CVE-2026-32597

PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

HIGH

7.5

CVSS Score

Published: March 12, 2026 at 09:41 PM UTC

Updated: September 10, 2026 at 01:18 PM UTC

8 products affected across 3 vendorsPyjwtSatelliteOpenShift AI

Using pyjwt by jpadilla?

Get instant alerts when new vulnerabilities affect pyjwt - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 0.3%

SSVC

PoC

Description

PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Pyjwt · Pyjwt Project

95%

v < 2.12.0

Affected range stops below 2.12.0, so it looks safe — our inference, not a vendor statement

Pyjwt · Jpadilla

60%

v < 2.12.0

Affected range stops below 2.12.0, so it looks safe — our inference, not a vendor statement

AI Inference Server · Red Hatcontainer

60%

All versions

Vendor states this is fixed in 1775680192 (unaffected)

Vendor states this is fixed in 1775680262 (unaffected)

Vendor states this is fixed in 1775749857 (unaffected)

Ansible Automation Platform · Red Hatrpm

60%

Vendor states this is fixed in 0:2.12.1-1.el8ap (unaffected)

Vendor states this is fixed in 0:2.12.1-1.el9ap (unaffected)

Vendor states this is fixed in 0:4.6.28-3.el8ap (unaffected)

Vendor states this is fixed in 0:4.6.28-3.el9ap (unaffected)

Vendor states this is fixed in 0:4.7.11-2.el9ap (unaffected)

Vendor states this is fixed in 1777296732 (unaffected)

Vendor states this is fixed in 1777299023 (unaffected)

Vendor states this is fixed in 1777311120 (unaffected)

Vendor states this is fixed in 1777311601 (unaffected)

Vendor states this is fixed in 1777387242 (unaffected)

Vendor states this is fixed in 1777391447 (unaffected)

Vendor states this is fixed in 1777394109 (unaffected)

Vendor states this is fixed in 1777398576 (unaffected)

Vendor states this is fixed in 1777403872 (unaffected)

Vendor states this is fixed in 2 (unaffected)

OpenShift AI · Red Hatcontainer

60%

All versions

Vendor states this is fixed in 1776338381 (unaffected)

Vendor states this is fixed in 1776343111 (unaffected)

Vendor states this is fixed in 1778264363 (unaffected)

Vendor states this is fixed in 1778600187 (unaffected)

Vendor states this is fixed in 1780069069 (unaffected)

Vendor states this is fixed in 1782472374 (unaffected)

Vendor states this is fixed in 1783615165 (unaffected)

Vendor states this is fixed in 1783615385 (unaffected)

Vendor states this is fixed in 1783615414 (unaffected)

Vendor states this is fixed in 1783615432 (unaffected)

Vendor states this is fixed in 1783616068 (unaffected)

Vendor states this is fixed in 1783664916 (unaffected)

Vendor states this is fixed in 1783664921 (unaffected)

Vendor states this is fixed in 1783696507 (unaffected)

Vendor states this is fixed in 1783696512 (unaffected)

Vendor states this is fixed in 1783998551 (unaffected)

Vendor states this is fixed in 1783998585 (unaffected)

OpenShift Lightspeed · Red Hatrpm

60%

All versions

Satellite · Red Hatrpm

60%

Vendor states this is fixed in 1780414237 (unaffected)

Trusted Artifact Signer · Red Hatrpm

60%

All versions

Vendor states this is fixed in 1775815407 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (35)

x_refsource_CONFIRMExploitMitigationVendor Advisory

Source: cverecord

https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.debian.org/debian-lts-announce/2026/05/msg00008.html