StackRadar

CVE-2026-48525

Medium

Advisory

Published 28 May 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.004
30th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
153
of 17,781 indexed, latest versions
Container images
157
deployed by those charts
Fix available
1 of 2
affected packages

PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS

Carried by container images the latest versions of 153 of 17,781 indexed charts deploy, on 157 images.

Affected packageAffected versionsFixed inImages
pyjwtpypi2.8.0, 2.9.0, 2.10.1, 2.11.0+2 more2.13.0122
pyjwtdeb1.7.1-2ubuntu2.1, 2.3.0-1, 2.3.0-1ubuntu0.2, 2.3.0-1ubuntu0.3+5 moreno fix listed37
OSV records
DEBIAN-CVE-2026-48525GHSA-w7vc-732c-9m39UBUNTU-CVE-2026-48525
Also known as
PYSEC-2026-178

Charts affected

153 by stars
ChartLatestAffected imagesRadar Score
uptime-kumauptime-kumaVerified publisher4.2.01 of 1See more

uptime-kuma uptime-kuma 4.2.0

1 of the 1 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.0a8610b3b4c38
pyjwt@2.6.0-1+deb12u1
no fix listed

Open the chart page →

30,159
airflowairflow-helmVerified publisher8.9.01 of 4See more

airflow airflow-helm 8.9.0

1 of the 4 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
apache/airflow:2.8.4-python3.964e58748b6b9
pyjwt@2.8.0
2.13.0

Open the chart page →

11,367
maildocker-postfixVerified publisher5.1.01 of 1See more

mail docker-postfix 5.1.0

1 of the 1 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
boky/postfix:5.1.0aafc77238423
pyjwt@2.10.1
2.13.0

Open the chart page →

5,366
clearmlallegroaiOfficialVerified publisher7.15.01 of 4See more

clearml allegroai 7.15.0

1 of the 4 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
allegroai/clearml:2.0.0-613713ae38f7daf
pyjwt@2.8.0
2.13.0

Open the chart page →

10,622
stackgres-operatorstackgres-chartsOfficialVerified publisher1.19.11 of 2See more

stackgres-operator stackgres-charts 1.19.1

1 of the 2 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
quay.io/stackgres/operator:1.19.1f241b0b20326
pyjwt@2.9.0
2.13.0

Open the chart page →

2,119
oncallgrafana1.16.51 of 12See more

oncall grafana 1.16.5

1 of the 12 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
grafana/oncall:v1.16.5499851658393
pyjwt@2.10.1
2.13.0

Open the chart page →

16,251
wazuhwazuh-helm-morgovedVerified publisher2.0.71 of 5See more

wazuh wazuh-helm-morgoved 2.0.7

1 of the 5 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.14.3f09282d281f6
pyjwt@2.10.1
2.13.0

Open the chart page →

11,384
homeassistantvolker-raschekVerified publisher0.2.31 of 1See more

homeassistant volker-raschek 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.12.48d000332b09b
pyjwt@2.8.0
2.13.0

Open the chart page →

6,041
openclawopenclawVerified publisher1.91.31 of 2See more

openclaw openclaw 1.91.3

1 of the 2 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
ghcr.io/browserless/chromium:v2.56.7b1ba7b054af2
pyjwt@2.7.0-1ubuntu0.1
no fix listed

Open the chart page →

2,977
dependabot-gitlabdependabot-gitlabVerified publisher6.3.01 of 3See more

dependabot-gitlab dependabot-gitlab 6.3.0

1 of the 3 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
andrcuns/dependabot-gitlab:7.7.0-alpha.143060f159f4c
pyjwt@2.7.0-1ubuntu0.1
no fix listed

Open the chart page →

4,556
nautobotnautobotOfficialVerified publisher3.1.21 of 1See more

nautobot nautobot 3.1.2

1 of the 1 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
networktocode/nautobot:3.0-py3.13ed484336b1ad
pyjwt@2.12.1
2.13.0

Open the chart page →

4,332
syftopenmined0.9.51 of 6See more

syft openmined 0.9.5

1 of the 6 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
openmined/syft-backend:0.9.5b72f74a68b32
pyjwt@2.10.1
2.13.0

Open the chart page →

17,245
wazuhwazuh-helmVerified publisher0.0.81 of 4See more

wazuh wazuh-helm 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.11.11da5c38c6a78
pyjwt@2.8.0
2.13.0

Open the chart page →

6,168
daskhubdask2024.1.12 of 9See more

daskhub dask 2024.1.1

2 of the 9 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
pangeo/base-notebook:2024.01.155fbe688a4f80
pyjwt@2.8.0
2.13.0
quay.io/jupyterhub/k8s-hub:3.2.12528c6e57587
pyjwt@2.8.0
2.13.0

Open the chart page →

14,094
seafiledatamateVerified publisher0.6.01 of 6See more

seafile datamate 0.6.0

1 of the 6 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
datamate/seafile-professional:11.0.202dd66b722464
pyjwt@2.3.0-1ubuntu0.2
no fix listed

