PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-7036 Python Jose Project CVE debrief

CVE-2016-7036 is a critical vulnerability in python-jose affecting versions through 1.3.1. The issue is described as a failure to use a constant-time comparison for HMAC keys, which can create an information-leak or authentication weakness depending on how the library is used. NVD rates the issue CVSS 9.8, with network attackability, no privileges required, no user interaction, and high confidentiality, integrity, and availability impact. The upstream fix is associated with python-jose 1.3.2.

Vendor
Python Jose Project
Product
CVE-2016-7036
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-23
Original CVE updated
2026-05-13
Advisory published
2017-01-23
Advisory updated
2026-05-13

Who should care

Organizations and developers using python-jose for JWT or HMAC-based cryptographic verification, especially if any deployed systems still run version 1.3.1 or earlier. Security teams responsible for application dependency management, API authentication, and secret validation should prioritize review.

Technical summary

NVD lists CVE-2016-7036 as affecting python-jose up to and including 1.3.1. The weakness is tied to non-constant-time comparison of HMAC keys, which can expose timing behavior during comparison. NVD assigns CWE-361 and a CVSS v3.0 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The available references point to the upstream patch and the 1.3.2 release as the remediation path.

Defensive priority

Immediate. This is a remotely reachable, unauthenticated, high-severity cryptographic flaw in a security-sensitive library. Upgrade or replace affected deployments as soon as possible and verify that no application is pinned to python-jose 1.3.1 or earlier.

Recommended defensive actions

  • Upgrade python-jose to 1.3.2 or later in all environments.
  • Inventory applications and services that depend on python-jose and confirm the resolved version is actually deployed.
  • Review authentication and token-verification code paths that rely on HMAC comparison behavior.
  • Rebuild containers and lockfiles after dependency updates to prevent older versions from being redeployed.
  • Add dependency scanning or SBOM-based checks to block python-jose 1.3.1 and earlier from re-entering production.

Evidence notes

Source corpus indicates the vulnerability affects cpe:2.3:a:python-jose_project:python-jose through version 1.3.1 and that 1.3.2 is the referenced fix release. The description states the root issue is failure to use constant-time comparison for HMAC keys. NVD published the CVE on 2017-01-23 and later modified the record on 2026-05-13. The corpus does not describe a concrete exploitation scenario beyond the timing-related weakness, so impact language should remain tied to the supplied CVSS and vendor/NVD text.

Official resources

Publicly disclosed in NVD on 2017-01-23; remediation is associated with python-jose 1.3.2.