Vulnerable Library - vonage-4.7.2-py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /tmp/ws-ua_20260414115749_FASALT/python_KPPKZR/202604141157501/env/lib/python3.9/site-packages/pyjwt-2.12.1.dist-info
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2026-25645
Vulnerable Library - requests-2.32.5-py3-none-any.whl
Python HTTP for Humans.
Library home page: https://files.pythonhosted.org/packages/1e/db/4254e3eabe8020b458f1a747140d32277ec7a271daf1d235b70dc0b4e6e3/requests-2.32.5-py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /tmp/ws-ua_20260414115749_FASALT/python_KPPKZR/202604141157501/env/lib/python3.9/site-packages/requests-2.32.5.dist-info
Dependency Hierarchy:
- vonage-4.7.2-py3-none-any.whl (Root Library)
- vonage_http_client-1.5.1-py3-none-any.whl
- ❌ requests-2.32.5-py3-none-any.whl (Vulnerable Library)
Found in base branch: main
Reachability Analysis
This vulnerability is potentially reachable
vonage-python-code-snippets/application/get-application.py (Application)
-> vonage-application-2.0.1/vonage_application/__init__.py (Extension)
-> vonage-application-2.0.1/vonage_application/application.py (Extension)
-> vonage-http-client-1.5.1/vonage_http_client/http_client.py (Extension)
-> requests-2.32.5/requests/adapters.py (Extension)
-> ❌ requests-2.32.5/requests/utils.py (Vulnerable Component)
Vulnerability Details
Requests is a HTTP library. Prior to version 2.33.0, the "requests.utils.extract_zipped_paths()" utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call "extract_zipped_paths()" directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set "TMPDIR" in their environment to a directory with restricted write access.
Publish Date: 2026-03-25
URL: CVE-2026-25645
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.004%
CVSS 3 Score Details (4.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-03-25
Fix Resolution: https://github.com/psf/requests.git - v2.33.0
CVE-2026-44432
Vulnerable Library - urllib3-2.6.3-py3-none-any.whl
HTTP library with thread-safe connection pooling, file post, and more.
Library home page: https://files.pythonhosted.org/packages/39/08/aaaad47bc4e9dc8c725e68f9d04865dbcb2052843ff09c97b08904852d84/urllib3-2.6.3-py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /tmp/ws-ua_20260414115749_FASALT/python_KPPKZR/202604141157501/env/lib/python3.9/site-packages/urllib3-2.6.3.dist-info
Dependency Hierarchy:
- vonage-4.7.2-py3-none-any.whl (Root Library)
- vonage_http_client-1.5.1-py3-none-any.whl
- requests-2.32.5-py3-none-any.whl
- ❌ urllib3-2.6.3-py3-none-any.whl (Vulnerable Library)
Found in base branch: main
Vulnerability Details
urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data) on the client side. This vulnerability is fixed in 2.7.0.
Publish Date: 2026-05-13
URL: CVE-2026-44432
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.019%
CVSS 3 Score Details (8.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-mf9v-mfxr-j63j
Release Date: 2026-05-11
Fix Resolution (urllib3): 2.7.0
Direct dependency fix Resolution (vonage): 4.8.0
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2026-44431
Vulnerable Library - urllib3-2.6.3-py3-none-any.whl
HTTP library with thread-safe connection pooling, file post, and more.
Library home page: https://files.pythonhosted.org/packages/39/08/aaaad47bc4e9dc8c725e68f9d04865dbcb2052843ff09c97b08904852d84/urllib3-2.6.3-py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /tmp/ws-ua_20260414115749_FASALT/python_KPPKZR/202604141157501/env/lib/python3.9/site-packages/urllib3-2.6.3.dist-info
Dependency Hierarchy:
- vonage-4.7.2-py3-none-any.whl (Root Library)
- vonage_http_client-1.5.1-py3-none-any.whl
- requests-2.32.5-py3-none-any.whl
- ❌ urllib3-2.6.3-py3-none-any.whl (Vulnerable Library)
Found in base branch: main
Vulnerability Details
urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.
