What’s Vulnerable › Vulnerabilities

CVE-2026-102270: PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.

• Severity: medium (CVSS 4.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-09-28 · updated 2026-10-06
• Weakness: CWE-1333

Description

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT is_pem_format is affected because lazy PEM regular expression backtracks extensively. This occurs when a certificate-like input contains repeated BEGIN markers without a matching END marker. As a result, is_pem_format performs unbounded backtracking while searching for a PEM end marker. Consequently, an attacker can cause intensive CPU consumption. This issue is fixed in version 2.14.0.

Affected products

• jpadilla pyjwt: before 2.14.0 — fixed in 2.14.0

How to fix

Upgrade to a fixed version: jpadilla pyjwt 2.14.0. Check the vendor advisory for mitigations.

References

• https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07
• https://github.com/jpadilla/pyjwt/releases/tag/2.14.0
• https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jwrc-g2q2-pq5p
• https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jwrc-g2q2-pq5p

Get alerted when CVE-2026-102270 or the next vulnerability affects your stack