[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cve-CVE-2026-32597":3},{"id":4,"cve_id":5,"euvd_id":6,"summary":7,"published":8,"cvss_data":9,"is_remote":19,"cwes":20,"cpes":24,"technologies":28,"references":31,"score":70,"epss_score":71,"epss_percentile":72,"is_kev":73,"cisa_kev_date_added":74,"cisa_kev_due_date":74,"cisa_ssvc":75,"attack_mappings":85,"exploits":140},4224,"CVE-2026-32597","EUVD-2026-11728","PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.","2026-03-13T19:55:00Z",{"cvss_v3.1":10},{"scope":11,"version":12,"baseScore":13,"attackVector":14,"baseSeverity":15,"vectorString":16,"integrityImpact":15,"userInteraction":17,"attackComplexity":18,"availabilityImpact":17,"privilegesRequired":17,"confidentialityImpact":17},"UNCHANGED","3.1",7.5,"NETWORK","HIGH","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:N","NONE","LOW",true,[21,22,23],"CWE-345","CWE-863","CWE-347",[25,26,27],"cpe:2.3:a:pyjwt_project:pyjwt:*:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:pyjwt:2.11.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:pyjwt:*:*:*:*:*:*:*:*",[29,30],"Pyjwt_Project Pyjwt","Pyjwt Pyjwt",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69],"https:\u002F\u002Fgithub.com\u002Fjpadilla\u002Fpyjwt\u002Fsecurity\u002Fadvisories\u002FGHSA-752w-5fwx-jx9f","https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2026\u002F05\u002Fmsg00008.html","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-32597","https:\u002F\u002Fgithub.com\u002Fjpadilla\u002Fpyjwt","https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpyjwt\u002FPYSEC-2026-120.yaml","https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:10140","https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:10141","https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:10184","https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:12176","https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:13508","https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:13512","https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:13545","https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:13553","https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:13672","https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:13916","https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:17083","https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:19138","https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:19355","https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:19375","https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:19712","https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:21431","https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:21517","https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:22330","https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:24977","https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:26226","https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:6568","https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:6720","https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:6912","https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:6926","https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:8437","https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:8746","https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:8747","https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:8748","https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-32597","https:\u002F\u002Fbugzilla.redhat.com\u002Fshow_bug.cgi?id=2447194","https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-32597.json","https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:37275","https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:42644",0.73,0.00273,0.1952,false,null,{"timestamp":76,"automatable":77,"tech_impact":78,"exploitation":79,"cisa_decision":80,"cisa_remediation_timeline":84},"2026-03-13T14:48:42.534762Z","yes","partial","poc",{"vector":81,"decision":82,"priority":83},"CISAv1\u002FE:P\u002FA:Y\u002FT:P\u002FM:H\u002F2026-10-25T16:01:56.592032\u002F","attend","medium","14D",[86,92,101,109,116,124,132],{"name":87,"source":88,"tactics":89,"technique_id":91},"Exploit Public-Facing Application","attack_vector",[90],"initial-access","T1190",{"name":93,"source":94,"cwe_ids":95,"tactics":96,"capec_ids":98,"technique_id":100},"Exploitation for Stealth","capec",[21],[97],"stealth",[99],"CAPEC-665","T1211",{"name":102,"source":94,"cwe_ids":103,"tactics":104,"capec_ids":106,"technique_id":108},"Defacement",[21],[105],"impact",[107],"CAPEC-148","T1491",{"name":110,"source":94,"cwe_ids":111,"tactics":112,"capec_ids":114,"technique_id":115},"Component Firmware",[21],[113,97],"persistence",[99],"T1542.002",{"name":117,"source":94,"cwe_ids":118,"tactics":119,"capec_ids":122,"technique_id":123},"Modify Authentication Process",[21],[120,121,113],"credential-access","defense-impairment",[99],"T1556",{"name":125,"source":94,"cwe_ids":126,"tactics":127,"capec_ids":129,"technique_id":131},"ARP Cache Poisoning",[21],[128,120],"collection",[130],"CAPEC-141","T1557.002",{"name":133,"source":94,"cwe_ids":134,"tactics":135,"capec_ids":137,"technique_id":139},"DNS Server",[21],[136],"resource-development",[138],"CAPEC-142","T1584.002",[141],{"link":32}]