Publish Date: 2026-05-13
URL: CVE-2026-44431
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.013%
CVSS 3 Score Details (5.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-qccp-gfcp-xxvc
Release Date: 2026-05-11
Fix Resolution (urllib3): 2.7.0
Direct dependency fix Resolution (vonage): 4.8.0
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2026-48523
Vulnerable Library - pyjwt-2.12.1-py3-none-any.whl
JSON Web Token implementation in Python
Library home page: https://files.pythonhosted.org/packages/e5/7a/8dd906bd22e79e47397a61742927f6747fe93242ef86645ee9092e610244/pyjwt-2.12.1-py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /tmp/ws-ua_20260414115749_FASALT/python_KPPKZR/202604141157501/env/lib/python3.9/site-packages/pyjwt-2.12.1.dist-info
Dependency Hierarchy:
- vonage-4.7.2-py3-none-any.whl (Root Library)
- vonage_http_client-1.5.1-py3-none-any.whl
- vonage_jwt-1.1.5-py3-none-any.whl
- ❌ pyjwt-2.12.1-py3-none-any.whl (Vulnerable Library)
Found in base branch: main
Vulnerability Details
PyJWT is a JSON Web Token implementation in Python. From 2.9.0 to 2.12.1, there is a verifier-side algorithm allow-list bypass when jwt.decode() or jwt.decode_complete() are called with a PyJWK key. The token header alg is checked against the caller-supplied algorithms allow-list, but signature verification is performed with the algorithm bound to the PyJWK object instead of the header algorithm. An attacker who controls a registered JWK/JWKS private key can sign with a disallowed algorithm, advertise an allowed algorithm in the JWT header, and still be accepted. The issue affects the documented PyJWKClient.get_signing_key_from_jwt(...) flow. This vulnerability is fixed in 2.13.0.
Publish Date: 2026-05-28
URL: CVE-2026-48523
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.019%
CVSS 3 Score Details (5.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-jq35-7prp-9v3f
Release Date: 2026-05-28
Fix Resolution: pyjwt - 2.13.0,pyjwt - 2.13.0
CVE-2026-48525
Vulnerable Library - pyjwt-2.12.1-py3-none-any.whl
JSON Web Token implementation in Python
Library home page: https://files.pythonhosted.org/packages/e5/7a/8dd906bd22e79e47397a61742927f6747fe93242ef86645ee9092e610244/pyjwt-2.12.1-py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /tmp/ws-ua_20260414115749_FASALT/python_KPPKZR/202604141157501/env/lib/python3.9/site-packages/pyjwt-2.12.1.dist-info
Dependency Hierarchy:
- vonage-4.7.2-py3-none-any.whl (Root Library)
- vonage_http_client-1.5.1-py3-none-any.whl
- vonage_jwt-1.1.5-py3-none-any.whl
- ❌ pyjwt-2.12.1-py3-none-any.whl (Vulnerable Library)
Found in base branch: main
Vulnerability Details
PyJWT is a JSON Web Token implementation in Python. From 2.8.0 to 2.12.1, when verifying detached JWS tokens using the unencoded-payload option ("b64": false, RFC 7797), PyJWT performs Base64URL decoding of the compact-serialization payload segment before enforcing the detached-payload rules. For b64=false, PyJWT later discards that decoded payload and replaces it with the caller-provided detached_payload. In practice, this turns the middle segment into an attacker-controlled “work amplifier”: a remote client can supply an arbitrarily large Base64URL payload segment that forces CPU work + memory allocations even if the signature is invalid. This creates an unauthenticated DoS vector against any endpoint that verifies detached JWS using PyJWT. This vulnerability is fixed in 2.13.0.
Publish Date: 2026-05-28
URL: CVE-2026-48525
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.039%
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-w7vc-732c-9m39
Release Date: 2026-05-28
Fix Resolution: pyjwt - 2.13.0,pyjwt - 2.13.0
CVE-2026-45409
Vulnerable Library - idna-3.11-py3-none-any.whl
Internationalized Domain Names in Applications (IDNA)
Library home page: https://files.pythonhosted.org/packages/0e/61/66938bbb5fc52dbdf84594873d5b51fb1f7c7794e9c0f5bd885f30bc507b/idna-3.11-py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /tmp/ws-ua_20260414115749_FASALT/python_KPPKZR/202604141157501/env/lib/python3.9/site-packages/idna-3.11.dist-info
Dependency Hierarchy:
- vonage-4.7.2-py3-none-any.whl (Root Library)
- vonage_http_client-1.5.1-py3-none-any.whl
- requests-2.32.5-py3-none-any.whl
- ❌ idna-3.11-py3-none-any.whl (Vulnerable Library)
Found in base branch: main
Vulnerability Details
This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fix. Payloads such as ""\u0660" * N" or ""\u30fb" * N + "\u6f22"" utilize the "valid_contexto" function prior to length rejection, and for high values of "N" will take a long time to process. Impact A specially crafted argument to the "idna.encode()" function could consume significant resources. This may lead to a denial-of-service. Patches Starting in version 3.14, the function rejects long inputs as soon as practicable prior to any further processing to minimize resource consumption. In version 3.15, this approach was extended to lesser used alternate functions (i.e. per-label conversions and codec support). Workarounds Domain names cannot exceed 253 characters in length, if this length limit is enforced prior to passing the domain to the "idna.encode()" function it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.
