CVE-2026-102265
published 2026-09-28CVE-2026-102265: PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS._load in jwt/api_jws.py is affected because parser catches…
PriorityP429medium5.3CVSS 3.1
AVNACLPRNUINSUCNINAL
EPSS
0.30%
21.3th percentile
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS._load in jwt/api_jws.py is affected because parser catches ValueError but not RecursionError. This occurs when a deeply nested token header reaches json.loads. As a result, RecursionError escapes the documented PyJWT error hierarchy. Consequently, an unauthenticated malformed token can cause a request-level failure and HTTP 500. This issue is fixed in version 2.14.0.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jpadilla | pyjwt | — | — |
| pyjwt_project | pyjwt | — | — |
| pyjwt_project | pyjwt | >= 2.13.0 < 2.14.0 | 2.14.0 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
pyjwt: pyjwt: Denial of Service via deeply nested token headers
vendor_redhat·2026-09-28·CVSS 5.3
CVE-2026-102265 [MEDIUM] CWE-248 pyjwt: pyjwt: Denial of Service via deeply nested token headers
pyjwt: pyjwt: Denial of Service via deeply nested token headers
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS._load in jwt/api_jws.py is affected because parser catches ValueError but not RecursionError. This occurs when a deeply nested token header reaches json.loads. As a result, RecursionError escapes the documented PyJWT error hierarchy. Consequently, an unauthenticated malformed token can cause a request-level failure and HTTP 500. This issue is fixed in version 2.14.0.
A flaw was found in PyJWT. An unauthenticated remote attacker could trigger a Denial of Service (DoS) condition by supplying a specially crafted JSON Web Token (JWT) with deeply nested headers during decoding. Processing these nested structures causes an uncaught recurs
GHSA
PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header
ghsa·2026-09-29
CVE-2026-102265 [MEDIUM] CWE-674 PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header
PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header
## Package
pyjwt (PyPI)
## Affected versions
tested & verified on: 2.13.0. Every version whose `PyJWS._load()` translates only `ValueError` is affected
## Description
`PyJWS._looad()` (`jwt/api_jws.py:337`) splits the compact token, base64url decodes the header segment and hands it to `json.loads()` before `_verify_signature()` runs. The parse is wrapped in `except ValueError as e: raise DecodeError(...)`. That is what makes the documented contract sufficient for untrusted input: `except jwt.PyJWTError` (or `InvalidTokenError`) around `jwt.decode(token, key, algorithms=[...])`.
CPython's JSON decoder raises `RecursionError` (a `RuntimeError` subclass, not a `ValueError`) once nesting crosses the native stac
VulDB
jpadilla PyJWT up to 2.13.x JWS Loading jwt/api_jws.py PyJWS._load recursion
vuldb·2026-09-28·CVSS 5.3
CVE-2026-102265 [MEDIUM] jpadilla PyJWT up to 2.13.x JWS Loading jwt/api_jws.py PyJWS._load recursion
A vulnerability described as problematic has been identified in jpadilla PyJWT up to 2.13.x. Affected by this issue is the function PyJWS._load of the file jwt/api_jws.py of the component JWS Loading. The manipulation results in uncontrolled recursion.
This vulnerability is reported as CVE-2026-102265. The attack can be launched remotely. No exploit exists.
Upgrading the affected component is recommended.
No detection rules found.
No public exploits indexed.
2026-09-28
Published