CVE-2026-102270: PyJWT ReDoS Vulnerability in is_pem_format Function
Summary
CVE-2026-102270: PyJWT: ReDoS vulnerability when calling the is_pem_format function. Affects pyjwt versions < 2.14.0. Fixed in 2.14.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PyJWT is a Python library that allows for the encoding and decoding of JSON Web Tokens (JWT). It is widely used for secure token-based authentication in web applications. The library provides various features, including support for different signing algorithms and the ability to handle token expiration. However, a vulnerability has been identified in the is_pem_format function, which can lead to excessive CPU usage under certain conditions, making it susceptible to denial-of-service attacks.
Vulnerability Detail
The vulnerability arises from a ReDoS (Regular Expression Denial of Service) issue in the is_pem_format function. This function uses a regex pattern that employs a lazy quantifier, which can lead to quadratic time complexity when processing specially crafted input. An attacker can exploit this by providing a custom certificate that consists solely of '-----BEGIN CERTIFICATE-----' lines without a corresponding '-----END CERTIFICATE-----' line. This results in the regex engine performing multiple rescans of the input, causing significant CPU resource consumption and potentially leading to service unavailability.
How To Fix
Latest published version: 2.15.1 as of 23 Oct 2026
pip install --upgrade "pyjwt==2.15.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.14.0
This is the first release that contains the fix.
pip install --upgrade "pyjwt==2.14.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid passing untrusted or attacker-controlled key or certificate bytes to the PyJWT's key preparation functions until you can update to the patched version. Additionally, you can implement input validation to ensure that only properly formatted certificates are processed.
Conclusion
The CVE-2026-102270 vulnerability in the PyJWT library poses a significant risk due to its potential for causing denial-of-service attacks through excessive CPU usage. It is crucial for users of the library to update to version 2.14.0 or later to mitigate this risk. Additionally, employing input validation can help protect against exploitation until the update is applied.
See every vulnerability recorded for pyjwt →
FAQ
ReDoS stands for Regular Expression Denial of Service. It occurs when an attacker exploits a poorly designed regex pattern, causing excessive resource consumption and potentially leading to service downtime.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to test your application without needing to sign up.
The primary impact is resource exhaustion, which can make the affected service unavailable to legitimate users, leading to denial-of-service conditions.
Yes, a patch is available in PyJWT version 2.14.0 and later. It is recommended to upgrade to this version to mitigate the vulnerability.
If you cannot update immediately, ensure that you do not pass untrusted input to the affected functions and implement input validation as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for pyjwt.
