CVE-2026-102265

Received Received - Intake

RecursionError in PyJWT Token Parsing Leads to DoS

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: GitHub, Inc.

Description

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS._load in jwt/api_jws.py is affected because parser catches ValueError but not RecursionError. This occurs when a deeply nested token header reaches json.loads. As a result, RecursionError escapes the documented PyJWT error hierarchy. Consequently, an unauthenticated malformed token can cause a request-level failure and HTTP 500. This issue is fixed in version 2.14.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-28

Last Modified

2026-09-28

Generated

2026-09-29

AI Q&A

2026-09-29

EPSS Evaluated

N/A

NVD

CVE-2026-102265

Affected Vendors & Products

Vendor	Product	Version / Range
pyjwt	pyjwt	to 2.14.0 (exc)
pyjwt	pyjwt	2.14.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

Executive Summary

PyJWT versions 2.13.0 to 2.14.0 have a flaw in jwt/api_jws.py where the parser catches ValueError but not RecursionError. When a deeply nested token header triggers json.loads, a RecursionError occurs and escapes the expected error handling. This leads to an unauthenticated malformed token causing HTTP 500 errors.

Detection Guidance

Detecting this vulnerability requires checking the installed version of PyJWT. Run 'pip show PyJWT' or 'pip list | grep PyJWT' to verify if the version is between 2.13.0 and 2.14.0. If so, the system is vulnerable.

Impact Analysis

An attacker could send a specially crafted token to crash the server, causing denial of service. This results in unavailable services and potential downtime for applications relying on PyJWT for authentication.

Compliance Impact

This vulnerability causes HTTP 500 errors due to unhandled RecursionError in token parsing, leading to service disruptions. Such disruptions may violate availability requirements in GDPR and HIPAA, which mandate reliable access to personal or health data.

Mitigation Strategies

Upgrade PyJWT to version 2.14.0 or later using 'pip install --upgrade PyJWT'. If upgrading is not possible, ensure tokens are validated properly and avoid parsing deeply nested headers to prevent RecursionError.

Hi! I’m here to help you understand CVE-2026-102265. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70