PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS

🗓️ 24 Jul 2026 08:02:10Reported by MicrosoftType

mscve🔗 msrc.microsoft.com👁 6 Views

Unauthenticated DoS in PyJWT from unbounded Base64URL decoding of unused payload in detached JWS.

Reporter	Title	Published	Views	Family All 122
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.2.0	30 Jun 202616:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses multiple dependencies which are vulnerable to multiple CVEs.	30 Jul 202615:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses multiple dependencies which are vulnerable to multiple CVEs.	30 Jul 202615:32	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities found in Watson Data Intelligence	18 Aug 202608:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerabilities in pyjwt-2.12.1-py3-none-any.whl	17 Jun 202615:32	–	ibm
IBM Security Bulletins	Security Bulletin: Investigation Assistant App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	23 Jul 202613:08	–	ibm
IBM Security Bulletins	Security Bulletin:PyJWT CVE-2023-40254: Local File Inclusion & Server-Side Request Forgery via PyJWKClient uri Argument	4 Aug 202609:56	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.	30 Jun 202607:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.0) is affected by multiple vulnerabilities due to PyJWT	15 Jul 202606:08	–	ibm
ATTACKERKB	CVE-2026-48525	28 May 202615:11	–	attackerkb

Vulners

Node

microsoft azl3_python-jwt_2.8.0-2Range<2.13.0-1

07 Aug 2026 21:48Current

5Medium risk

Vulners AI Score5

CVSS 3.15.3

EPSS0.0037

Python Web Token Denial of Service Base64URL decoding Detached signature