Uncontrolled Recursion in pyjwt - #VU150521
Published: September 17, 2026
Vulnerability identifier: #VU150521
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-674
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in the PyJWS._load() header JSON parsing path when processing a compact token with a deeply nested JSON header. A remote attacker can send an unsigned crafted token to cause a denial of service.
The header is parsed before signature verification, and the resulting exception can bypass applications\' normal PyJWT error handling.
Affected software
pyjwt
Remediation
Install security update from vendor's website.
pyjwt - update to 2.14.0