A flaw was found in PyJWT. When processing a JSON Web Token (JWT) prior to signature verification, the parser fails to properly handle deeply nested data, leading to an unhandled recursion error. A remote unauthenticated attacker could exploit this flaw by submitting a specially crafted token, causing the application to raise an unexpected server exception and resulting in a Denial of Service (DoS).
Last checked: 2026-09-30 21:40 UTC
Proof of concept · CISA Coordinator (Assessed 2026-09-29 13:55 UTC)
Fix evidence last checked: 2026-09-28 22:07 UTC