Threats Tagged 'cve-2026-48524'

> [!NOTE] > The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint behavior (rate limiting, transient errors) which is beyond the attacker's control. Impact is reduced auth availability until the next successful fetch, not complete denial of service. ## Summary PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests. Additionally, fetch_data() finally block clears the JWKS cache on network error. ## Root Cause jwt/jwks_client.py:172-198 - get_signing_key(kid) calls get_signing_keys(refresh=True) for unknown kids, bypassing TTL cache with no cooldown. jwt/jwks_client.py:120-122 - finally block writes None to cache on error, clearing valid data. ## Impact - DoS against JWKS endpoint (unlimited requests per invalid token) - DoS against application (network I/O latency) - Cascading failure (rate limiting clears cache, breaking legitimate auth) ## Suggested Fix 1. Add refresh cooldown (refuse refresh more than once per TTL period) 2. Move cache write from finally to else block ## Affected Versions All versions with PyJWKClient (2.4.0 through 2.12.1)

PyJWKClient in the kimi-cli library allows fetching JSON Web Key Sets (JWKS) from URLs with schemes beyond HTTP and HTTPS, including file://, ftp://, and data:. This can lead to server-side request forgery (SSRF) on local files and other protocols. An attacker who can influence the jku URL and write to a local file path can forge JWT tokens that the application accepts as valid. The vulnerability affects PyJWT versions 2.11.0 and 2.12.1 and likely earlier versions. A fix is available that restricts allowed URL schemes to HTTP and HTTPS.

This update includes the following RPMs: llvm21: * clang21-21.1.8-6.hum1 (aarch64, x86_64) * clang21-analyzer-21.1.8-6.hum1 (aarch64, x86_64) * clang21-devel-21.1.8-6.hum1 (aarch64, x86_64) * clang21-libs-21.1.8-6.hum1 (aarch64, x86_64) * clang21-resource-filesystem-21.1.8-6.hum1 (aarch64, x86_64) * clang21-tools-extra-21.1.8-6.hum1 (aarch64, x86_64) * clang21-tools-extra-devel-21.1.8-6.hum1 (aarch64, x86_64) * compiler-rt21-21.1.8-6.hum1 (aarch64, x86_64) * git-clang-format21-21.1.8-6.hum1 (aarch64, x86_64) * libomp21-21.1.8-6.hum1 (aarch64, x86_64) * libomp21-devel-21.1.8-6.hum1 (aarch64, x86_64) * lld21-21.1.8-6.hum1 (aarch64, x86_64) * lld21-devel-21.1.8-6.hum1 (aarch64, x86_64) * lld21-libs-21.1.8-6.hum1 (aarch64, x86_64) * lldb21-21.1.8-6.hum1 (aarch64, x86_64) * lldb21-devel-21.1.8-6.hum1 (aarch64, x86_64) * llvm21-21.1.8-6.hum1 (aarch64, x86_64) * llvm21-cmake-utils-21.1.8-6.hum1 (aarch64, x86_64) * llvm21-devel-21.1.8-6.hum1 (aarch64, x86_64) * llvm21-doc-21.1.8-6.hum1 (noarch) * llvm21-filesystem-21.1.8-6.hum1 (aarch64, x86_64) * llvm21-googletest-21.1.8-6.hum1 (aarch64, x86_64) * llvm21-libs-21.1.8-6.hum1 (aarch64, x86_64) * llvm21-static-21.1.8-6.hum1 (aarch64, x86_64) * llvm21-test-21.1.8-6.hum1 (aarch64, x86_64) * python3-clang21-21.1.8-6.hum1 (aarch64, x86_64) * llvm21-21.1.8-6.hum1.src (src)

This update includes the following RPMs: llvm: * clang-21.1.8-1.1.hum1 (aarch64, x86_64) * clang-analyzer-21.1.8-1.1.hum1 (aarch64, x86_64) * clang-devel-21.1.8-1.1.hum1 (aarch64, x86_64) * clang-libs-21.1.8-1.1.hum1 (aarch64, x86_64) * clang-resource-filesystem-21.1.8-1.1.hum1 (aarch64, x86_64) * clang-tools-extra-21.1.8-1.1.hum1 (aarch64, x86_64) * clang-tools-extra-devel-21.1.8-1.1.hum1 (aarch64, x86_64) * compiler-rt-21.1.8-1.1.hum1 (aarch64, x86_64) * git-clang-format-21.1.8-1.1.hum1 (aarch64, x86_64) * libcxx-21.1.8-1.1.hum1 (aarch64, x86_64) * libcxx-devel-21.1.8-1.1.hum1 (aarch64, x86_64) * libcxx-static-21.1.8-1.1.hum1 (aarch64, x86_64) * libcxxabi-21.1.8-1.1.hum1 (aarch64, x86_64) * libcxxabi-devel-21.1.8-1.1.hum1 (aarch64, x86_64) * libcxxabi-static-21.1.8-1.1.hum1 (aarch64, x86_64) * libomp-21.1.8-1.1.hum1 (aarch64, x86_64) * libomp-devel-21.1.8-1.1.hum1 (aarch64, x86_64) * lld-21.1.8-1.1.hum1 (aarch64, x86_64) * lld-devel-21.1.8-1.1.hum1 (aarch64, x86_64) * lld-libs-21.1.8-1.1.hum1 (aarch64, x86_64) * lldb-21.1.8-1.1.hum1 (aarch64, x86_64) * lldb-devel-21.1.8-1.1.hum1 (aarch64, x86_64) * llvm-21.1.8-1.1.hum1 (aarch64, x86_64) * llvm-bolt-21.1.8-1.1.hum1 (aarch64, x86_64) * llvm-cmake-utils-21.1.8-1.1.hum1 (aarch64, x86_64) * llvm-devel-21.1.8-1.1.hum1 (aarch64, x86_64) * llvm-doc-21.1.8-1.1.hum1 (noarch) * llvm-filesystem-21.1.8-1.1.hum1 (aarch64, x86_64) * llvm-googletest-21.1.8-1.1.hum1 (aarch64, x86_64) * llvm-libs-21.1.8-1.1.hum1 (aarch64, x86_64) * llvm-libunwind-21.1.8-1.1.hum1 (aarch64, x86_64) * llvm-libunwind-devel-21.1.8-1.1.hum1 (aarch64, x86_64) * llvm-libunwind-static-21.1.8-1.1.hum1 (aarch64, x86_64) * llvm-static-21.1.8-1.1.hum1 (aarch64, x86_64) * llvm-test-21.1.8-1.1.hum1 (aarch64, x86_64) * mlir-21.1.8-1.1.hum1 (aarch64, x86_64) * mlir-devel-21.1.8-1.1.hum1 (aarch64, x86_64) * mlir-static-21.1.8-1.1.hum1 (aarch64, x86_64) * polly-21.1.8-1.1.hum1 (aarch64, x86_64) * polly-devel-21.1.8-1.1.hum1 (aarch64, x86_64) * python3-clang-21.1.8-1.1.hum1 (aarch64, x86_64) * python3-lit-21.1.8-1.1.hum1 (noarch) * python3-lldb-21.1.8-1.1.hum1 (aarch64, x86_64) * python3-mlir-21.1.8-1.1.hum1 (aarch64, x86_64) * llvm-21.1.8-1.1.hum1.src (src)