Open the chart page →

27,267
karakeephelmforgeVerified publisher1.2.91 of 3See more

karakeep helmforge 1.2.9

1 of the 3 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
ghcr.io/browserless/chromium:v2.55.42ed0183564d7
pyjwt@2.7.0-1ubuntu0.1
no fix listed

Open the chart page →

9,460
hertzbeathertzbeatOfficialVerified publisher1.8.12 of 4See more

hertzbeat hertzbeat 1.8.1

2 of the 4 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
apache/hertzbeat:1.8.075d48a62748f
pyjwt@2.7.0-1
no fix listed
apache/hertzbeat-collector:1.8.0a2bab1be574c
pyjwt@2.7.0-1
no fix listed

Open the chart page →

14,000
netboxstartechnicaVerified publisher5.1.01 of 4See more

netbox startechnica 5.1.0

1 of the 4 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
netboxcommunity/netbox:v3.7.8-2.8.09bf83b350a89
pyjwt@2.8.0
2.13.0

Open the chart page →

1,650
alerta-webalerta-webVerified publisher0.1.121 of 2See more

alerta-web alerta-web 0.1.12

1 of the 2 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
hayk96/alerta-web:9.0.486377705e9e3
pyjwt@2.10.1
2.13.0

Open the chart page →

3,569
convertigoconvertigoOfficialVerified publisher8.4.31 of 5See more

convertigo convertigo 8.4.3

1 of the 5 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
pyjwt@2.8.0
2.13.0

Open the chart page →

17,404
home-assistantk8s-home-lab-repo16.3.11 of 1See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
pyjwt@2.10.1
2.13.0

Open the chart page →

4,634
mealieth-chartsVerified publisher0.5.11 of 1See more

mealie th-charts 0.5.1

1 of the 1 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
pyjwt@2.10.1
2.13.0

Open the chart page →

3,804
akeyless-api-gatewayakeyless-services-helmVerified publisher1.62.221 of 1See more

akeyless-api-gateway akeyless-services-helm 1.62.22

1 of the 1 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
akeyless/base:latest759e4289fae8
pyjwt@2.12.0
2.13.0

Open the chart page →

2,358
paperless-ngxalexmorbo-paperless-ngxVerified publisher0.2.01 of 2See more

paperless-ngx alexmorbo-paperless-ngx 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
pyjwt@2.10.1
2.13.0

Open the chart page →

12,037
anteonanteonVerified publisher2.6.42 of 13See more

anteon anteon 2.6.4

2 of the 13 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
ddosify/selfhosted_alaz_backend:2.3.11e5be48b37348
pyjwt@2.9.0
2.13.0
ddosify/selfhosted_backend:3.2.93c11e3182652
pyjwt@2.8.0
2.13.0

Open the chart page →

22,202
tikaapache-tika3.2.21 of 1See more

tika apache-tika 3.2.2

1 of the 1 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
apache/tika:3.2.2.0-fullffab324253ed
pyjwt@2.10.1
2.13.0

Open the chart page →

437
squestchristianhuthVerified publisher6.6.71 of 4See more

squest christianhuth 6.6.7

1 of the 4 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
pyjwt@2.10.1
2.13.0

Open the chart page →

9,971
syncstorage-rschristianhuthVerified publisher6.1.11 of 2See more

syncstorage-rs christianhuth 6.1.1

1 of the 2 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
ghcr.io/porelli/firefox-sync:syncstorage-rs-mysql-0.18.27d244e514216
pyjwt@2.10.1
2.13.0

Open the chart page →

693
cosmotech-copilot-apicosmotech-apiVerified publisher0.1.11 of 1See more

cosmotech-copilot-api cosmotech-api 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
pyjwt@2.8.0
2.13.0

Open the chart page →

11,205
paperless-ngxcrystalnetVerified publisher0.2.221 of 3See more

paperless-ngx crystalnet 0.2.22

1 of the 3 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.13.10642357c5dbd
pyjwt@2.9.0
2.13.0

Open the chart page →

13,761
seafiledr300481Verified publisher0.12.11 of 1See more

seafile dr300481 0.12.1

1 of the 1 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
seafileltd/seafile-mc:11.0.12d0c66e4621bd
pyjwt@2.3.0-1ubuntu0.2
no fix listed

Open the chart page →

10,858
craftycontrollerdrewburr-labs-helm-chartsVerified publisher0.3.01 of 1See more

craftycontroller drewburr-labs-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
registry.gitlab.com/crafty-controller/crafty-4:latest166a06f73d8c
pyjwt@2.8.0
2.13.0

Open the chart page →

3,671
taigafermosit0.0.111 of 7See more

taiga fermosit 0.0.11

1 of the 7 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
taigaio/taiga-back:latest4beed8f62c9f
pyjwt@2.10.1
2.13.0

Open the chart page →

8,496
obicogabe565Verified publisher0.6.01 of 3See more

obico gabe565 0.6.0

1 of the 3 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
ghcr.io/gabe565/obico/web:latesta5c1daef46c0
pyjwt@2.10.1
2.13.0

