CVE-2026-101918

A flaw was found in PyJWT. When processing a JSON Web Token (JWT) prior to signature verification, the parser fails to properly handle deeply nested data, leading to an unhandled recursion error. A remote unauthenticated attacker could exploit this flaw by submitting a specially crafted token, causing the application to raise an unexpected server exception and resulting in a Denial of Service (DoS).

This vulnerability is rated as Moderate impact because an unauthenticated remote attacker can cause a denial of service at the request level without resulting in process termination, persistent resource exhaustion, or authentication bypass. In Red Hat environments, applications utilizing PyJWT are primarily exposed when processing untrusted JSON Web Tokens through pre-verification decoding routines or automated key retrieval mechanisms. Standard token validation workflows that enforce signature verification prior to payload parsing remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.