CVE-2026-102265

Published: Sep 28, 2026Modified: Oct 7, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Exploitability: 3.9 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS._load in jwt/api_jws.py is affected because parser catches ValueError but not RecursionError. This occurs when a deeply nested token header reaches json.loads. As a result, RecursionError escapes the documented PyJWT error hierarchy. Consequently, an unauthenticated malformed token can cause a request-level failure and HTTP 500. This issue is fixed in version 2.14.0.

Affected (1)

Products: Pyjwt Project: Pyjwt

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Pyjwt Project Pyjwt	Version 2.13.0

Related CWEs

Uncontrolled Recursion

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

References (4)

https://github.com/jpadilla/pyjwt/commit/06573692ebcdec8831c3927513b3e87c31fbbb62

Source: security-advisories@github.com

Patch

https://github.com/jpadilla/pyjwt/releases/tag/2.14.0

Source: security-advisories@github.com

ProductRelease Notes

https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863

Source: security-advisories@github.com

ExploitMitigationVendor Advisory

https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitMitigationVendor Advisory

Timeline

No history available yet.