CVE-2026-102274

Analyzed Analyzed - Analysis Complete

Denial of Service in PyJWT JWKSet Handling

Publication date: 2026-09-28

Last updated on: 2026-10-06

Assigner: GitHub, Inc.

Description

PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications can experience authentication failures or request-level denial of service. This issue is fixed in version 2.14.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-28

Last Modified

2026-10-06

Generated

2026-10-19

AI Q&A

2026-09-29

EPSS Evaluated

2026-10-16

NVD

CVE-2026-102274

EUVD

EUVD-2026-88542

Affected Vendors & Products

Vendor	Product	Version / Range
pyjwt_project	pyjwt	From 2.9.0 (inc) to 2.14.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-755	The product does not handle or incorrectly handles an exceptional condition.

Attack-Flow Graph

Executive Summary

PyJWT versions 2.9.0 to 2.14.0 have a flaw in PyJWKSet where a malformed RSA JWK component raises a ValueError that is not caught. This causes the entire PyJWKSet construction to fail, leading to potential authentication failures or denial of service when processing requests.

Detection Guidance

To detect this vulnerability, check the installed version of PyJWT using pip show PyJWT. If the version is between 2.9.0 and 2.14.0, the system is vulnerable. Test for malformed RSA JWK components by attempting to load a JWK Set with a malformed key and observing if PyJWKSet fails to initialize.

Impact Analysis

This vulnerability can cause applications to fail authentication checks or become unavailable due to denial of service if a malformed RSA key is present in a JWK Set. It may disrupt services relying on JWT validation.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR or HIPAA by causing authentication failures or denial of service in applications handling sensitive data. If authentication is disrupted, it may lead to unauthorized access or service interruptions, violating data protection or availability requirements under these regulations.

Mitigation Strategies

Upgrade PyJWT to version 2.14.0 or later immediately. Use pip install --upgrade PyJWT to apply the fix. Review JWK Sets for malformed RSA keys to prevent authentication failures or denial of service.

Hi! I’m here to help you understand CVE-2026-102274. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70