{
    "summary": {
        "snap": {
            "added": [],
            "removed": [],
            "diff": []
        },
        "deb": {
            "added": [],
            "removed": [],
            "diff": [
                "python3-jwt"
            ]
        }
    },
    "diff": {
        "deb": [
            {
                "name": "python3-jwt",
                "from_version": {
                    "source_package_name": "pyjwt",
                    "source_package_version": "2.7.0-1ubuntu0.3",
                    "version": "2.7.0-1ubuntu0.3"
                },
                "to_version": {
                    "source_package_name": "pyjwt",
                    "source_package_version": "2.7.0-1ubuntu0.4",
                    "version": "2.7.0-1ubuntu0.4"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-101917",
                        "url": "https://ubuntu.com/security/CVE-2026-101917",
                        "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or varying kid values absent from the cached JWKS. As a result, each cache miss causes PyJWKClient to refresh the JWKS. Consequently, attacker traffic can amplify outbound requests to the configured JWKS endpoint. This issue is fixed in version 2.14.0.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-09-28 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-101918",
                        "url": "https://ubuntu.com/security/CVE-2026-101918",
                        "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a result, documented PyJWT exception handling does not contain the failure. Consequently, an unauthenticated request can raise an exception that may produce an HTTP 500 response. The advisory-defined affected implementation also includes jwt/api_jwt.py, verify_signature=False. This issue is fixed in version 2.15.0.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-09-28 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-102274",
                        "url": "https://ubuntu.com/security/CVE-2026-102274",
                        "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in  jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications can experience authentication failures or request-level denial of service. This issue is fixed in version 2.14.0.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-09-28 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-102275",
                        "url": "https://ubuntu.com/security/CVE-2026-102275",
                        "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in  jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components. As a result, identity derived from x can differ from operations performed with d. Consequently, if an integration also accepts private key parameters from a proof header without rejecting them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue is fixed in version 2.15.0.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-09-28 21:17:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-101917",
                                "url": "https://ubuntu.com/security/CVE-2026-101917",
                                "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or varying kid values absent from the cached JWKS. As a result, each cache miss causes PyJWKClient to refresh the JWKS. Consequently, attacker traffic can amplify outbound requests to the configured JWKS endpoint. This issue is fixed in version 2.14.0.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-09-28 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-101918",
                                "url": "https://ubuntu.com/security/CVE-2026-101918",
                                "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a result, documented PyJWT exception handling does not contain the failure. Consequently, an unauthenticated request can raise an exception that may produce an HTTP 500 response. The advisory-defined affected implementation also includes jwt/api_jwt.py, verify_signature=False. This issue is fixed in version 2.15.0.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-09-28 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-102274",
                                "url": "https://ubuntu.com/security/CVE-2026-102274",
                                "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in  jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications can experience authentication failures or request-level denial of service. This issue is fixed in version 2.14.0.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-09-28 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-102275",
                                "url": "https://ubuntu.com/security/CVE-2026-102275",
                                "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in  jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components. As a result, identity derived from x can differ from operations performed with d. Consequently, if an integration also accepts private key parameters from a proof header without rejecting them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue is fixed in version 2.15.0.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-09-28 21:17:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: Unauthenticated Denial of Service via unbounded thread",
                            "    lock waiting during JWKS cache refreshes",
                            "    - debian/patches/CVE-2026-101917.patch: Throttle repeated PyJWKClient",
                            "      refreshes in jwt/jwks_client.py, tests/test_jwks_client.py.",
                            "    - CVE-2026-101917",
                            "  * SECURITY UPDATE: Uncaught recursion exception in get_signing_key_from_jwt",
                            "    - debian/patches/CVE-2026-101918.patch: fix: normalize recursive JWT ",
                            "      payload errors in jwt/api_jwt.py, tests/test_api_jwt.py,",
                            "      tests/test_jwks_client.py.",
                            "    - CVE-2026-101918",
                            "  * SECURITY UPDATE: Uncaught exception in RSAAlgorithm.from_jwk when ",
                            "    processing malformed RSA key.",
                            "    - debian/patches/CVE-2026-102274.patch: Skip malformed JWKs in JWK sets in",
                            "      jwt/api_jwk.py, tests/test_api_jwk.py.",
                            "    - CVE-2026-102274",
                            "  * SECURITY UPDATE: Public/private key identity confusion via mismatched x ",
                            "    and d parameters in OKPAlgorithm.from_jwk",
                            "    - debian/patches/CVE-2026-102275.patch: fix: reject inconsistent OKP ",
                            "      private keys in jwt/algorithms.py, tests/test_algorithms.py.",
                            "    - CVE-2026-102275",
                            ""
                        ],
                        "package": "pyjwt",
                        "version": "2.7.0-1ubuntu0.4",
                        "urgency": "medium",
                        "distributions": "noble-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Hurman <hurman@canonical.com>",
                        "date": "Thu, 15 Oct 2026 12:30:42 +0800"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            }
        ],
        "snap": []
    },
    "added": {
        "deb": [],
        "snap": []
    },
    "removed": {
        "deb": [],
        "snap": []
    },
    "notes": "Changelog diff for Ubuntu 24.04 noble image from release image serial 20261017 to 20261020",
    "from_series": "noble",
    "to_series": "noble",
    "from_serial": "20261017",
    "to_serial": "20261020",
    "from_manifest_filename": "release_manifest.previous",
    "to_manifest_filename": "manifest.current"
}