Threat database

Red Hat AI Inference Model Optimization Tools

PyJWT versions prior to certain fixed releases do not validate the 'crit' (Critical) header parameter in JSON Web Signature (JWS) tokens as required by RFC 7515 §4.1.11. This allows tokens containing unknown critical extensions to be accepted instead of rejected, violating the RFC and potentially enabling security policy bypasses. The vulnerability is similar to CVE-2025-59420 affecting Authlib and has a CVSS score of 7.5 (High).

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * requests: Requests vulnerable to .netrc credentials leak via malicious URLs (CVE-2024-47081) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

When using a `requests.Session`, if the first request to a given origin is made with `verify=False`, TLS certificate verification may remain disabled for all subsequent requests to that origin, even if `verify=True` is explicitly specified later. This occurs because the underlying connection is reused from the session's connection pool, causing the initial TLS verification setting to persist for the lifetime of the pooled connection. As a result, applications may unintentionally send requests without certificate verification, leading to potential man-in-the-middle attacks and compromised confidentiality or integrity. This behavior affects versions of `requests` prior to 2.32.0.