CVE-2026-102270 PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.
An attacker can cause excessive CPU consumption and denial of service in applications using PyJWT by providing malformed PEM-like input.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-102270?
CVE-2026-102270 is a medium-severity denial of service vulnerability in jpadilla pyjwt, published on 28 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT is_pem_format is affected because lazy PEM regular expression backtracks extensively. This occurs when a certificate-like input contains repeated BEGIN markers without a matching END marker. As a result, is_pem_format performs unbounded backtracking while searching for a PEM end marker. Consequently, an attacker can cause intensive CPU consumption. This issue is fixed in version 2.14.0.
Weakness: CWE-1333
Which versions are affected by CVE-2026-102270?
3 open source packages ship an affected version, including pyjwt. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pyjwt PyPI | All versions | 2.14.0 |
pyjwt PyPI | All versions | 2.14.0 |
pyjwt PyPI | All versions | 2.14.0 |
Products include Pyjwt Project Pyjwt.
How do I fix CVE-2026-102270?
Upgrade pyjwt to 2.14.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-102270 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-102270 exists.
Other vulnerabilities in jpadilla pyjwt
- CVE-2026-102268 PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
- CVE-2026-32597 PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
- CVE-2026-102266 PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
- CVE-2026-102267 PyJWT: PyJWKClient follows redirects when fetching JWKS
- CVE-2026-102271 PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard
Sources
Also known as AZL-104988, CLEANSTART-2026-IP96561, CLEANSTART-2026-JF42627, DEBIAN-CVE-2026-102270, ECHO-629d-f198-695f, GHSA-jwrc-g2q2-pq5p and 27 more.