Denial of Service Vulnerability in PyJWT by Jpadilla
CVE-2026-102270

4.4MEDIUM

Key Information:

Vendor

Jpadilla

Status
Pyjwt
Vendor
CVE Published:
28 September 2026

What is CVE-2026-102270?

The is_pem_format function in PyJWT prior to version 2.14.0 is susceptible to a denial of service vulnerability. This occurs due to excessive backtracking when processing malformed certificate-like inputs that contain repeated BEGIN markers without corresponding END markers. As a result, attackers can exploit this vulnerability to cause significant CPU consumption, which can degrade application performance or render services unavailable. Users are urged to upgrade to version 2.14.0 or later to mitigate this issue.

Affected Version(s)

pyjwt < 2.14.0

References

https://github.com/jpadilla/pyjwt/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34...
x_refsource_MISC
https://github.com/jpadilla/pyjwt/releases/tag/2.14.0
x_refsource_MISC

CVSS V3.1

Score:
4.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.