CVE-2026-102274: PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set

September 29, 2026

A malformed RSA JWK inside a JWK Set aborts parsing of the entire set instead of being skipped, because RSAAlgorithm.from_jwk can raise a plain ValueError that isn’t caught by PyJWKSet’s per-key error-skipping logic.

References

github.com/advisories/GHSA-w6j9-cwv2-h6wq
github.com/jpadilla/pyjwt/commit/8915570a0bfda9f0ff0e34e7fb09bdb9d71580cf
github.com/jpadilla/pyjwt/releases/tag/2.14.0
github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq
nvd.nist.gov/vuln/detail/CVE-2026-102274

Code Behaviors & Features

Detect and mitigate CVE-2026-102274 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →