CVE-2026-101917: CWE-770: Allocation of Resources Without Limits or Throttling in jpadilla pyjwt
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or varying kid values absent from the cached JWKS. As a result, each cache miss causes PyJWKClient to refresh the JWKS. Consequently, attacker traffic can amplify outbound requests to the configured JWKS endpoint. This issue is fixed in version 2.14.0.
AI Analysis
Technical Summary
PyJWT, a Python library for JSON Web Token handling, has a vulnerability (CWE-770) in versions before 2.14.0 where the get_signing_key_from_jwt function does not limit or throttle resource allocation when unknown key IDs cause repeated cache misses. Each cache miss triggers a refresh of the JWKS endpoint via PyJWKClient, allowing an attacker to amplify traffic to the JWKS endpoint by sending unauthenticated tokens with unknown or varying kid values. This can result in excessive outbound requests and potential service disruption. The vulnerability is resolved in PyJWT version 2.14.0.
Potential Impact
The vulnerability allows an attacker to cause PyJWT to repeatedly refresh the JWKS endpoint due to cache misses caused by unknown key IDs in tokens. This can amplify outbound requests to the JWKS endpoint, potentially leading to denial of service or resource exhaustion on the JWKS server or the client system using PyJWT. There is no direct impact on confidentiality or integrity, but availability may be affected.
Mitigation Recommendations
Upgrade PyJWT to version 2.14.0 or later, where this issue is fixed. No other mitigation is indicated by the vendor advisory. Patch status is confirmed as fixed in 2.14.0.
CVE-2026-101917: CWE-770: Allocation of Resources Without Limits or Throttling in jpadilla pyjwt
Description
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or varying kid values absent from the cached JWKS. As a result, each cache miss causes PyJWKClient to refresh the JWKS. Consequently, attacker traffic can amplify outbound requests to the configured JWKS endpoint. This issue is fixed in version 2.14.0.
CVSS v3.1
Score 5.3medium
Affected software
jpadilla
pyjwt
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
PyJWT, a Python library for JSON Web Token handling, has a vulnerability (CWE-770) in versions before 2.14.0 where the get_signing_key_from_jwt function does not limit or throttle resource allocation when unknown key IDs cause repeated cache misses. Each cache miss triggers a refresh of the JWKS endpoint via PyJWKClient, allowing an attacker to amplify traffic to the JWKS endpoint by sending unauthenticated tokens with unknown or varying kid values. This can result in excessive outbound requests and potential service disruption. The vulnerability is resolved in PyJWT version 2.14.0.
Potential Impact
The vulnerability allows an attacker to cause PyJWT to repeatedly refresh the JWKS endpoint due to cache misses caused by unknown key IDs in tokens. This can amplify outbound requests to the JWKS endpoint, potentially leading to denial of service or resource exhaustion on the JWKS server or the client system using PyJWT. There is no direct impact on confidentiality or integrity, but availability may be affected.
Mitigation Recommendations
Upgrade PyJWT to version 2.14.0 or later, where this issue is fixed. No other mitigation is indicated by the vendor advisory. Patch status is confirmed as fixed in 2.14.0.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-09-28T15:55:37.908Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6abacf14f7a7c541062b9a4f
Added to database: 09/28/2026, 20:33:24 UTC
Last enriched: 09/28/2026, 20:48:12 UTC
Last updated: 09/29/2026, 02:48:01 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.