PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)

SummaryPyJWKClient.getsigningkeyfromjwttoken — the first step of the JWKSverification flow documented in docs/usage.rst — must decode a token'spayload before its signature can be checked, viajwt.apijwt.decodecompletetoken, options="verifysignature": False.That call parses the payload with...

PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header

Packagepyjwt PyPI Affected versionstested & verified on: 2.13.0. Every version whose PyJWS.load translates only ValueError is affected DescriptionPyJWS.looad jwt/apijws.py:337 splits the compact token, base64url decodes the header segment and hands it to json.loads before verifysignature runs. Th...

PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)

Summary PyJWKClient.getsigningkeyfromjwttoken — the first step of the JWKS verification flow documented in docs/usage.rst — must decode a token's payload before its signature can be checked, via jwt.apijwt.decodecompletetoken, options="verifysignature": False. That call parses the payload with...

EUVD-2026-88479

PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse PyJWKClient.getsigningkeyfromjwt / verifysignature=False...

GHSA-42VR-XJ54-VC7V PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)

Summary PyJWKClient.getsigningkeyfromjwttoken — the first step of the JWKS verification flow documented in docs/usage.rst — must decode a token's payload before its signature can be checked, via jwt.apijwt.decodecompletetoken, options="verifysignature": False. That call parses the payload with...

Linux Distros Unpatched Vulnerability : CVE-2026-101918

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.getsigningkeyfromjwt is affected because payload pars...

Linux Distros Unpatched Vulnerability : CVE-2026-102265

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS.load in jwt/apijws.py is affected because parser catches ValueErro...

PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header

Package pyjwt PyPI Affected versions tested & verified on: 2.13.0. Every version whose PyJWS.load translates only ValueError is affected Description PyJWS.looad jwt/apijws.py:337 splits the compact token, base64url decodes the header segment and hands it to json.loads before verifysignature runs...

GHSA-8WJV-2P76-3863 PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header

Package pyjwt PyPI Affected versions tested & verified on: 2.13.0. Every version whose PyJWS.load translates only ValueError is affected Description PyJWS.looad jwt/apijws.py:337 splits the compact token, base64url decodes the header segment and hands it to json.loads before verifysignature runs...

Security Bulletin: EDB Postgres AI Database with IBM is affected by Multiple Vulnerabilities.

Summary Multiple Vulnerabilities found in EDB PGAI database products. Hence, IBM strongly recommends upgrading to 18.6 Vulnerability Details CVEID:CVE-2026-30922 DESCRIPTION: pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the pyasn1 library is vulnerable to a Denial of Service DoS...

CVE-2026-442_

CVE protobuf.js CVE-2026-44289, CVE-2026-44290, CVE-2026-44291, CVE-2026-44292, CVE-2026-44294, CVE-2026-44295 - protobuf.js ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testin...

Uncontrolled Recursion

Overview PyJWT is a Python implementation of RFC 7519. Affected versions of this package are vulnerable to Uncontrolled Recursion via the load method in jwt/apijws.py when parsing a JWT with a deeply nested recursive JSON structure in the header. An attacker can supply a JWT whose header contains...

Uncaught Exception

Overview PyJWT is a Python implementation of RFC 7519. Affected versions of this package are vulnerable to Uncaught Exception via decodepayload in jwt/apijwt.py, where a JWT token containing a deeply nested JSON payload triggers an unhandled RecursionError during json.loads parsing. An attacker c...

AZL-105230 CVE-2026-102265 affecting package python-jwt 2.13.0-1

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS.load in jwt/apijws.py is affected because parser catches ValueError but not RecursionError. This occurs when a deeply nested token header reaches json.loads. As a result, RecursionError escapes the...

DEBIAN-CVE-2026-102265

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS.load in jwt/apijws.py is affected because parser catches ValueError but not RecursionError. This occurs when a deeply nested token header reaches json.loads. As a result, RecursionError escapes the...

CVE-2026-102265

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS.load in jwt/apijws.py is affected because parser catches ValueError but not RecursionError. This occurs when a deeply nested token header reaches json.loads. As a result, RecursionError escapes the...

DEBIAN-CVE-2026-101918

PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.getsigningkeyfromjwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a...

AZL-105218 CVE-2026-101918 affecting package python-jwt 2.13.0-1

PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.getsigningkeyfromjwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a...

CVE-2026-101918

PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.getsigningkeyfromjwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a...

UBUNTU-CVE-2026-102265

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS.load in jwt/apijws.py is affected because parser catches ValueError but not RecursionError. This occurs when a deeply nested token header reaches json.loads. As a result, RecursionError escapes the...