CVE-2026-102270

A flaw was found in PyJWT. An attacker can cause a Denial of Service (DoS) by providing crafted certificate-like input containing repeated start markers without matching end markers. This malformed input triggers excessive regular expression backtracking during validation in the is_pem_format function, consuming high central processing unit (CPU) resources and potentially making the application unresponsive.

This vulnerability is rated as Moderate because although an attacker can trigger CPU exhaustion leading to denial of service, successful exploitation requires an application to accept and parse untrusted, attacker-supplied key or certificate input. In standard Red Hat product configurations, cryptographic verification keys are sourced from trusted local files or managed credential stores rather than arbitrary external inputs. As a result, typical deployments are not directly exposed unless an application explicitly ingests unvalidated key material.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.