CVE-2026-62995 is a security flaw in the joserfc Python library that processes JSON Web Tokens (JWTs). The vulnerability arises from the library's acceptance of JWTs containing non-standard trailing padding, which can be exploited to create malleable tokens. This malleability may allow attackers to circumvent security mechanisms such as token revocation and anti-replay protections in applications relying on joserfc for JWT validation. The vulnerability affects Red Hat Hardened Images RPMs, specifically the jaeger package version 2.20.0-0.8.hum1 for aarch64 and x86_64. Red Hat has published an advisory (RHSA-2026:48758) detailing the issue and the affected packages. While no explicit patch link is provided, the advisory references updated RPMs including the fixed version. Red Hat rates this vulnerability as critical due to its potential impact on authentication security.

The vulnerability enables attackers to exploit JWT malleability by using tokens with non-standard trailing padding. This can lead to bypassing token revocation and anti-replay protections, potentially allowing unauthorized access or continued use of tokens that should be invalidated. The impact is primarily on the integrity of authentication and authorization mechanisms in applications using the vulnerable joserfc library. There is no indication of confidentiality or availability impact. No known exploits in the wild have been reported.

Red Hat has released updated RPM packages for the jaeger component (version 2.20.0-0.8.hum1) as part of the Red Hat Hardened Images security update. Users should apply these updates to remediate the vulnerability. Since no explicit patch link is provided, users should follow Red Hat's official guidance at https://images.redhat.com/ and the advisory RHSA-2026:48758 for instructions on applying the update. No alternative mitigations or workarounds are specified in the advisory. Monitoring for updates from Red Hat is recommended to confirm patch availability and deployment.