed in version 2.8.0.post2+tuxcare of pyjwt." } }, { "id": "GHSA-pxh4-856f-4h89", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } ], "bom-ref": "urn:uuid:41159f56-67e5-5237-9f97-427a9dbc67cf", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-pxh4-856f-4h89 does not affect version 2.8.0.post2+tuxcare of pyjwt. not_affected \u2014 PyJWT 2.8.0.post5+tuxcare contains the vulnerable code pattern (HMACAlgorithm.from_jwk accepts empty k and returns b'' without validation at jwt/algorithms.py:365), but the library's documented verification paths are protected by a runtime defense. The prepare_key method (lines 285-326) validates and rejects empty HMAC keys before any cryptographic operations. All library verification flows rou...", "justification": "protected_at_runtime" } } ], "dependencies": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } ] }