CVE-2026-85394
4 advisories.
PyPI/python-jose CVE-2024-33663, CVE-2026-85394: critical 9.1
python-jose algorithm confusion guard bypassed by DER-encoded public keys
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 3.5.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-3qf3-8w2g-rqmx
- https://nvd.nist.gov/vuln/detail/CVE-2026-85394
- https://github.com/mpdavis/python-jose/issues/414
- https://github.com/advisories/GHSA-6c5p-j8vq-pqhj
- https://github.com/mpdavis/python-jose
- https://github.com/mpdavis/python-jose/blob/018b310ddb8b50dcfd09a0c152117835a21dd656/jose/backends/native.py
- https://github.com/mpdavis/python-jose/blob/018b310ddb8b50dcfd09a0c152117835a21dd656/jose/utils.py
- https://www.vulncheck.com/advisories/python-jose-through-3.5.0-algorithm-confusion-via-der-encoded-public-key-as-hmac-secret
CVE-2024-33663, CVE-2026-85394 · published · modified · JSON
PyPI/python-jose CVE-2024-33663, CVE-2026-85394: high 7.4
python-jose algorithm confusion with OpenSSH ECDSA keys
Action: Upgrade python-jose to 3.4.0 or later.
pip install python-jose==3.4.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.4.0 | - |
Fixed versions
| 3.4.0 |
Sources
- osv: GHSA-6c5p-j8vq-pqhj
- https://nvd.nist.gov/vuln/detail/CVE-2024-33663
- https://github.com/mpdavis/python-jose/issues/346
- https://github.com/mpdavis/python-jose
- https://github.com/pypa/advisory-database/tree/main/vulns/python-jose/PYSEC-2024-232.yaml
- https://www.vicarius.io/vsociety/posts/algorithm-confusion-in-python-jose-cve-2024-33663
CVE-2024-33663, CVE-2026-85394 · published · modified · JSON
PyPI/python-jose CVE-2024-33663, CVE-2026-85394: unknown
python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217.
Action: Upgrade python-jose to 3.4.0 or later.
pip install python-jose==3.4.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.4.0 | - |
Fixed versions
| 3.4.0 |
Sources
- osv: PYSEC-2024-232
- https://github.com/mpdavis/python-jose/issues/346
- https://www.vicarius.io/vsociety/posts/algorithm-confusion-in-python-jose-cve-2024-33663
- https://github.com/advisories/GHSA-6c5p-j8vq-pqhj
CVE-2024-33663, CVE-2026-85394 · published · modified · JSON
PyPI/python-jose CVE-2024-33663, CVE-2026-85394: critical 9.1
python-jose algorithm confusion guard bypassed by DER-encoded public keys
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 3.5.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: PYSEC-2026-4298
- https://nvd.nist.gov/vuln/detail/CVE-2026-85394
- https://github.com/mpdavis/python-jose/issues/414
- https://github.com/advisories/GHSA-6c5p-j8vq-pqhj
- https://github.com/mpdavis/python-jose
- https://github.com/mpdavis/python-jose/blob/018b310ddb8b50dcfd09a0c152117835a21dd656/jose/backends/native.py
- https://github.com/mpdavis/python-jose/blob/018b310ddb8b50dcfd09a0c152117835a21dd656/jose/utils.py
- https://www.vulncheck.com/advisories/python-jose-through-3.5.0-algorithm-confusion-via-der-encoded-public-key-as-hmac-secret
- https://pypi.org/project/python-jose
- https://github.com/advisories/GHSA-3qf3-8w2g-rqmx
CVE-2024-33663, CVE-2026-85394 · published · modified · JSON