PyJWT, the Python implementation of JSON Web Tokens, has a flaw in which the payload parser catches ValueError but not RecursionError. When an attacker supplies a JWT with a deeply nested payload, the recursive expansion causes a RecursionError during json.loads. Because the exception is not caught, an unauthenticated request can raise the error and trigger an HTTP 500 response, resulting in a denial of service that affects application availability but does not expose data or grant further privileges.

The vulnerability impacts the PyJWT library distributed by the jpadilla project, covering all releases from 2.0.0a1 up to and including 2.15.0. Systems that rely on any of these versions for token verification or key retrieval—particularly when the verify_signature flag is set to False or when using PyJWKClient.get_signing_key_from_jwt—are at risk.

The CVSS base score is 5.3, indicating moderate severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, suggesting limited evidence of active exploitation. Attackers can trigger the vulnerability by sending a crafted JWT containing recursive payloads without needing authentication; the resulting RecursionError can cause an HTTP 500 response, temporarily disrupting services. No privilege escalation or data exfiltration is possible, but the DoS impact can be significant in high‑traffic environments.