{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:72795075-2617-5704-9b57-31b99652bdb5", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "pyjwt", "purl": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare", "type": "library", "bom-ref": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare", "version": "2.8.0.post4+tuxcare", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-45768", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:c31b87b9-19e1-5355-ae84-a841d8ff7cc5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-45768 is fixed in version 2.8.0.post4+tuxcare of pyjwt." } }, { "id": "CVE-2026-101917", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:375033e8-6a86-5911-a144-4f8189ad3d69", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101917 is fixed in version 2.8.0.post4+tuxcare of pyjwt." } }, { "id": "CVE-2026-101918", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:b5fc928b-2808-5886-abbc-b993700c63e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101918 affects version 2.8.0.post4+tuxcare of pyjwt." } }, { "id": "CVE-2026-102267", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:ed4ff27d-2714-5b5c-9b0e-cbd3eaec4500", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-102267 is fixed in version 2.8.0.post4+tuxcare of pyjwt." } }, { "id": "CVE-2026-102268", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:c295aadc-3d7a-5e12-9139-bf0ad92b7952", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-102268 is fixed in version 2.8.0.post4+tuxcare of pyjwt." } }, { "id": "CVE-2026-102269", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:ee4c7f31-cbc3-5580-8b17-a9406d7e6aba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-102269 is fixed in version 2.8.0.post4+tuxcare of pyjwt." } }, { "id": "CVE-2026-102270", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:cf80eb62-122a-5b47-9aeb-f252d8a05578", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-102270 is fixed in version 2.8.0.post4+tuxcare of pyjwt." } }, { "id": "CVE-2026-102271", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:a893e29e-66e8-5eb4-a16e-ec8a77984e95", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-102271 is fixed in version 2.8.0.post4+tuxcare of pyjwt." } }, { "id": "CVE-2026-32597", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:696b496f-0362-589e-b9ee-6853cc89b7b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-32597 is fixed in version 2.8.0.post4+tuxcare of pyjwt." } }, { "id": "CVE-2026-48522", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:cea8f315-c887-5b46-9e40-ebc12cc5c079", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-48522 does not affect version 2.8.0.post4+tuxcare of pyjwt. already_fixed \u2014 CVE-2026-48522: PyJWKClient URI scheme SSRF vulnerability is already fixed in the target repository. The fix was introduced via commit 67029b7 (Backport CVE-2026-48526 to 2.8.0) on 2026-07-13, which added URI scheme validation to reject non-HTTP(S) schemes (file://, ftp://, data:, etc.) before any fetch operation. While the version number was later reverted from 2.8.0.post2+tuxcare to 2.8.0.pos...", "justification": "code_not_present" } }, { "id": "CVE-2026-48524", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:54064e7d-3cfe-58c4-9172-2f237c2159ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-48524 is fixed in version 2.8.0.post4+tuxcare of pyjwt." } }, { "id": "CVE-2026-48525", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:676a414f-726b-5081-903c-95a01d6e2c24", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-48525 does not affect version 2.8.0.post4+tuxcare of pyjwt. pyjwt 2.8.0 is not affected by CVE-2026-48525. The upstream fix (jpadilla/pyjwt@95791b1) forwards the opt-in 'enforce_minimum_key_length' option into sig_options in api_jwt.py; the vulnerability is that setting that option per call had no effect, letting an undersized RSA key through. Branch tuxcare-current/2.8.0 contains none of that machinery (no enforce_minimum_key_length, no sig_options, no InsecureKeyLengthWarning in jwt/). The CVE-2025-45768 backport (796cc35, PYELSCVE-180) instead enforces a minimum 2048-bit RSA key unconditionally in RSAAlgorithm.prepare_key, which no option can disable. Verified on the released 2.8.0.post3+tuxcare wheel from Nexus with a fresh 1024-bit RSA key: rejected with no options, with enforce_minimum_key_length=False and with verify_signature=False; a 2048-bit key still round-trips. MR !18 was changelog-only and has been closed. Jira PYELSCVE-1216.", "justification": "code_not_present" } }, { "id": "CVE-2026-48526", "affects": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare" } ], "bom-ref": "urn:uuid:c7793e64-d80f-5e57-86f2-4baa3cfc39ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-48526 is fixed in version 2.8.0.post4+tuxcare of pyjwt." } } ], "dependencies": [ { "ref": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare" } ] }