CVE-2026-101918

Analyzed Analyzed - Analysis Complete

PyJWT RecursionError in JWT Payload Parsing

Publication date: 2026-09-28

Last updated on: 2026-10-07

Assigner: GitHub, Inc.

Description

PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a result, documented PyJWT exception handling does not contain the failure. Consequently, an unauthenticated request can raise an exception that may produce an HTTP 500 response. The advisory-defined affected implementation also includes jwt/api_jwt.py, verify_signature=False. This issue is fixed in version 2.15.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-28

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-09-29

EPSS Evaluated

2026-10-18

NVD

CVE-2026-101918

EUVD

EUVD-2026-88479

Affected Vendors & Products

Vendor	Product	Version / Range
pyjwt_project	pyjwt	From 2.0.0 (inc) to 2.15.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-248	An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

Executive Summary

PyJWT versions from 2.0.0a1 to 2.15.0 are vulnerable to a RecursionError due to improper exception handling in PyJWKClient.get_signing_key_from_jwt. When an attacker sends a JWT with a recursively nested payload, the json.loads function triggers a RecursionError which is not caught by the existing ValueError handler. This causes an unauthenticated request to raise an exception leading to an HTTP 500 error.

Detection Guidance

Detecting this vulnerability requires checking the installed PyJWT version. Run pip show PyJWT or pip list | grep PyJWT to verify if the version is below 2.15.0. If so, the system is vulnerable.

Impact Analysis

This vulnerability can cause denial of service by crashing the server with an HTTP 500 error when processing maliciously crafted JWT tokens. It does not directly expose data but disrupts service availability for applications using affected PyJWT versions.

Compliance Impact

This vulnerability primarily impacts service availability and could lead to disruptions in systems handling sensitive data. While it does not directly violate GDPR or HIPAA, repeated service outages due to this issue may affect compliance with availability requirements under these regulations.

Mitigation Strategies

Upgrade PyJWT to version 2.15.0 or later immediately using pip install --upgrade PyJWT. Review applications using PyJWT to ensure they handle exceptions properly and do not expose stack traces.

Hi! I’m here to help you understand CVE-2026-101918. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70