CVE-2026-101917: Allocation of Resources Without Limits or Throttling

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT getsigningkeyfromjwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or...

CVE-2026-102265: Uncontrolled Recursion

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS.load in jwt/apijws.py is affected because parser catches ValueError but not RecursionError. This occurs when a deeply nested token header reaches json.loads. As a result, RecursionError escapes the...

PT-2026-102361

Name of the Vulnerable Software and Affected Versions PyJWT versions prior to 2.14.0 Description PyJWT is a Python implementation of JSON Web Token standards. The signature segment decoding process accepts characters outside the canonical Base64URL representation when non-Base64URL characters are...

PT-2026-102348

Name of the Vulnerable Software and Affected Versions PyJWT versions 2.0.0a1 through 2.14.9 Description The PyJWKClient.get signing key from jwt function and the jwt/api jwt.py implementation when verify signature=False are affected by an issue where the payload parser catches ValueError but fail...

PT-2026-102365

Name of the Vulnerable Software and Affected Versions PyJWT versions 2.13.0 through 2.13.x Description The HMACAlgorithm.prepare key function is affected because the HMAC key guard only recognizes top-level public JSON Web Key JWK forms and fails to identify container representations. This occurs...

PT-2026-102362

Name of the Vulnerable Software and Affected Versions PyJWT versions prior to 2.14.0 Description The is pem format function is affected by a regular expression issue where lazy PEM processing causes extensive backtracking. This happens when input resembling a certificate contains repeated BEGIN...

PT-2026-102359

Name of the Vulnerable Software and Affected Versions PyJWT versions prior to 2.14.0 Description The PyJWKClient component fails to revalidate redirect destinations against the JWKS trust boundary. When a trusted JWKS endpoint returns a redirect influenced by an attacker, the client follows it an...

USN-8823-1: PyJWT vulnerabilities

It was discovered that PyJWT incorrectly handled certain URIs when using PyJWKClient. A remote attacker could possibly use this issue to perform server-side request forgery SSRF or expose sensitive local files. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS...

USN-8823-1 pyjwt vulnerabilities

It was discovered that PyJWT incorrectly handled certain URIs when using PyJWKClient. A remote attacker could possibly use this issue to perform server-side request forgery SSRF or expose sensitive local files. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-jwt (UTSA-2026-054077)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054077 advisory. PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the...

EulerOS 2.0 SP10 : python-jwt (EulerOS-SA-2026-3714)

According to the versions of the python-jwt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC...

SUSE CVE-2026-32597

PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC 7515 4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting...

PT-2026-102374

Name of the Vulnerable Software and Affected Versions PyJWT versions 2.1.0 through 2.14.0 Description The OKPAlgorithm.from jwk function in jwt/algorithms.py fails to compare the public key derived from d with x during the private-JWK import process. This occurs when an OKP private JWK provides...

CVE-2026-102270

creationtimestamp| type| source ---|---|--- 2026-09-11 14:20:50+00:00| published-proof-of-concept| https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jwrc-g2q2-pq5p...

CVE-2026-102266

creationtimestamp| type| source ---|---|--- 2026-09-11 14:20:49+00:00| published-proof-of-concept| https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9j54-fg26-wv3r 2026-09-30 13:30:31+00:00| seen| https://gist.github.com/alon710/021c63a7b1d8134c56a782a255bf9e1a...

CVE-2026-102265

creationtimestamp| type| source ---|---|--- 2026-09-11 13:37:22+00:00| published-proof-of-concept| https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863 2026-09-30 14:30:31+00:00| seen| https://gist.github.com/alon710/f6dca5418926a6ce4c4f68d94001f804...

CVE-2026-102271

creationtimestamp| type| source ---|---|--- 2026-09-11 13:37:21+00:00| published-proof-of-concept| https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773...

CVE-2026-102272

creationtimestamp| type| source ---|---|--- 2026-09-11 13:35:57+00:00| published-proof-of-concept| https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947...

PT-2026-102347

Name of the Vulnerable Software and Affected Versions PyJWT versions prior to 2.14.0 Description The get signing key from jwt function is affected by a flaw where unknown kid Key ID values trigger forced refreshes of the JSON Web Key Set JWKS without a negative cache or minimum refresh interval...

PT-2026-102363

Name of the Vulnerable Software and Affected Versions PyJWT versions 2.4.0 through 2.13.x Description The HMACAlgorithm.prepare key function is affected because the asymmetric-key guard relies on textual markers that are absent from DER Distinguished Encoding Rules encoding. This occurs when an...