CVE-2026-101918: PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)

Published Sep 28, 2026
·
Updated

PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.getsigningkeyfromjwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a result, documented PyJWT exception handling does not contain the failure. Consequently, an unauthenticated request can raise an exception that may produce an HTTP 500 response. The advisory-defined affected implementation also includes jwt/apijwt.py, verifysignature=False. This issue is fixed in version 2.15.0.

Affected Software

1 affected component
pypi/pyjwt>=2.0.0a1<2.15.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade PyJWT to a version that resolves this vulnerability.

    Fixed in 2.15.0

Event History

Sep 28, 2026
CVE Published
via MITRE·08:11 PM
Data Sourced
via MITRE·08:11 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:17 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Which application paths are exposed?

Applications are exposed where untrusted JWTs are passed to PyJWKClient.get_signing_key_from_jwt, or where the affected jwt/api_jwt.py path is used with verify_signature=False. Versions from 2.0.0a1 through 2.15.0 are identified as affected by the advisory.

2

What must an attacker provide to trigger the denial of service?

An attacker only needs to submit an attacker-controlled JWT containing a recursively nested payload that reaches json.loads before signature verification. No authentication or user interaction is required.

3

What is the practical failure mode?

The malformed payload can raise an unhandled RecursionError because the payload parser catches ValueError but not RecursionError. In a web application, this may result in an HTTP 500 response and denial of service for the affected request path.

4

What version addresses the issue?

The issue is fixed in PyJWT version 2.15.0.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203