Vulnerabilities matching "python-jose" — 18 matching vulnerabilities

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed — no installation and no source-code access required.

Scan your app free →
Severity Vulnerability Package Ecosystem Disclosed Fixed version
9.1 critical CVE-2024-33663: python-jose Algorithm Confusion Guard Bypass via DER-Encoded Public Keys python-jose PyPI 15 Oct 2026 No fix published
9.1 critical CVE-2024-33663: python-jose Critical Vulnerability in HMAC Initialization python-jose PyPI 03 Sep 2026 No fix published
5.3 medium Denial of Service Vulnerability in python-jose: Compressed JWE Content python-jose PyPI 17 Dec 2025 3.4.0
5.3 medium CVE-2024-29370: python-jose Denial-of-Service Vulnerability via Malicious JWE Token python-jose PyPI 17 Dec 2025 No fix published
5.3 medium Denial-of-Service Vulnerability in python-jose Package (CVE-2024-29370) python-jose Debian 17 Dec 2025 No fix published
Unrated Critical Vulnerability in python-jose: JWT Token Signature Bypass python-jose Debian 10 Oct 2025 No fix published
7.4 critical CVE-2024-33663: python-jose algorithm confusion with OpenSSH ECDSA keys python-jose PyPI 26 Apr 2024 3.4.0
5.3 medium CVE-2024-33664: python-jose Denial of Service via Compressed JWT Tokens python-jose PyPI 26 Apr 2024 3.4.0
Unrated Algorithm Confusion Vulnerability in python-jose Package python-jose Debian 26 Apr 2024 No fix published
Unrated Denial of Service Vulnerability in python-jose Package python-jose Debian 26 Apr 2024 No fix published
Unrated CVE-2024-33663: python-jose Algorithm Confusion Vulnerability python-jose PyPI 26 Apr 2024 3.4.0
Unrated CVE-2024-33664: python-jose Denial of Service via High Compression JWE Token python-jose PyPI 26 Apr 2024 3.4.0
Unrated Algorithm Confusion Vulnerability in python-jose: ECDSA Key Handling Issue python-jose Debian 26 Apr 2024 No fix published
Unrated Denial of Service Vulnerability in python-jose: JWT Bomb Risk python-jose Debian 26 Apr 2024 No fix published
5.3 medium Denial of Service Vulnerability in python-jose Package - CVE-2024-33664 python-jose Ubuntu 26 Apr 2024 No fix published
6.5 medium Algorithm Confusion Vulnerability in python-jose Package python-jose Ubuntu 26 Apr 2024 No fix published
9.8 critical CVE-2016-7036: python-jose failure to use a constant time comparison for HMAC keys python-jose PyPI 17 May 2022 1.3.2
Unrated CVE-2016-7036: python-jose HMAC Key Comparison Vulnerability python-jose PyPI 23 Jan 2017 1.3.2
Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

Searching the database

How do I search for a CVE or a package?

Type a CVE id, package name, ecosystem or keyword into the search field. Results include the severity, the affected package, the ecosystem, the disclosure date and the fixed version.

Can I filter by severity or by whether a fix exists?

Yes. The filters on the left narrow the list to critical, high, medium or low vulnerabilities, to a single ecosystem, and to vulnerabilities that have a fix available or none yet.

What does "No fix published" mean?

No patched version has been released for that vulnerability yet. The vulnerability page still shows the affected range and any workaround that can reduce exposure in the meantime.