Description
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS._load in jwt/api_jws.py is affected because parser catches ValueError but not RecursionError. This occurs when a deeply nested token header reaches json.loads. As a result, RecursionError escapes the documented PyJWT error hierarchy. Consequently, an unauthenticated malformed token can cause a request-level failure and HTTP 500. This issue is fixed in version 2.14.0.
Published: 2026-09-28
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch Package
AI Analysis

Impact

The vulnerability is an uncaught RecursionError in jwt.decode() that the library’s error handling fails to catch. An attacker can send a token with a deeply nested header, causing json.loads to raise a RecursionError that propagates outside the documented PyJWT error hierarchy. The result is a request‑level failure that manifests as an HTTP 500 error. This flaw is identified as CWE‑248 (Uncaught RecursionError), allowing an unauthenticated user to disrupt service.

Affected Systems

The affected product is PyJWT, versions 2.13.0 through just before 2.14.0. Any deployment that has not yet applied the 2.14.0 fix is vulnerable.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The EPSS score is <1%, reflecting a low probability of exploitation. This issue is not listed in the CISA KEV catalog. The most likely attack vector is an unauthenticated attacker sending a malformed deeply nested token to an application that decodes it. No privileged access is required, but the attack can cause application crashes and a denial of service.

Generated by OpenCVE AI on September 30, 2026 at 04:38 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade PyJWT to version 2.14.0 or later
  • Implement input validation to reject token headers that exceed a safe nesting depth before decoding
  • Configure the JSON parser to enforce a maximum nesting depth to prevent recursion errors from causing application crashes

Generated by OpenCVE AI on September 30, 2026 at 04:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-8wjv-2p76-3863 PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header
History

Wed, 07 Oct 2026 21:15:00 +0000

Type Values Removed Values Added
First Time appeared Pyjwt Project
Pyjwt Project pyjwt
CPEs cpe:2.3:a:pyjwt_project:pyjwt:2.13.0:*:*:*:*:*:*:*
Vendors & Products Pyjwt Project
Pyjwt Project pyjwt

Thu, 01 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-248
References
Metrics threat_severity

None

 threat_severity

Moderate

Mon, 28 Sep 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Jpadilla
Jpadilla pyjwt
Vendors & Products Jpadilla
Jpadilla pyjwt

Mon, 28 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Description PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS._load in jwt/api_jws.py is affected because parser catches ValueError but not RecursionError. This occurs when a deeply nested token header reaches json.loads. As a result, RecursionError escapes the documented PyJWT error hierarchy. Consequently, an unauthenticated malformed token can cause a request-level failure and HTTP 500. This issue is fixed in version 2.14.0.
Title PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header
Weaknesses CWE-674
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Jpadilla Pyjwt
Pyjwt Project Pyjwt
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-01T15:01:31.377Z

Reserved: 2026-09-28T20:11:16.658Z

Link: CVE-2026-102265

cve-icon Vulnrichment

Updated: 2026-10-01T15:01:19.632Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-28T21:17:14.077

Modified: 2026-10-07T20:57:14.290

Link: CVE-2026-102265

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-28T20:48:04Z

Links: CVE-2026-102265 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T04:45:19Z

Weaknesses