CVE-2026-101918: PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)
PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.getsigningkeyfromjwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a result, documented PyJWT exception handling does not contain the failure. Consequently, an unauthenticated request can raise an exception that may produce an HTTP 500 response. The advisory-defined affected implementation also includes jwt/apijwt.py, verifysignature=False. This issue is fixed in version 2.15.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PyJWTto a version that resolves this vulnerability.Fixed in 2.15.0
Event History
Frequently Asked Questions
Which application paths are exposed?
Applications are exposed where untrusted JWTs are passed to PyJWKClient.get_signing_key_from_jwt, or where the affected jwt/api_jwt.py path is used with verify_signature=False. Versions from 2.0.0a1 through 2.15.0 are identified as affected by the advisory.
What must an attacker provide to trigger the denial of service?
An attacker only needs to submit an attacker-controlled JWT containing a recursively nested payload that reaches json.loads before signature verification. No authentication or user interaction is required.
What is the practical failure mode?
The malformed payload can raise an unhandled RecursionError because the payload parser catches ValueError but not RecursionError. In a web application, this may result in an HTTP 500 response and denial of service for the affected request path.
What version addresses the issue?
The issue is fixed in PyJWT version 2.15.0.