There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT is_pem_format is
    affected because lazy PEM regular expression backtracks extensively. This occurs when a certificate-like
    input contains repeated BEGIN markers without a matching END marker. As a result, is_pem_format performs
    unbounded backtracking while searching for a PEM end marker. Consequently, an attacker can cause intensive
    CPU consumption. This issue is fixed in version 2.14.0. (CVE-2026-102270)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - PyJWT 是 JSON Web 令牌標準的 Python 實作。在之前 2.14.0，PyJWT is_pem_format會受到影響，因為延遲的 PEM 規則運算式會大量回溯。當類似憑證的輸入包含重複的 BEGIN 標記而沒有相符的 END 標記時，就會發生這種情況。因此，is_pem_format在搜尋 PEM 結束標記時執行無限回溯。因此，攻擊者可能會造成大量 CPU 消耗。2.14.0 版已修正此問題。(CVE-2026-102270)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - PyJWT 是 JSON Web Token 标准的 Python 实现。低于 2.14.0的 PyJWT is_pem_format会受到影响，因为懒惰 PEM 正则表达式会广泛回溯。当类证书的输入包含重复的 BEGIN 标记而没有匹配的 END 标记时，会发生这种情况。因此，is_pem_format 在搜索 PEM 结束标记时会执行无限回溯。因此，攻击者可造成密集 CPU 消耗。此问题已在 2.14.0 版本中修复。(CVE-2026-102270)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - PyJWT は、JSON Web トークン標準の Python 実装です。2.14.0より前は、lazy PEM正規表現が広範囲にバックトラックするため、PyJWT is_pem_formatは影響を受けます。これは、証明書のような入力に、一致する END マーカーなしで繰り返された BEGIN マーカーが含まれる場合に発生します。その結果、is_pem_format は PEM エンドマーカーの検索中に無限バックトラッキングを実行します。その結果、攻撃者は集中的なCPU消費を引き起こす可能性があります。この問題はバージョン 2.14.0 で修正されています。(CVE-2026-102270)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5064-1 advisory.

    - CVE-2026-101917: attacker traffic can amplify outbound requests to the configured JWKS endpoint     (bsc#1283060).
    - CVE-2026-101918: unauthenticated request can raise an exception that may produce an HTTP 500 response     (bsc#1283061).
    - CVE-2026-102267: forwarded credentials may be disclosed or verification keys may be substituted     (bsc#1283064).
    - CVE-2026-102268: an attacker who knows the public key can forge authenticated HMAC tokens (bsc#1283065).
    - CVE-2026-102269: raw-token revocation checks can fail to recognize an equivalent modified token     (bsc#1283066).
    - CVE-2026-102270: an attacker can cause intensive CPU consumption (bsc#1283067).
    - CVE-2026-102271: an attacker who knows the public key can forge authenticated HMAC tokens (bsc#1283068).
    - CVE-2026-102275: an attacker may use a stolen sender-constrained token without the legitimate private     key       (bsc#1283072).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT is_pem_format is     affected because lazy PEM regular expression backtracks extensively. This occurs when a certificate-like     input contains repeated BEGIN markers without a matching END marker. As a result, is_pem_format performs     unbounded backtracking while searching for a PEM end marker. Consequently, an attacker can cause intensive     CPU consumption. This issue is fixed in version 2.14.0. (CVE-2026-102270)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the python3 package has been released.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5093-1 advisory.

    - CVE-2026-102268: an attacker who knows the public key can forge authenticated HMAC tokens (bsc#1283065).
    - CVE-2026-102270: an attacker can cause intensive CPU consumption (bsc#1283067).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
472225	Echo: pyjwt: security update to 2.14.0	Tenable Cloud Security	Echo Local Security Checks	2026/10/3	2026/10/13	medium
465503	Chainguard: authentik-fips-2026.5: security update to 2026.5.7-r7	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	2026/10/2	2026/10/7	medium
472225	Echo: pyjwt: security update to 2.14.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	2026/10/3	2026/10/13	medium
465503	Chainguard: authentik-fips-2026.5: security update to 2026.5.7-r7	Tenable Cloud Security	Chainguard Local Security Checks	2026/10/2	2026/10/7	medium
351364	Linux Distros 未修補弱點：CVE-2026-102270	Nessus	Misc.	2026/9/30	2026/11/9	medium
351364	Linux Distros 未修补的漏洞：CVE-2026-102270	Nessus	Misc.	2026/9/30	2026/11/9	medium
351364	Linux Distros のパッチ未適用の脆弱性: CVE-2026-102270	Nessus	Misc.	2026/9/30	2026/11/9	medium
376262	SUSE SLED15 / SLES15 Security Update : python-PyJWT (SUSE-SU-2026:5064-1)	Nessus	SuSE Local Security Checks	2026/11/5	2026/11/5	critical
351364	Linux Distros Unpatched Vulnerability : CVE-2026-102270	Nessus	Misc.	2026/9/30	2026/11/9	medium
374968	Photon OS 5.0: Python3 PHSA-2026-5.0-92-1040	Nessus	PhotonOS Local Security Checks	2026/11/2	2026/11/2	critical
376954	SUSE SLES12 Security Update : python-PyJWT (SUSE-SU-2026:5093-1)	Nessus	SuSE Local Security Checks	2026/11/6	2026/11/6	medium

検出

プラグインの検索

medium

medium

medium

medium

medium

medium

medium

critical

medium

critical

medium