{"schema_version":"1.9.0","id":"CVE-2026-32597","published":"2026-03-12T21:41:50.427Z","modified":"2026-09-08T03:46:35.487256358Z","aliases":["GHSA-752w-5fwx-jx9f","PYSEC-2026-120"],"related":["ALSA-2026:12176","ALSA-2026:13916","SUSE-SU-2026:1199-1","SUSE-SU-2026:1389-1","SUSE-SU-2026:1400-1","SUSE-SU-2026:20839-1","SUSE-SU-2026:20869-1","SUSE-SU-2026:20879-1","SUSE-SU-2026:20934-1","openSUSE-SU-2026:10397-1","openSUSE-SU-2026:10681-1","openSUSE-SU-2026:20431-1"],"summary":"PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)","details":"PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jpadilla/pyjwt","events":[{"introduced":"0"},{"fixed":"bd9700cca7f9258fadcc429c1034e508025931f2"}],"database_specific":{"cpe":"cpe:2.3:a:pyjwt_project:pyjwt:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"2.12.0"}],"source":["AFFECTED_FIELD","CPE_RANGE"]}}],"versions":["2.11.0","2.10.1","2.10.0","2.9.0","2.8.0","2.7.0","2.6.0","2.5.0","2.4.0","2.3.0","2.2.0","2.1.0","2.0.1","2.0.0","2.0.0a2","2.0.0a1","1.7.1","1.7.0","1.6.4","1.6.3","1.6.1","1.6.0","1.5.3","1.5.2","1.5.1","1.5.0","1.4.2","1.4.1","1.4.0","1.3.0","1.2.0","1.1.0","1.0.1","1.0.0","0.4.3","0.4.2","0.4.1","0.4.0","0.3.2","0.3.1","0.3.0","0.2.3","0.2.2","0.2.0","0.1.9","0.1.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32597.json"}}],"references":[{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2026/05/msg00008.html"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32597.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10140"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10141"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10184"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:12176"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:13508"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:13512"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:13545"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:13553"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:13672"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:13916"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17083"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19138"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19355"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19375"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19712"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21431"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21517"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22330"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24977"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26226"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:37275"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:42644"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:6568"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:6720"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:6912"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:6926"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8437"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8746"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8747"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8748"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-32597"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32597.json"},{"type":"ADVISORY","url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32597"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447194"}],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-345","CWE-863"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32597.json"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}