CVE-2026-102270
published 2026-09-28CVE-2026-102270: PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT is_pem_format is affected because lazy PEM regular expression backtracks…
PriorityP424medium4.9CVSS 3.1
AVNACLPRHUINSUCNINAH
EPSS
0.21%
10.7th percentile
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT is_pem_format is affected because lazy PEM regular expression backtracks extensively. This occurs when a certificate-like input contains repeated BEGIN markers without a matching END marker. As a result, is_pem_format performs unbounded backtracking while searching for a PEM end marker. Consequently, an attacker can cause intensive CPU consumption. This issue is fixed in version 2.14.0.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jpadilla | pyjwt | < 2.14.0 | 2.14.0 |
| pyjwt_project | pyjwt | < 2.14.0 | 2.14.0 |
| pyjwt_project | pyjwt | >= 0 < 2.14.0 | 2.14.0 |
CVSS provenance
nvdv3.14.9MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
vendor_redhat4.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format
vendor_redhat·2026-09-28·CVSS 4.4
CVE-2026-102270 [MEDIUM] CWE-1333 pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format
pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT is_pem_format is affected because lazy PEM regular expression backtracks extensively. This occurs when a certificate-like input contains repeated BEGIN markers without a matching END marker. As a result, is_pem_format performs unbounded backtracking while searching for a PEM end marker. Consequently, an attacker can cause intensive CPU consumption. This issue is fixed in version 2.14.0.
A flaw was found in PyJWT. An attacker can cause a Denial of Service (DoS) by providing crafted certificate-like input containing repeated start markers without matching end markers. This malformed input triggers excessive regular express
GHSA
PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.
ghsa·2026-09-30
CVE-2026-102270 [MEDIUM] CWE-1333 PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.
PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.
### Summary
There is a Re-DoS vulnerability in the `is_pem_format` function which results in a intesive CPU usage if an attacker is been able to provide a custom certificate.
### Details
The problem is that the lazy quantifier `.+?` will always first try to match as little as possible until it finds a `---- END`. Normally this means the complexity of this should be O(N). However, by providing an input which consists only of `----BEGIN CERTIFICATE-----` lines and no `---- END` line, the regex algorithm will first try to match the first line and then, with the lazy quantifier, all the lines until the end O(N), which then fails since it is unable to find a `---- END` line. It will then jump to the next line, resulting in
VulDB
PyJWT up to 2.13.x Pem Format Checking is_pem_format incorrect regex
vuldb·2026-09-28·CVSS 4.4
CVE-2026-102270 [MEDIUM] PyJWT up to 2.13.x Pem Format Checking is_pem_format incorrect regex
A vulnerability was found in PyJWT up to 2.13.x. It has been declared as problematic. The affected element is the function is_pem_format of the component Pem Format Checking. The manipulation results in incorrect regular expression.
This vulnerability is identified as CVE-2026-102270. The attack can be executed remotely. There is not any exploit available.
It is recommended to upgrade the affected component.
No detection rules found.
No public exploits indexed.
2026-09-28
Published