GCVE - cpe:2.3:a:python-jose_project:python-jose:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:python-jose_project:python-jose:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Python Jose Project (`d402604b-e7ac-5a1b-b501-627d8b364be5`)
Product	Python Jose (`b03486e0-b5ee-592f-a7fc-48a653eddc11`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/mpdavis/python-jose`	purl2cpe	2026-06-01 10:13:03.228357
`pkg:pypi/python-jose`	purl2cpe	2026-06-01 10:13:03.228359
`pkg:rpm/fedora/python-jose`	purl2cpe	2026-06-01 10:13:03.228362
`pkg:rpm/opensuse/python-python-jose`	purl2cpe	2026-06-01 10:13:03.228365

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-85394`	vulnerable	2026-09-16 04:33:08.061362	python-jose through 3.5.0 Algorithm Confusion via DER-encoded Public Key as HMAC Secret CRITICAL (9.1) python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663. Published: 2026-09-03T18:54:26.563Z Updated: 2026-09-14T13:50:51.862Z Open on db.gcve.eu Reference links https://github.com/mpdavis/python-jose/issues/414 https://github.com/mpdavis/python-jose https://github.com/mpdavis/python-jose/blob/018b310ddb8b50dcfd09a0c152117835a21dd656/jose/backends/native.py https://github.com/mpdavis/python-jose/blob/018b310ddb8b50dcfd09a0c152117835a21dd656/jose/utils.py https://github.com/advisories/GHSA-6c5p-j8vq-pqhj	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-33664`	vulnerable	2026-06-08 06:37:31.934689	Details available python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryption (JWE) token with a high compression ratio, aka a "JWT bomb." This is similar to CVE-2024-21319. Published: 2024-04-25T00:00:00.000Z Updated: 2024-09-05T15:28:29.569Z Open on db.gcve.eu Reference links https://github.com/mpdavis/python-jose/issues/344 https://github.com/mpdavis/python-jose/pull/345 https://www.vicarius.io/vsociety/posts/jwt-bomb-in-python-jose-cve-2024-33664	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-33663`	vulnerable	2026-06-08 06:37:31.934093	Details available python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217. Published: 2024-04-25T00:00:00.000Z Updated: 2024-09-03T19:34:19.749Z Open on db.gcve.eu Reference links https://github.com/mpdavis/python-jose/issues/346 https://www.vicarius.io/vsociety/posts/algorithm-confusion-in-python-jose-cve-2024-33663	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-7036`	vulnerable	2026-06-08 05:08:11.619199	Details available python-jose before 1.3.2 allows attackers to have unspecified impact by leveraging failure to use a constant time comparison for HMAC keys. Published: 2017-01-23T21:00:00.000Z Updated: 2024-08-06T01:50:46.651Z Open on db.gcve.eu Reference links https://github.com/mpdavis/python-jose/releases/tag/1.3.2 http://www.securityfocus.com/bid/95845 https://github.com/mpdavis/python-jose/pull/35/commits/89b46353b9f611e9da38de3d2fedf52331167b93	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Python Jose

Notes

PURL mappings

Vulnerability references

Contribute