PyPI/python-jose CVE-2024-33663, CVE-2026-85394: critical 9.1, EPSS 0.31%
python-jose algorithm confusion guard bypassed by DER-encoded public keys
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 3.5.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-3qf3-8w2g-rqmx
- https://nvd.nist.gov/vuln/detail/CVE-2026-85394
- https://github.com/mpdavis/python-jose/issues/414
- https://github.com/advisories/GHSA-6c5p-j8vq-pqhj
- https://github.com/mpdavis/python-jose
- https://github.com/mpdavis/python-jose/blob/018b310ddb8b50dcfd09a0c152117835a21dd656/jose/backends/native.py
- https://github.com/mpdavis/python-jose/blob/018b310ddb8b50dcfd09a0c152117835a21dd656/jose/utils.py
- https://www.vulncheck.com/advisories/python-jose-through-3.5.0-algorithm-confusion-via-der-encoded-public-key-as-hmac-secret
CVE-2024-33663, CVE-2026-85394 · published · modified · JSON