Description
PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications can experience authentication failures or request-level denial of service. This issue is fixed in version 2.14.0.
Published: 2026-09-28
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Authentication failure or denial of service
Action: Patch
AI Analysis

Impact

PyJWT does not catch a ValueError raised for malformed RSA JWK components when loading a JWK Set, a flaw that can be classified as CWE-248 and CWE-755. A single malformed key member aborts construction of the entire JWK Set, causing applications that rely on this library to fail authentication or experience a request‑level denial of service.

Affected Systems

The vulnerable product is PyJWT, maintained by jpadilla. Versions from 2.9.0 up to, but not including, 2.14.0 are affected.

Risk and Exploitability

The CVSS score of 5.9 indicates moderate severity. The EPSS score is < 1%, indicating a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an actor supplying a malicious JWK Set to an application that uses PyJWT for token validation, which causes the parsing failure and results in authentication failures or request‑level denial of service.

Generated by OpenCVE AI on September 30, 2026 at 04:40 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade PyJWT to version 2.14.0 or later
  • Validate and sanitize JWK Sets to ensure all RSA key components are correctly formatted before processing with PyJWT
  • Monitor authentication logs for failures or denial of service patterns that may indicate JWK parsing errors

Generated by OpenCVE AI on September 30, 2026 at 04:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-w6j9-cwv2-h6wq PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set
History

Tue, 06 Oct 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Pyjwt Project
Pyjwt Project pyjwt
CPEs cpe:2.3:a:pyjwt_project:pyjwt:*:*:*:*:*:*:*:*
Vendors & Products Pyjwt Project
Pyjwt Project pyjwt

Tue, 29 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-248
References
Metrics threat_severity

None

 threat_severity

Moderate

Mon, 28 Sep 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Jpadilla
Jpadilla pyjwt
Vendors & Products Jpadilla
Jpadilla pyjwt

Mon, 28 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Description PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications can experience authentication failures or request-level denial of service. This issue is fixed in version 2.14.0.
Title PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set
Weaknesses CWE-755
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Jpadilla Pyjwt
Pyjwt Project Pyjwt
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-29T19:38:02.520Z

Reserved: 2026-09-28T20:11:16.658Z

Link: CVE-2026-102274

cve-icon Vulnrichment

Updated: 2026-09-29T19:37:56.921Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-28T21:17:15.677

Modified: 2026-10-06T18:25:21.003

Link: CVE-2026-102274

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-28T20:42:28Z

Links: CVE-2026-102274 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T04:45:19Z

Weaknesses
  • CWE-248

    Uncaught Exception

  • CWE-755

    Improper Handling of Exceptional Conditions