Publish Date: 2026-05-21
URL: CVE-2026-45409
Threat Assessment
Exploit Maturity: Not Defined
EPSS:
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-65pc-fj4g-8rjx
Release Date: 2026-05-19
Fix Resolution: idna - 3.15
CVE-2026-48522
Vulnerable Library - pyjwt-2.12.1-py3-none-any.whl
JSON Web Token implementation in Python
Library home page: https://files.pythonhosted.org/packages/e5/7a/8dd906bd22e79e47397a61742927f6747fe93242ef86645ee9092e610244/pyjwt-2.12.1-py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /tmp/ws-ua_20260414115749_FASALT/python_KPPKZR/202604141157501/env/lib/python3.9/site-packages/pyjwt-2.12.1.dist-info
Dependency Hierarchy:
- vonage-4.7.2-py3-none-any.whl (Root Library)
- vonage_http_client-1.5.1-py3-none-any.whl
- vonage_jwt-1.1.5-py3-none-any.whl
- ❌ pyjwt-2.12.1-py3-none-any.whl (Vulnerable Library)
Found in base branch: main
Vulnerability Details
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen() which uses Python stdlib's default OpenerDirector registering HTTPHandler, HTTPSHandler, FTPHandler, FileHandler, and DataHandler. There is currently no documented option to restrict which schemes PyJWKClient will fetch. If an application's jku URL ingestion path accepts attacker-influenced URLs (e.g., from JWT header, configuration file, OAuth flow parameter), the attacker can cause PyJWKClient to read arbitrary local files via file:// (SSRF on local filesystem), cause PyJWKClient to attempt FTP / data-URI fetches (broader SSRF surface), or forge tokens that PyJWT verifies as valid. The library does not directly return non-HTTP(S) URI contents to the attacker; the chained "plant a JWKS to forge tokens" scenario described in the original report requires additional application-layer flaws (attacker write access to a filesystem path, untrusted jku derivation) that this fix does not address. This vulnerability is fixed in 2.13.0.
Publish Date: 2026-05-28
URL: CVE-2026-48522
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.027%
CVSS 3 Score Details (4.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-993g-76c3-p5m4
Release Date: 2026-05-28
Fix Resolution: pyjwt - 2.13.0,pyjwt - 2.13.0
CVE-2026-48524
Vulnerable Library - pyjwt-2.12.1-py3-none-any.whl
JSON Web Token implementation in Python
Library home page: https://files.pythonhosted.org/packages/e5/7a/8dd906bd22e79e47397a61742927f6747fe93242ef86645ee9092e610244/pyjwt-2.12.1-py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /tmp/ws-ua_20260414115749_FASALT/python_KPPKZR/202604141157501/env/lib/python3.9/site-packages/pyjwt-2.12.1.dist-info
Dependency Hierarchy:
- vonage-4.7.2-py3-none-any.whl (Root Library)
- vonage_http_client-1.5.1-py3-none-any.whl
- vonage_jwt-1.1.5-py3-none-any.whl
- ❌ pyjwt-2.12.1-py3-none-any.whl (Vulnerable Library)
Found in base branch: main
Vulnerability Details
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests. The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint behavior (rate limiting, transient errors) which is beyond the attacker's control. This vulnerability is fixed in 2.13.0.
Publish Date: 2026-05-28
URL: CVE-2026-48524
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.039%
CVSS 3 Score Details (3.7)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-fhv5-28vv-h8m8
Release Date: 2026-05-28
Fix Resolution: pyjwt - 2.13.0,pyjwt - 2.13.0
⛑️Automatic Remediation will be attempted for this issue.
Path to dependency file: /requirements.txt
Path to vulnerable library: /tmp/ws-ua_20260414115749_FASALT/python_KPPKZR/202604141157501/env/lib/python3.9/site-packages/pyjwt-2.12.1.dist-info
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - requests-2.32.5-py3-none-any.whl
Python HTTP for Humans.