Open the chart page →

1,965
IMgrycapOfficialVerified publisher1.8.01 of 3See more

IM grycap 1.8.0

1 of the 3 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
ghcr.io/grycap/im:latest06a16d4f279f
pyjwt@2.10.1
2.13.0

Open the chart page →

4,132
helmuphelmupVerified publisher0.1.02 of 3See more

helmup helmup 0.1.0

2 of the 3 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
sirrend/helmup-engine:0.1.13699e79e3d4e2
pyjwt@2.8.0
2.13.0
sirrend/helmup-github-scraper:0.1.47ca688c7abf5
pyjwt@2.8.0
2.13.0

Open the chart page →

16,514
jessejesse-chartVerified publisher0.0.461 of 6See more

jesse jesse-chart 0.0.46

1 of the 6 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
salehmir/jesse:1.10.101afa95f979e9
pyjwt@2.8.0
2.13.0

Open the chart page →

3,421
difykubeblocksVerified publisher0.5.11 of 5See more

dify kubeblocks 0.5.1

1 of the 5 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
langgenius/dify-api:0.6.11fca918260dd6
pyjwt@2.8.0
2.13.0

Open the chart page →

20,403
litellmlitellm-helm0.2.01 of 1See more

litellm litellm-helm 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
ghcr.io/berriai/litellm-database:litellm_stable_release_branch-v1.75.5-stableab63d26a8a2c
pyjwt@2.9.0
2.13.0

Open the chart page →

4,292
medusamedusaVerified publisher1.3.81 of 1See more

medusa medusa 1.3.8

1 of the 1 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
linuxserver/medusa:v1.0.26-ls2884477fb1ce3ca
pyjwt@2.10.1
2.13.0

Open the chart page →

977
uptime-kumapascaliskeVerified publisher3.0.01 of 1See more

uptime-kuma pascaliske 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.0.2-slim-rootless9865163f92c1
pyjwt@2.6.0-1
no fix listed

Open the chart page →

6,883
privacyideaprivacyidea1.0.61 of 2See more

privacyidea privacyidea 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
gpappsoft/privacyidea-docker:3.12.2af7841adad26
pyjwt@2.10.1
2.13.0

Open the chart page →

5,440
phpqonstruktVerified publisher0.2.01 of 1See more

php qonstrukt 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
qonstrukt/php:8.4-v8-apache089af7925aa1
pyjwt@2.7.0-1ubuntu0.1
no fix listed

Open the chart page →

23,964
routehub-client-hubroutehub-helm1.0.01 of 3See more

routehub-client-hub routehub-helm 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
timescale/timescaledb-ha:pg16d7db8f1085a3
pyjwt@2.3.0-1ubuntu0.3
no fix listed

Open the chart page →

12,930
mealiertomik-helm-chartsVerified publisher0.0.21 of 1See more

mealie rtomik-helm-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.2.1322369a5b748
pyjwt@2.10.1
2.13.0

Open the chart page →

3,929
uptime-kumasb-helm-charts0.4.01 of 1See more

uptime-kuma sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.0.24c364ef96aad
pyjwt@2.6.0-1
no fix listed

Open the chart page →

38,107
slo-reportingslo-reportingVerified publisher0.3.341 of 2See more

slo-reporting slo-reporting 0.3.34

1 of the 2 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
ghcr.io/colenio/slo-reporting:0.3.316b64d194a27d
pyjwt@2.10.1
2.13.0

Open the chart page →

2,928
taigaunxwaresVerified publisher2026.3.81 of 6See more

taiga unxwares 2026.3.8

1 of the 6 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
taigaio/taiga-back:latest4beed8f62c9f
pyjwt@2.10.1
2.13.0

Open the chart page →

9,148
verbacapverbacapVerified publisher1.0.71 of 1See more

verbacap verbacap 1.0.7

1 of the 1 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
ghcr.io/mirio/verbacap:v1.5.084928e2fc4f2
pyjwt@2.8.0
2.13.0

Open the chart page →

2,233
uptime-kumaadnoctemVerified publisher0.4.11 of 1See more

uptime-kuma adnoctem 0.4.1

1 of the 1 container images this version deploys carry CVE-2026-48525.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.4917318f9d7be
pyjwt@2.6.0-1+deb12u1
no fix listed

Open the chart page →

30,028

Container images carrying it

157 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/jupyterhub/k8s-hub:4.3.5113e372cf71b
pyjwt@2.12.1
2.13.0
1
quay.io/jupyterhub/k8s-hub:3.2.12528c6e57587
pyjwt@2.8.0
2.13.0
1
quay.io/jupyterhub/k8s-hub:4.3.492f883d09270
pyjwt@2.12.1
2.13.0
1
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
pyjwt@2.10.1
2.13.0
1
quay.io/stackgres/operator:1.19.1f241b0b20326
pyjwt@2.9.0
2.13.0
1
registry.gitlab.com/crafty-controller/crafty-4:latest166a06f73d8c
pyjwt@2.8.0
2.13.0
1
registry.gitlab.com/xrow-public/helm-smtp/postfix:1.3.37eea4f0883dd
pyjwt@2.10.1
2.13.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.