From e93a40cd9ddc158b2108fa30c0c91b33f0d90bb9 Mon Sep 17 00:00:00 2001
From: Hetvi Thakar <hthakar@cisco.com>
Date: Thu, 15 Oct 2026 19:33:15 -0700
Subject: [PATCH] python3-pyjwt: fix CVE-2026-102274

This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/jpadilla/pyjwt/commit/8915570a0bfda9f0ff0e34e7fb09bdb9d71580cf
[2] https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
---
 .../python/files/CVE-2026-102274.patch        | 63 +++++++++++++++++++
 .../python/python3-pyjwt_2.12.1.bb            |  1 +
 2 files changed, 64 insertions(+)
 create mode 100644 meta-python/recipes-devtools/python/files/CVE-2026-102274.patch

diff --git a/meta-python/recipes-devtools/python/files/CVE-2026-102274.patch b/meta-python/recipes-devtools/python/files/CVE-2026-102274.patch
new file mode 100644
index 0000000000..6a49dac3be
--- /dev/null
+++ b/meta-python/recipes-devtools/python/files/CVE-2026-102274.patch
@@ -0,0 +1,63 @@
+From 8915570a0bfda9f0ff0e34e7fb09bdb9d71580cf Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jos=C3=A9=20Padilla?= <jpadilla@users.noreply.github.com>
+Date: Tue, 8 Sep 2026 16:13:35 -0400
+Subject: [PATCH] Skip malformed JWKs in JWK sets
+
+CVE: CVE-2026-102274
+Upstream-Status: Backport [https://github.com/jpadilla/pyjwt/commit/8915570a0bfda9f0ff0e34e7fb09bdb9d71580cf]
+
+(cherry picked from commit 8915570a0bfda9f0ff0e34e7fb09bdb9d71580cf)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ jwt/api_jwk.py        |  7 ++++++-
+ tests/test_api_jwk.py | 17 +++++++++++++++++
+ 2 files changed, 23 insertions(+), 1 deletion(-)
+
+diff --git a/jwt/api_jwk.py b/jwt/api_jwk.py
+index 4ae7cc3..5ee26b4 100644
+--- a/jwt/api_jwk.py
++++ b/jwt/api_jwk.py
+@@ -79,7 +79,12 @@ class PyJWK:
+                 f"Unable to find an algorithm for key: {self._jwk_data}",
+             ) from None
+ 
+-        self.key = self.Algorithm.from_jwk(self._jwk_data)
++        try:
++            self.key = self.Algorithm.from_jwk(self._jwk_data)
++        except ValueError as error:
++            raise InvalidKeyError(
++                f"Unable to construct key from JWK: {error}"
++            ) from error
+ 
+     @staticmethod
+     def from_dict(obj: JWKDict, algorithm: str | None = None) -> PyJWK:
+diff --git a/tests/test_api_jwk.py b/tests/test_api_jwk.py
+index 221e2e2..b081034 100644
+--- a/tests/test_api_jwk.py
++++ b/tests/test_api_jwk.py
+@@ -224,6 +224,23 @@ class TestPyJWK:
+ 
+ 
+ class TestPyJWKSet:
++    @crypto_required
++    def test_should_skip_malformed_rsa_key_and_load_remaining_keys(self) -> None:
++        with open(key_path("jwk_rsa_key.json")) as keyfile:
++            malformed_key = json.loads(keyfile.read())
++
++        malformed_key["d"] = "AAAAAA"
++        for parameter in ("p", "q", "dp", "dq", "qi"):
++            del malformed_key[parameter]
++
++        with open(key_path("jwk_rsa_pub.json")) as keyfile:
++            valid_key = json.loads(keyfile.read())
++
++        jwk_set = PyJWKSet.from_dict({"keys": [malformed_key, valid_key]})
++
++        assert len(jwk_set.keys) == 1
++        assert jwk_set.keys[0].key_type == "RSA"
++
+     @crypto_required
+     def test_should_load_keys_from_jwk_data_dict(self) -> None:
+         algo = RSAAlgorithm(RSAAlgorithm.SHA256)
+-- 
+2.35.6
diff --git a/meta-python/recipes-devtools/python/python3-pyjwt_2.12.1.bb b/meta-python/recipes-devtools/python/python3-pyjwt_2.12.1.bb
index 56c48c79fe..f7542cab2e 100644
--- a/meta-python/recipes-devtools/python/python3-pyjwt_2.12.1.bb
+++ b/meta-python/recipes-devtools/python/python3-pyjwt_2.12.1.bb
@@ -11,6 +11,7 @@ SRC_URI += "file://CVE-2026-48522.patch \
            file://CVE-2026-48525.patch \
            file://CVE-2026-48526.patch \
            file://CVE-2026-103001.patch \
+           file://CVE-2026-102274.patch \
            "
 
 SRC_URI[sha256sum] = "c74a7a2adf861c04d002db713dd85f84beb242228e671280bf709d765b03672b"