CVE-2026-32597
Description
A missing verification step has been discovered in PyJWT. PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.
Statement
An IMPORTANT severity flaw was found in PyJWT, a Python JSON Web Token (JWT) library shipped in a broad set of Red Hat products, including Red Hat Ansible Automation Platform, Red Hat Enterprise Linux, Red Hat OpenShift AI and Red Hat AI Inference Server components, and Red Hat Quay. PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 section 4.1.11: when a JSON Web Signature (JWS) token contains a crit array listing header extensions that PyJWT does not understand, the library accepts the token instead of rejecting it, violating a MUST requirement of the RFC. As a result, a remote attacker who can submit crafted tokens to an application that relies on PyJWT for JWT verification can have tokens carrying unrecognized critical header extensions accepted, undermining the integrity of the token validation the application depends on. Red Hat has rated this flaw as IMPORTANT with a CVSS 3.1 score of 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), consistent with the upstream severity. Affected Red Hat product streams are tracked with a delegated resolution, and fixes are being pursued by the responsible product teams.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Understanding the Weakness (CWE)
Access Control,Integrity,Confidentiality
Technical Impact: Gain Privileges or Assume Identity; Modify Application Data; Execute Unauthorized Code or Commands
An attacker could gain access to sensitive data and possibly execute unauthorized code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
