The vulnerability exists in the is_pem_format function of PyJWT. A crafted string containing multiple repeated BEGIN markers without a matching END marker triggers excessive backtracking in a lazy PEM regular expression, causing the function to consume excessive CPU time. This results in a denial-of-service condition that can be exploited by an attacker who can supply such input to the application.

Affected versions of PyJWT are those prior to 2.14.0, known for the jpadilla:pyjwt package. Systems that rely on this package for JWT validation or certificate parsing are at risk, including any Python web services or applications that import PyJWT directly. The issue is fixed in PyJWT 2.14.0 and later.

The CVSS score for this vulnerability is 4.4, indicating a moderate severity. No EPSS score is available, and the vulnerability is not present in the CISA KEV list. Attackers must be able to cause the application to call is_pem_format with a malicious string; the actual vector depends on how the application handles JWTs. The impact is primarily resource exhaustion, leading to a denial of service of the affected process.