CVE-2026-102274

A flaw was found in pyjwt. The library fails to properly handle errors when parsing a JSON Web Key (JWK) set that contains a malformed RSA key alongside valid keys. A remote attacker can supply or inject a malformed key to abort the processing of the entire key set, resulting in authentication failures and a Denial of Service (DoS).

This vulnerability is rated as Moderate severity for Red Hat products because an attacker can only cause service disruptions without compromising cryptographic keys or bypassing signature validation. The issue is triggered when an application ingests an untrusted key bundle containing an invalid RSA entry, causing key set processing to terminate prematurely due to an unhandled exception. Because exploitation requires consuming malformed key sets from identity providers and only affects availability rather than enabling unauthorized access, the blast radius is contained.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.