Threats tagged 'ghsa-w6j9-cwv2-h6wq'

PyJWT versions 2.9.0 through 2.13.0 contain a vulnerability where a malformed RSA JWK in a JWK Set causes the entire set parsing to abort due to an uncaught ValueError. This happens because the ValueError raised by the cryptography library during RSA key recovery is not caught by PyJWT's exception handling, leading to denial of service in key processing.