What’s Vulnerable › Vulnerabilities

CVE-2026-102265: PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-09-28 · updated 2026-10-07
• Weakness: CWE-674

Description

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS._load in jwt/api_jws.py is affected because parser catches ValueError but not RecursionError. This occurs when a deeply nested token header reaches json.loads. As a result, RecursionError escapes the documented PyJWT error hierarchy. Consequently, an unauthenticated malformed token can cause a request-level failure and HTTP 500. This issue is fixed in version 2.14.0.

Affected products

• jpadilla pyjwt: 2.13.0

References

• https://github.com/jpadilla/pyjwt/commit/06573692ebcdec8831c3927513b3e87c31fbbb62
• https://github.com/jpadilla/pyjwt/releases/tag/2.14.0
• https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863
• https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863

Get alerted when CVE-2026-102265 or the next vulnerability affects your stack