PyPI/python-jose CVE-2024-33663, CVE-2026-85394: unknown, EPSS 0.31%

python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.

Action: Upgrade python-jose to 3.4.0 or later.

pip install python-jose==3.4.0

Affected

Fixed versions

Sources

• osv: PYSEC-2024-232
• https://github.com/mpdavis/python-jose/issues/346
• https://www.vicarius.io/vsociety/posts/algorithm-confusion-in-python-jose-cve-2024-33663
• https://github.com/advisories/GHSA-6c5p-j8vq-pqhj

CVE-2024-33663, CVE-2026-85394 · published 2024-04-26T00:15:09Z · modified 2026-10-15T14:56:01.261338787Z · JSON