CVE-2026-102265

MEDIUM 5.3

PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS._load in jwt/api_jws.py is affected because parser catches ValueError but not RecursionError. This occurs when a deeply nested token header reaches json.loads. As a result, RecursionError escapes the documented PyJWT error hierarchy. Consequently, an unauthenticated malformed token can cause a request-level failure and HTTP 500. This issue is fixed in version 2.14.0.

CWE	CWE-674
Vendor	jpadilla
Product	pyjwt
Published	Sep 28, 2026

Stay Ahead of the Next One

Get instant alerts for jpadilla pyjwt

Be the first to know when new medium vulnerabilities affecting jpadilla pyjwt are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Affected Versions

jpadilla / pyjwt

>= 2.13.0, < 2.14.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863 github.com: https://github.com/jpadilla/pyjwt/commit/06573692ebcdec8831c3927513b3e87c31fbbb62 github.com: https://github.com/jpadilla/pyjwt/releases/tag/2.14.0