CVE-2026-102274
published 2026-09-28CVE-2026-102274: PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.39%
31.4th percentile
PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications can experience authentication failures or request-level denial of service. This issue is fixed in version 2.14.0.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jpadilla | pyjwt | — | — |
| pyjwt_project | pyjwt | >= 2.9.0 < 2.14.0 | 2.14.0 |
| pyjwt_project | pyjwt | >= 2.9.0 < 2.14.0 | 2.14.0 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set
ghsa·2026-09-29
CVE-2026-102274 [MEDIUM] CWE-755 PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set
PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set
## Summary
A malformed RSA JWK inside a JWK Set aborts parsing of the entire set instead of being skipped, because `RSAAlgorithm.from_jwk` can raise a plain `ValueError` that isn't caught by `PyJWKSet`'s per-key error-skipping logic.
## Affected component / version
- Package: `PyJWT` (PyPI, ecosystem `pip`)
- Files: `jwt/api_jwk.py` (`PyJWK.__init__`, `PyJWKSet.__init__`), `jwt/algorithms.py` (`RSAAlgorithm.from_jwk`)
- Confirmed present in the `master` branch as of 2026-09-05 (commit `7144e4534c34810f4525dc4578a32addd8212cff`, tag `2.13.0`). Directly verified identical in tags `2.9.0`, `2.10.0`, `2.11.0`, `2.12.0`, `2.12.1`, `2.13.0` -- the vulnerable call and the `except PyJWTError` guard are unchanged across all six releas
VulDB
jpadilla PyJWT up to 2.13.x PyJWKSet jwt/api_jwk.py RSAAlgorithm.from_jwk denial of service
vuldb·2026-09-28·CVSS 5.9
CVE-2026-102274 [MEDIUM] jpadilla PyJWT up to 2.13.x PyJWKSet jwt/api_jwk.py RSAAlgorithm.from_jwk denial of service
A vulnerability classified as problematic was found in jpadilla PyJWT up to 2.13.x. This vulnerability affects the function RSAAlgorithm.from_jwk of the file jwt/api_jwk.py of the component PyJWKSet. Such manipulation leads to denial of service.
This vulnerability is traded as CVE-2026-102274. The attack may be launched remotely. There is no exploit available.
Upgrading the affected component is advised.
Red Hat
pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set
vendor_redhat·2026-09-28·CVSS 5.9
CVE-2026-102274 [MEDIUM] CWE-248 pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set
pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set
PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications can experience authentication failures or request-level denial of service. This issue is fixed in version 2.14.0.
A flaw was found in pyjwt. The library fails to properly handle errors when parsing a JSON Web Key (JWK) set that contains a malformed RSA key alongside valid keys. A remote attacker can supply or inject a mal
No detection rules found.
No public exploits indexed.
2026-09-28
Published