Library home page: https://files.pythonhosted.org/packages/1e/db/4254e3eabe8020b458f1a747140d32277ec7a271daf1d235b70dc0b4e6e3/requests-2.32.5-py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /tmp/ws-ua_20260414115749_FASALT/python_KPPKZR/202604141157501/env/lib/python3.9/site-packages/requests-2.32.5.dist-info
Dependency Hierarchy:
Found in base branch: main
Reachability Analysis
This vulnerability is potentially reachable
Vulnerability Details
Requests is a HTTP library. Prior to version 2.33.0, the "requests.utils.extract_zipped_paths()" utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call "extract_zipped_paths()" directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set "TMPDIR" in their environment to a directory with restricted write access.
Publish Date: 2026-03-25
URL: CVE-2026-25645
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.004%
CVSS 3 Score Details (4.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-03-25
Fix Resolution: https://github.com/psf/requests.git - v2.33.0
Vulnerable Library - urllib3-2.6.3-py3-none-any.whl
HTTP library with thread-safe connection pooling, file post, and more.
Library home page: https://files.pythonhosted.org/packages/39/08/aaaad47bc4e9dc8c725e68f9d04865dbcb2052843ff09c97b08904852d84/urllib3-2.6.3-py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /tmp/ws-ua_20260414115749_FASALT/python_KPPKZR/202604141157501/env/lib/python3.9/site-packages/urllib3-2.6.3.dist-info
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data) on the client side. This vulnerability is fixed in 2.7.0.
Publish Date: 2026-05-13
URL: CVE-2026-44432
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.019%
CVSS 3 Score Details (8.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-mf9v-mfxr-j63j
Release Date: 2026-05-11
Fix Resolution (urllib3): 2.7.0
Direct dependency fix Resolution (vonage): 4.8.0
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - urllib3-2.6.3-py3-none-any.whl
HTTP library with thread-safe connection pooling, file post, and more.
Library home page: https://files.pythonhosted.org/packages/39/08/aaaad47bc4e9dc8c725e68f9d04865dbcb2052843ff09c97b08904852d84/urllib3-2.6.3-py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /tmp/ws-ua_20260414115749_FASALT/python_KPPKZR/202604141157501/env/lib/python3.9/site-packages/urllib3-2.6.3.dist-info
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.
Publish Date: 2026-05-13
URL: CVE-2026-44431
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.013%
CVSS 3 Score Details (5.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-qccp-gfcp-xxvc
Release Date: 2026-05-11
Fix Resolution (urllib3): 2.7.0
Direct dependency fix Resolution (vonage): 4.8.0
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - pyjwt-2.12.1-py3-none-any.whl
JSON Web Token implementation in Python
Library home page: https://files.pythonhosted.org/packages/e5/7a/8dd906bd22e79e47397a61742927f6747fe93242ef86645ee9092e610244/pyjwt-2.12.1-py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /tmp/ws-ua_20260414115749_FASALT/python_KPPKZR/202604141157501/env/lib/python3.9/site-packages/pyjwt-2.12.1.dist-info
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
PyJWT is a JSON Web Token implementation in Python. From 2.9.0 to 2.12.1, there is a verifier-side algorithm allow-list bypass when jwt.decode() or jwt.decode_complete() are called with a PyJWK key. The token header alg is checked against the caller-supplied algorithms allow-list, but signature verification is performed with the algorithm bound to the PyJWK object instead of the header algorithm. An attacker who controls a registered JWK/JWKS private key can sign with a disallowed algorithm, advertise an allowed algorithm in the JWT header, and still be accepted. The issue affects the documented PyJWKClient.get_signing_key_from_jwt(...) flow. This vulnerability is fixed in 2.13.0.
Publish Date: 2026-05-28
URL: CVE-2026-48523
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.019%
CVSS 3 Score Details (5.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-jq35-7prp-9v3f
Release Date: 2026-05-28
Fix Resolution: pyjwt - 2.13.0,pyjwt - 2.13.0
Vulnerable Library - pyjwt-2.12.1-py3-none-any.whl
JSON Web Token implementation in Python
Library home page: https://files.pythonhosted.org/packages/e5/7a/8dd906bd22e79e47397a61742927f6747fe93242ef86645ee9092e610244/pyjwt-2.12.1-py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /tmp/ws-ua_20260414115749_FASALT/python_KPPKZR/202604141157501/env/lib/python3.9/site-packages/pyjwt-2.12.1.dist-info
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
PyJWT is a JSON Web Token implementation in Python. From 2.8.0 to 2.12.1, when verifying detached JWS tokens using the unencoded-payload option ("b64": false, RFC 7797), PyJWT performs Base64URL decoding of the compact-serialization payload segment before enforcing the detached-payload rules. For b64=false, PyJWT later discards that decoded payload and replaces it with the caller-provided detached_payload. In practice, this turns the middle segment into an attacker-controlled “work amplifier”: a remote client can supply an arbitrarily large Base64URL payload segment that forces CPU work + memory allocations even if the signature is invalid. This creates an unauthenticated DoS vector against any endpoint that verifies detached JWS using PyJWT. This vulnerability is fixed in 2.13.0.
