Python-Jwt Security Update — AlmaLinux 8 (ALSA-2026:93440)

ALSA-2026:93440 updates the Python jwt package on AlmaLinux 8, fixing CVE-2026-32597 — an improper verification flaw (CWE-345 integrity class, CVSS 7.5) in JWT token handling within python-jwt. Update with dnf update python-jwt (or python3-jwt per the module) and restart applications that verify tokens.

High 7.5 CVSS 2026-11-02

AlmaLinux 8

Was das unter einer SharedLicense-Lizenz bedeutet

Improper token verification in a JWT library means crafted tokens can pass as valid — authentication decisions across every application using the library rest on this check being airtight.

Type:

security

Severity:

important

Release date:

2026-11-02

Description:

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 ?4.1.11 MUST violation) (CVE-2026-32597)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture	Package	Checksum
noarch	python3-jwt-1.6.1-2.el8_10.1.noarch.rpm	0af90cdb019c551877985d1aaa0715b1cdef190bec18b58d9c083c70cda6fb03

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Häufig gestellte Fragen

What is CVE-2026-32597?

It is an improper-verification vulnerability (CWE-345) in the Python JWT library shipped on AlmaLinux 8, rated CVSS 7.5 and fixed in the update ALSA-2026:93440 (release date November 2, 2026).

Who is affected?

AlmaLinux 8 servers with python-jwt installed — any Python application issuing or validating JWT tokens for APIs, SSO or session handling.

How do I apply the fix?

Run dnf update python-jwt (or python3-jwt) and restart the applications that import it — Python loads the patched module on next process start.

What does an attacker gain from improper JWT verification?

If signature or claim verification can be bypassed, an attacker crafts a token with arbitrary claims — different user, elevated role, extended expiry — and the application accepts it as genuine.

Referenzen

Sicherheitshinweise

System auf Schwachstellen prüfen

Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.

System prüfen

Häufig gestellte Fragen

Verwandte Warnhinweise

System auf Schwachstellen prüfen