GHSA-h395-gr6q-cpjc
NoneCVSS
—
EPSS
—
Published
Feb 3, 2026
CISA due date
—
The record
jsonwebtoken has Type Confusion that leads to potential authorization bypass
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | jsonwebtoken | 0 | 10.3.0 |
| Chainguard | komodo-core | 0 | 2.0.0-r0 |
| Chainguard | lychee | 0 | 0.22.0-r4 |
| Chainguard | py3.10-hf-xet | 0 | 1.2.0-r5 |
| Chainguard | py3.11-hf-xet | 0 | 1.2.0-r5 |
| Chainguard | py3.12-hf-xet | 0 | 1.2.0-r5 |
| Chainguard | py3.13-hf-xet | 0 | 1.2.0-r5 |
| Chainguard | qdrant | 0 | 1.16.3-r4 |
| Chainguard | uv | 0 | 0.10.2-r1 |
| Chainguard | wasmcloud | 0 | 2.0.1-r0 |
| Chainguard | zed | 0 | 0.223.3-r0 |
| Wolfi | lychee | 0 | 0.22.0-r4 |
| Wolfi | py3.10-hf-xet | 0 | 1.2.0-r5 |
| Wolfi | py3.11-hf-xet | 0 | 1.2.0-r5 |
| Wolfi | py3.12-hf-xet | 0 | 1.2.0-r5 |
| Wolfi | py3.13-hf-xet | 0 | 1.2.0-r5 |
| Wolfi | qdrant | 0 | 1.16.3-r4 |
| Wolfi | uv | 0 | 0.10.2-r1 |
| Wolfi | wasmcloud | 0 | 2.0.1-r0 |
| Wolfi | zed | 0 | 0.223.3-r0 |
Related vulnerabilities
- CVE-2026-25537 jsonwebtoken is a JWT lib in rust. Same vulnerability
- CVE-2026-31812 Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Also affects komodo-core
- CVE-2026-25727 time provides date and time handling in Rust. Also affects komodo-core
- CVE-2026-25541 Bytes is a utility library for working with bytes. Also affects komodo-core
- CVE-2026-21895 The `rsa` crate is an RSA implementation written in rust. Also affects lychee
- GHSA-9c48-w39g-hm26 rsa crate has potential panic on a prime being equal to 1 Also affects lychee
- CVE-2024-12224 `idna` accepts Punycode labels that do not produce any non-ASCII when decoded Also affects lychee
- CVE-2026-32829 lz4_flex is a pure Rust implementation of LZ4 compression/decompression. Also affects py3.10-hf-xet