Publish Date: 2026-05-28
URL: CVE-2026-48525
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.039%
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-w7vc-732c-9m39
Release Date: 2026-05-28
Fix Resolution: pyjwt - 2.13.0,pyjwt - 2.13.0
Vulnerable Library - idna-3.11-py3-none-any.whl
Internationalized Domain Names in Applications (IDNA)
Library home page: https://files.pythonhosted.org/packages/0e/61/66938bbb5fc52dbdf84594873d5b51fb1f7c7794e9c0f5bd885f30bc507b/idna-3.11-py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /tmp/ws-ua_20260414115749_FASALT/python_KPPKZR/202604141157501/env/lib/python3.9/site-packages/idna-3.11.dist-info
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fix. Payloads such as ""\u0660" * N" or ""\u30fb" * N + "\u6f22"" utilize the "valid_contexto" function prior to length rejection, and for high values of "N" will take a long time to process. Impact A specially crafted argument to the "idna.encode()" function could consume significant resources. This may lead to a denial-of-service. Patches Starting in version 3.14, the function rejects long inputs as soon as practicable prior to any further processing to minimize resource consumption. In version 3.15, this approach was extended to lesser used alternate functions (i.e. per-label conversions and codec support). Workarounds Domain names cannot exceed 253 characters in length, if this length limit is enforced prior to passing the domain to the "idna.encode()" function it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.
Publish Date: 2026-05-21
URL: CVE-2026-45409
Threat Assessment
Exploit Maturity: Not Defined
EPSS:
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-65pc-fj4g-8rjx
Release Date: 2026-05-19
Fix Resolution: idna - 3.15
Vulnerable Library - pyjwt-2.12.1-py3-none-any.whl
JSON Web Token implementation in Python
Library home page: https://files.pythonhosted.org/packages/e5/7a/8dd906bd22e79e47397a61742927f6747fe93242ef86645ee9092e610244/pyjwt-2.12.1-py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /tmp/ws-ua_20260414115749_FASALT/python_KPPKZR/202604141157501/env/lib/python3.9/site-packages/pyjwt-2.12.1.dist-info
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen() which uses Python stdlib's default OpenerDirector registering HTTPHandler, HTTPSHandler, FTPHandler, FileHandler, and DataHandler. There is currently no documented option to restrict which schemes PyJWKClient will fetch. If an application's jku URL ingestion path accepts attacker-influenced URLs (e.g., from JWT header, configuration file, OAuth flow parameter), the attacker can cause PyJWKClient to read arbitrary local files via file:// (SSRF on local filesystem), cause PyJWKClient to attempt FTP / data-URI fetches (broader SSRF surface), or forge tokens that PyJWT verifies as valid. The library does not directly return non-HTTP(S) URI contents to the attacker; the chained "plant a JWKS to forge tokens" scenario described in the original report requires additional application-layer flaws (attacker write access to a filesystem path, untrusted jku derivation) that this fix does not address. This vulnerability is fixed in 2.13.0.
Publish Date: 2026-05-28
URL: CVE-2026-48522
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.027%
CVSS 3 Score Details (4.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-993g-76c3-p5m4
Release Date: 2026-05-28
Fix Resolution: pyjwt - 2.13.0,pyjwt - 2.13.0
Vulnerable Library - pyjwt-2.12.1-py3-none-any.whl
JSON Web Token implementation in Python
Library home page: https://files.pythonhosted.org/packages/e5/7a/8dd906bd22e79e47397a61742927f6747fe93242ef86645ee9092e610244/pyjwt-2.12.1-py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /tmp/ws-ua_20260414115749_FASALT/python_KPPKZR/202604141157501/env/lib/python3.9/site-packages/pyjwt-2.12.1.dist-info
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests. The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint behavior (rate limiting, transient errors) which is beyond the attacker's control. This vulnerability is fixed in 2.13.0.
Publish Date: 2026-05-28
URL: CVE-2026-48524
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.039%
CVSS 3 Score Details (3.7)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-fhv5-28vv-h8m8
Release Date: 2026-05-28
Fix Resolution: pyjwt - 2.13.0,pyjwt - 2.13.0
⛑️Automatic Remediation will be attempted for this issue.