{"uuid": "57e73fa1-1a90-4af2-9d6b-b6b961d4d9ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-102265", "type": "seen", "source": "https://gist.github.com/alon710/f6dca5418926a6ce4c4f68d94001f804", "content": "# CVE-2026-102265: CVE-2026-102265: Unhandled RecursionError in PyJWT JSON Parser Leading to Denial of Service\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-09-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-102265\n\n## Summary\nAn uncontrolled recursion vulnerability exists in PyJWT from version 2.13.0 to 2.14.0. The vulnerability allows remote, unauthenticated attackers to cause a Denial of Service (DoS) via crafted JWT headers that trigger stack exhaustion during JSON decoding.\n\n## TL;DR\nPyJWT fails to catch RecursionError during JSON header parsing, allowing remote attackers to crash request-handling threads with malformed JWTs.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-674 (Uncontrolled Recursion)\n- **Attack Vector**: Network\n- **CVSS Score**: 5.3 (Medium)\n- **EPSS Score**: 0.00291 (0.29%)\n- **Exploit Status**: Proof of Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications utilizing PyJWT versions between 2.13.0 (inclusive) and 2.14.0 (exclusive) for JWT validation.\n- **PyJWT**: >= 2.13.0, < 2.14.0 (Fixed in: `2.14.0`)\n\n## Mitigation\n\n- Upgrade PyJWT to version 2.14.0 or later to patch the exception handling logic.\n- Configure Web Application Firewalls (WAF) to filter out requests containing excessive nested bracket characters in HTTP headers.\n- Add application-level token validation middleware to check the complexity and size of JWT segments prior to decoding.\n\n**Remediation Steps:**\n1. Identify all Python environments running PyJWT version 2.13.0.\n2. Update the package using pip: pip install --upgrade pyjwt>=2.14.0.\n3. Verify the installed version using: python -c \"import jwt; print(jwt.__version__)\".\n4. Restart dependent application servers or container pods to ensure the new library code is loaded.\n\n## References\n\n- [GitHub Security Advisory GHSA-8wjv-2p76-3863](https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863)\n- [Fix Commit: Handle recursive JWS headers as decode errors](https://github.com/jpadilla/pyjwt/commit/06573692ebcdec8831c3927513b3e87c31fbbb62)\n- [CVE-2026-102265 Record (CVE.org)](https://www.cve.org/CVERecord?id=CVE-2026-102265)\n- [NVD CVE-2026-102265 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-102265)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-102265) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-30T14:30:31.000000Z"}