CVE-2026-48525: CWE-400: Uncontrolled Resource Consumption in jpadilla pyjwt
PyJWT versions from 2.8.0 up to but not including 2.13.0 contain a vulnerability related to uncontrolled resource consumption when verifying detached JWS tokens with the unencoded-payload option (b64=false). An attacker can supply a large Base64URL payload segment that causes excessive CPU and memory usage even if the signature is invalid, leading to a denial of service. This issue is fixed in version 2.13.0.
AI Analysis
Technical Summary
PyJWT, a Python JSON Web Token library, versions 2.8.0 through 2.12.1 improperly handle Base64URL decoding of the compact-serialization payload segment when verifying detached JWS tokens using the unencoded-payload option (b64=false, RFC 7797). The library decodes the payload segment before enforcing detached-payload rules and then discards the decoded payload, replacing it with the caller-provided detached_payload. This behavior allows an attacker to supply an arbitrarily large Base64URL payload segment that forces excessive CPU and memory consumption, creating an unauthenticated denial-of-service vector against endpoints verifying detached JWS tokens with PyJWT. The vulnerability is addressed in PyJWT version 2.13.0.
Potential Impact
The vulnerability allows remote attackers to cause a denial of service by forcing excessive CPU and memory usage during token verification, even without valid signatures. This can disrupt availability of services that use affected PyJWT versions to verify detached JWS tokens with the unencoded-payload option.
Mitigation Recommendations
A fix is available in PyJWT version 2.13.0. Users should upgrade to version 2.13.0 or later to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.
CVE-2026-48525: CWE-400: Uncontrolled Resource Consumption in jpadilla pyjwt
Description
PyJWT versions from 2.8.0 up to but not including 2.13.0 contain a vulnerability related to uncontrolled resource consumption when verifying detached JWS tokens with the unencoded-payload option (b64=false). An attacker can supply a large Base64URL payload segment that causes excessive CPU and memory usage even if the signature is invalid, leading to a denial of service. This issue is fixed in version 2.13.0.
CVSS v3.1
Score 5.3medium
Affected software
jpadilla
pyjwt
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
PyJWT, a Python JSON Web Token library, versions 2.8.0 through 2.12.1 improperly handle Base64URL decoding of the compact-serialization payload segment when verifying detached JWS tokens using the unencoded-payload option (b64=false, RFC 7797). The library decodes the payload segment before enforcing detached-payload rules and then discards the decoded payload, replacing it with the caller-provided detached_payload. This behavior allows an attacker to supply an arbitrarily large Base64URL payload segment that forces excessive CPU and memory consumption, creating an unauthenticated denial-of-service vector against endpoints verifying detached JWS tokens with PyJWT. The vulnerability is addressed in PyJWT version 2.13.0.
Potential Impact
The vulnerability allows remote attackers to cause a denial of service by forcing excessive CPU and memory usage during token verification, even without valid signatures. This can disrupt availability of services that use affected PyJWT versions to verify detached JWS tokens with the unencoded-payload option.
Mitigation Recommendations
A fix is available in PyJWT version 2.13.0. Users should upgrade to version 2.13.0 or later to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-21T16:18:10.619Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a186056e29bf47b500b42db
Added to database: 05/28/2026, 15:33:42 UTC
Last enriched: 08/08/2026, 15:45:08 UTC
Last updated: 09/13/2026, 10:01:31 UTC
Views: 103
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.