A flaw was found in PyJWT. When processing a JSON Web Token (JWT) prior to signature verification, the parser fails to properly handle deeply nested data, leading to an unhandled recursion error. A remote unauthenticated attacker could exploit this flaw by submitting a specially crafted token, causing the application to raise an unexpected server exception and resulting in a Denial of Service (DoS).
Last checked: 2026-10-07 21:10 UTC
Proof of concept · CISA Coordinator (Assessed 2026-09-29 13:55 UTC)
Exploit reference · [email protected] · View external evidence (Observed 2026-10-07 21:10 UTC)
Fix evidence last checked: 2026-10-20 19:37 UTC
Ubuntu 22.04 LTS (Jammy Jellyfish)
USN-8934-1 · Published 2026-10-19
Ubuntu 24.04 LTS (Noble Numbat)
USN-8934-1 · Published 2026-10-19
Ubuntu 26.04 LTS (Resolute Raccoon)
USN-8934-1 · Published 2026-10-19
Ubuntu 26.10 (Stonking Stingray)
USN-8934-1 · Published 2026-10-19