{"uuid": "d172fd16-5589-485c-afa2-ea3258a5afe1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-102274", "type": "seen", "source": "https://gist.github.com/alon710/07bd1d4c1cf2f6ee50af1c55a6054731", "content": "# CVE-2026-102274: CVE-2026-102274: Denial of Service via Unhandled Exception in PyJWT JWK Set Parser\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-09-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-102274\n\n## Summary\nA vulnerability in PyJWT's JWK Set parsing logic allows a malformed RSA key to trigger an unhandled ValueError, leading to an application-wide or request-level Denial of Service.\n\n## TL;DR\nAn unhandled ValueError during RSA key recovery in PyJWT (2.9.0 - 2.13.0) crashes the entire JWK Set parser, allowing attackers to trigger a Denial of Service via malformed keys.\n\n## Technical Details\n\n- **CWE ID**: CWE-755\n- **Attack Vector**: Network\n- **CVSS Score**: 5.9 (Medium)\n- **EPSS Score**: 0.00352 (Percentile: 26.40%)\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications using PyJWT versions 2.9.0 through 2.13.0 that process JSON Web Key Sets (JWKS).\n- **pyjwt**: >= 2.9.0, < 2.14.0 (Fixed in: `2.14.0`)\n\n## Mitigation\n\n- Upgrade PyJWT to version 2.14.0 or higher.\n- Restrict JWK Set resolution to trusted, hardcoded Identity Providers.\n- Implement application-level error catching for parsing routines.\n\n**Remediation Steps:**\n1. Identify vulnerable PyJWT installations using SCA tools or pip show.\n2. Update dependency declarations in requirements.txt or pyproject.toml to pyjwt>=2.14.0.\n3. Rebuild and redeploy application containers or virtual environments.\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-102274) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-29T22:30:29.000000Z"}