https://vulnerability.circl.lu/sightings/feed 2026-09-30T20:00:21.928951+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/57e73fa1-1a90-4af2-9d6b-b6b961d4d9ac/export 2026-09-30T20:00:21.959722+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "57e73fa1-1a90-4af2-9d6b-b6b961d4d9ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-102265", "type": "seen", "source": "https://gist.github.com/alon710/f6dca5418926a6ce4c4f68d94001f804", "content": "# CVE-2026-102265: CVE-2026-102265: Unhandled RecursionError in PyJWT JSON Parser Leading to Denial of Service\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-09-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-102265\n\n## Summary\nAn uncontrolled recursion vulnerability exists in PyJWT from version 2.13.0 to 2.14.0. The vulnerability allows remote, unauthenticated attackers to cause a Denial of Service (DoS) via crafted JWT headers that trigger stack exhaustion during JSON decoding.\n\n## TL;DR\nPyJWT fails to catch RecursionError during JSON header parsing, allowing remote attackers to crash request-handling threads with malformed JWTs.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-674 (Uncontrolled Recursion)\n- **Attack Vector**: Network\n- **CVSS Score**: 5.3 (Medium)\n- **EPSS Score**: 0.00291 (0.29%)\n- **Exploit Status**: Proof of Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications utilizing PyJWT versions between 2.13.0 (inclusive) and 2.14.0 (exclusive) for JWT validation.\n- **PyJWT**: >= 2.13.0, < 2.14.0 (Fixed in: `2.14.0`)\n\n## Mitigation\n\n- Upgrade PyJWT to version 2.14.0 or later to patch the exception handling logic.\n- Configure Web Application Firewalls (WAF) to filter out requests containing excessive nested bracket characters in HTTP headers.\n- Add application-level token validation middleware to check the complexity and size of JWT segments prior to decoding.\n\n**Remediation Steps:**\n1. Identify all Python environments running PyJWT version 2.13.0.\n2. Update the package using pip: pip install --upgrade pyjwt>=2.14.0.\n3. Verify the installed version using: python -c \"import jwt; print(jwt.__version__)\".\n4. Restart dependent application servers or container pods to ensure the new library code is loaded.\n\n## References\n\n- [GitHub Security Advisory GHSA-8wjv-2p76-3863](https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863)\n- [Fix Commit: Handle recursive JWS headers as decode errors](https://github.com/jpadilla/pyjwt/commit/06573692ebcdec8831c3927513b3e87c31fbbb62)\n- [CVE-2026-102265 Record (CVE.org)](https://www.cve.org/CVERecord?id=CVE-2026-102265)\n- [NVD CVE-2026-102265 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-102265)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-102265) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-30T14:30:31.000000Z"} 2026-09-30T14:30:31+00:00 https://vulnerability.circl.lu/sighting/395c8127-20b7-4798-8e74-091c85d2a222/export 2026-09-30T20:00:21.961234+00:00 Joseph Lee https://cvepremium.circl.lu/user/syspect {"uuid": "395c8127-20b7-4798-8e74-091c85d2a222", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-102265", "type": "published-proof-of-concept", "source": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863", "content": "", "creation_timestamp": "2026-09-11T13:37:22.000000Z"} 2026-09-11T13:37:22+00:00