CVE-2026-85394

Name	CVE-2026-85394
Description	python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
python-jose (PTS)	bookworm	3.3.0+dfsg-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
python-jose	source	(unstable)	(not affected)

Notes

- python-jose <not-affected> (Incomplete fix for CVE-2024-33663 not applied)
https://github.com/mpdavis/python-jose/issues/414
CVE exists due to an incomplete fix for CVE-2024-33663