PyPI/python-jose CVE-2024-33663, CVE-2026-85394: high 7.4, EPSS 0.31%

python-jose algorithm confusion with OpenSSH ECDSA keys

Action: Upgrade python-jose to 3.4.0 or later.

pip install python-jose==3.4.0

Affected

Fixed versions

Sources

• osv: GHSA-6c5p-j8vq-pqhj
• https://nvd.nist.gov/vuln/detail/CVE-2024-33663
• https://github.com/mpdavis/python-jose/issues/346
• https://github.com/mpdavis/python-jose
• https://github.com/pypa/advisory-database/tree/main/vulns/python-jose/PYSEC-2024-232.yaml
• https://www.vicarius.io/vsociety/posts/algorithm-confusion-in-python-jose-cve-2024-33663

CVE-2024-33663, CVE-2026-85394 · published 2024-04-26T00:30:35Z · modified 2026-10-15T14:56:01.261338787Z · JSON