CVE-2026-101917 PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)
Attackers can cause denial of service by amplifying outbound requests to JWKS endpoints via unknown key IDs in PyJWT.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-101917?
CVE-2026-101917 is a medium-severity denial of service vulnerability in jpadilla pyjwt, published on 28 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or varying kid values absent from the cached JWKS. As a result, each cache miss causes PyJWKClient to refresh the JWKS. Consequently, attacker traffic can amplify outbound requests to the configured JWKS endpoint. This issue is fixed in version 2.14.0.
Weakness: CWE-770
Which versions are affected by CVE-2026-101917?
3 open source packages ship an affected version, including pyjwt. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pyjwt PyPI | All versions | 2.14.0 |
pyjwt PyPI | All versions | 2.14.0 |
pyjwt PyPI | All versions | 2.14.0 |
Products include Pyjwt Project Pyjwt.
How do I fix CVE-2026-101917?
Upgrade pyjwt to 2.14.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-101917 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-101917 exists.
Other vulnerabilities in jpadilla pyjwt
- CVE-2026-102268 PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
- CVE-2026-32597 PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
- CVE-2026-102266 PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
- CVE-2026-102267 PyJWT: PyJWKClient follows redirects when fetching JWKS
- CVE-2026-102271 PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard
Sources
Also known as AZL-104982, CLEANSTART-2026-QR87061, CLEANSTART-2026-UK80240, DEBIAN-CVE-2026-101917, ECHO-4350-3a06-160e, GHSA-2gx3-rcp4-g85q and 27 more.