CVE-2026-101918

Medium

Description

PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a result, documented PyJWT exception handling does not contain the failure. Consequently, an unauthenticated request can raise an exception that may produce an HTTP 500 response. The advisory-defined affected implementation also includes jwt/api_jwt.py, verify_signature=False. This issue is fixed in version 2.15.0.

SeverityMedium

CVSS5.3

Exploit probability—

ProductPyjwt

PublishedSep 28, 2026

First seenSep 28, 2026

Weakness typeCWE-248CWE-248

How to fix

Update

pyjwt_project pyjwt2.15.0 or later
pyjwt2.15.0 or later

Affected products

Product	Affected versions	Fixed in
pyjwt_project pyjwt	2.0.0 ≤ v < 2.15.0	2.15.0
pyjwtPyPI	2.0.0a1 ≤ v < 2.15.0	2.15.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.