python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens

🗓️ 07 Jun 2026 05:26:31Reported by RedHatType

redhat🔗 access.redhat.com👁 8 Views

PyJWT DoS from oversized Base64 URL payloads in detached tokens using unencoded-payload, causing high CPU and memory use.

Reporter	Title	Published	Views	Family All 250
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.2.0	30 Jun 202616:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses multiple dependencies which are vulnerable to multiple CVEs.	30 Jul 202615:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses multiple dependencies which are vulnerable to multiple CVEs.	30 Jul 202615:32	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities found in Watson Data Intelligence	18 Aug 202608:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerabilities in pyjwt-2.12.1-py3-none-any.whl	17 Jun 202615:32	–	ibm
IBM Security Bulletins	Security Bulletin: Investigation Assistant App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	23 Jul 202613:08	–	ibm
IBM Security Bulletins	Security Bulletin:PyJWT CVE-2023-40254: Local File Inclusion & Server-Side Request Forgery via PyJWKClient uri Argument	4 Aug 202609:56	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in watsonx.data	9 Sep 202604:53	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.	30 Jun 202607:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.0) is affected by multiple vulnerabilities due to PyJWT	15 Jul 202606:08	–	ibm

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Hardened Images	20251124	aarch64	clang21	21.1.8-6.hum1	clang21-21.1.8-6.hum1.aarch64.rpm
Red Hat Hardened Images	20251124	x86_64	clang21	21.1.8-6.hum1	clang21-21.1.8-6.hum1.x86_64.rpm
Red Hat Hardened Images	20251124	noarch	llvm21-doc	21.1.8-6.hum1	llvm21-doc-21.1.8-6.hum1.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-48525
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-48525
cve	www.cve.org/CVERecord

13 Jul 2026 05:10Current

6Medium risk

Vulners AI Score6

CVSS 3.15.3

EPSS0.0037

PyJWT Denial of Service Detached tokens Unencoded payload Base64 URL Token verification