Recursion Error in PyJWT Affects Token Processing
CVE-2026-102265

5.3MEDIUM

Key Information:

Vendor

Jpadilla

Status
Pyjwt
Vendor
CVE Published:
28 September 2026

What is CVE-2026-102265?

The vulnerability in PyJWT affects versions from 2.13.0 to 2.14.0, where the PyJWS._load function does not properly handle RecursionError exceptions. This issue arises when a JSON Web Token with a deeply nested header is processed, leading to potential request-level failures and an HTTP 500 error. An unauthenticated malformed token can exploit this flaw, resulting in significant disruption. The problem has been addressed in version 2.14.0.

Affected Version(s)

pyjwt >= 2.13.0, < 2.14.0

References

https://github.com/jpadilla/pyjwt/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/jpadilla/pyjwt/commit/06573692ebcdec88...
x_refsource_MISC
https://github.com/jpadilla/pyjwt/releases/tag/2.14.0
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.