CVE-2026-102274: PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set

September 29, 2026

A malformed RSA JWK inside a JWK Set aborts parsing of the entire set instead of being skipped, because RSAAlgorithm.from_jwk can raise a plain ValueError that isn’t caught by PyJWKSet’s per-key error-skipping logic.

References

github.com/advisories/GHSA-w6j9-cwv2-h6wq
github.com/jpadilla/pyjwt/commit/8915570a0bfda9f0ff0e34e7fb09bdb9d71580cf
github.com/jpadilla/pyjwt/releases/tag/2.14.0
github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq
nvd.nist.gov/vuln/detail/CVE-2026-102274

Code Behaviors & Features

Detect and mitigate CVE-2026-102274 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →