CVE-2026-101918
published 2026-09-28CVE-2026-101918: PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload…
PriorityP343high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.36%
28.0th percentile
PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a result, documented PyJWT exception handling does not contain the failure. Consequently, an unauthenticated request can raise an exception that may produce an HTTP 500 response. The advisory-defined affected implementation also includes jwt/api_jwt.py, verify_signature=False. This issue is fixed in version 2.15.0.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jpadilla | pyjwt | — | — |
| pyjwt_project | pyjwt | >= 2.0.0 < 2.15.0 | 2.15.0 |
| pyjwt_project | pyjwt | >= 2.0.0a1 < 2.15.0 | 2.15.0 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)
ghsa·2026-09-30
CVE-2026-101918 [MEDIUM] CWE-248 PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)
PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)
## Summary
`PyJWKClient.get_signing_key_from_jwt(token)` — the first step of the JWKS
verification flow documented in `docs/usage.rst` — must decode a token's
payload before its signature can be checked, via
`jwt.api_jwt.decode_complete(token, options={"verify_signature": False})`.
That call parses the payload with `json.loads` in `PyJWT._decode_payload`
(`jwt/api_jwt.py:297-300`), whose `except` clause catches only `ValueError`.
A payload that is valid JSON but nested ~20,000 levels deep makes
`json.loads` raise `RecursionError`, which is **not** a `ValueError` and
escapes as a raw, undocumented exception type — not `DecodeError`,
`InvalidTokenError
VulDB
jpadilla PyJWT up to 2.14.x Payload Parser jwt/api_jwt.py PyJWKClient.get_signing_key_from_jwt recursion
vuldb·2026-09-28·CVSS 5.3
CVE-2026-101918 [MEDIUM] jpadilla PyJWT up to 2.14.x Payload Parser jwt/api_jwt.py PyJWKClient.get_signing_key_from_jwt recursion
A vulnerability has been found in jpadilla PyJWT up to 2.14.x and classified as problematic. Affected by this vulnerability is the function PyJWKClient.get_signing_key_from_jwt of the file jwt/api_jwt.py of the component Payload Parser. This manipulation causes uncontrolled recursion.
The identification of this vulnerability is CVE-2026-101918. It is possible to initiate the attack remotely. There is no exploit available.
The affected component should be upgraded.
Red Hat
pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload
vendor_redhat·2026-09-28·CVSS 5.3
CVE-2026-101918 [MEDIUM] CWE-248 pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload
pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload
PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a result, documented PyJWT exception handling does not contain the failure. Consequently, an unauthenticated request can raise an exception that may produce an HTTP 500 response. The advisory-defined affected implementation also includes jwt/api_jwt.py, verify_signature=False. This issue is fixed in version 2.15.0.
A flaw was found in PyJWT. When processing a JSON Web Token (JWT) prior to signature verification, the parser fa
No detection rules found.
No public exploits indexed.
2026-09-28
Published