PyJWT versions 2.8.0 through 2.12.1 perform Base64URL decoding of the middle payload segment of detached JSON Web Signatures even when the payload is later ignored because the token is marked "b64": false. An attacker can supply an arbitrarily large encoding in that segment, causing the library to allocate memory and perform expensive decoding work. The operation fails fast if the signature is invalid, but the required CPU and memory consumption occur before validation, leading to a denial‑of‑service condition for any user who can send requests that include such tokens. This flaw is a classic input validation weakness and is classified as CWE‑400.

The affected product is the Python JSON Web Token library, PyJWT, released by jpadilla. Vulnerable releases are 2.8.0 through 2.12.1. All systems that import and use PyJWT for detached JWS verification and accept "b64": false payloads are impacted.

The CVSS score of 5.3 indicates moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the denial of service without authentication by sending a large Base64URL encoded segment to any endpoint that performs detached JWS verification with PyJWT. The attack does not require compromising other components; it merely exploits the library’s unchecked decoding logic.