PyJWT versions from 2.1.0+ (Ed25519) and 2.2.0+ (Ed448) accept OKP private JWKs where the declared public key 'x' does not match the private key 'd', causing a key identity confusion. This flaw allows an attacker to create a JWK with a legitimate public key but use their own private key for cryptographic operations. In DPoP integrations, this can enable misuse of stolen sender-constrained access tokens without possession of the legitimate private key. The issue is fixed in hermes-agent version 0.22.4.
HTTPX2 versions prior to 2.12.0 decompress streaming HTTP response bodies in a way that can cause excessive memory allocation. Specifically, each network read of up to 64 KiB is fully decompressed into a large intermediate buffer before yielding data, allowing a small compressed chunk to expand to tens of megabytes in memory. This can lead to memory pressure or out-of-memory termination when processing malicious compressed responses from untrusted servers. The issue affects applications that fetch resources from attacker-controlled servers without requiring authentication or user interaction. The vulnerability is fixed in HTTPX2 version 2.12.0 and later, which use incremental decompression with bounded buffers.
HTTPX2 versions 2.6.0 through 2.9.1 and underlying httpcore2 releases before 2.10.0 do not initiate TLS for secure WebSocket (wss://) connections routed through SOCKS5 proxies. This results in the WebSocket handshake and subsequent frames being sent in plaintext through the proxy, exposing sensitive headers, cookies, and messages. An attacker controlling or observing the SOCKS proxy path can intercept or modify this traffic, violating the expected confidentiality and integrity guarantees of wss connections. The issue is fixed in HTTPX2 and httpcore2 version 2.10.0 and later.
HTTPX2 versions before 0.22.2 can automatically add a Content-Length header to requests that already include a Transfer-Encoding header, resulting in conflicting HTTP/1.1 framing headers. This ambiguity can enable request smuggling or connection desynchronization when intermediaries interpret the headers differently. The issue affects requests with fixed-size bodies using HTTP/1.1 and requires attacker-controlled framing headers to be forwarded by the application. The vulnerability is fixed in HTTPX2 version 0.22.2.
HTTPX2 versions before 0.22.2 improperly serialize per-file Content-Type and custom headers in multipart/form-data requests without validating for control characters. This allows an attacker controlling upload metadata to inject CR or LF characters, enabling multipart part header injection. The impact depends on how the receiving server processes multipart headers, potentially altering part semantics or bypassing header-based checks. The issue is fixed in HTTPX2 version 0.22.2.
HTTPX2 versions before 2.10.0 contain a vulnerability in their Server-Sent Events (SSE) parser where processing a long unterminated SSE line split across many chunks causes quadratic CPU usage. This can be exploited by an attacker-controlled SSE endpoint to cause excessive CPU consumption, potentially leading to denial of service. The issue affects both synchronous and asynchronous SSE client APIs. Upgrading to HTTPX2 2.10.0 or later mitigates the issue by improving line buffering efficiency and limiting buffered event size.
PyJWT versions from 0.21.6 up to but not including 0.22.4, and versions from 2026.4.30 through 2026.9.24, contain a vulnerability where the decode() function mutates a caller-supplied options dictionary when signature verification is disabled. If the same options dictionary is reused with signature verification enabled later, it can silently bypass claim verifications such as expiration, audience, issuer, and subject checks. This leads to acceptance of expired or otherwise invalid tokens without exceptions. The issue is a regression introduced in March 2025 and fixed in version 0.22.4. The vulnerability has a medium severity with a CVSS score of 6.5.
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the PyJWT library's is_pem_format function. The vulnerability arises from a regex pattern that exhibits quadratic time complexity when processing malformed PEM-like input consisting of repeated '-----BEGIN CERTIFICATE-----' lines without a matching '---- END' line. This can cause excessive CPU usage, potentially leading to resource exhaustion and service unavailability. The issue affects PyJWT versions >=0.21.6 and <0.22.4. A fix was released in PyJWT 2.14.0 on 2026-09-11.
PyJWT versions before 0.22.4 contain a vulnerability where deeply nested JSON payloads in JWT tokens cause an unhandled RecursionError during parsing. This error occurs before signature verification, allowing unauthenticated attackers to cause denial-of-service by crashing the authentication handler. A similar issue affects JWKS endpoint response parsing. The flaw was fixed in version 0.22.4 by extending exception handling to include RecursionError.
A vulnerability in PyJWT causes a malformed RSA JWK inside a JWK Set to abort parsing of the entire set instead of skipping the malformed key. This occurs because a built-in Python ValueError raised during RSA key parsing is not caught by PyJWT's error handling, causing the constructor to fail and no keys to be added from the set.
PyJWT version 2.13.0 has a vulnerability involving algorithm confusion where public JWK containers can be incorrectly accepted as HMAC secrets. This allows an attacker who knows the public key material to forge HS256/HS384/HS512 JWT tokens if the application mixes symmetric and asymmetric algorithms and uses raw public JWK/JWKS JSON as the HMAC secret. The issue is fixed in PyJWT 2.14.0.
PyJWT version 2.13.0 contains a vulnerability where a UTF-8 BOM prefix in a JSON Web Key (JWK) bypasses a key validation guard, allowing an attacker to use an RSA public key as an HMAC secret. This enables forging JWT tokens with arbitrary claims when the verifier accepts both HS256 and RS256 algorithms. The vulnerability leads to complete authentication and authorization bypass. A fix has been committed but not yet released.
PyJWT versions including 2.13.0 accept compact JWS signature segments with non-canonical Base64URL characters, allowing alternate token serializations that decode to the same signature bytes and claims. This can enable bypass of raw-token-based revocation or logout mechanisms if the application uses the raw serialized token string as the identity for revocation or replay state. The vulnerability does not allow signature forgery or claim alteration. A fix has been developed to reject non-canonical Base64URL characters in signature segments but is not yet released.
PyJWT versions before 0.22.4 contain a vulnerability where malformed PEM public keys with whitespace or unusual line endings bypass the asymmetric key detection. This causes the public key to be used as an HMAC secret, allowing an attacker who knows the public key to forge valid HS256 tokens when the verification algorithm list mixes HMAC and asymmetric algorithms.
PyJWT versions up to 2.13.0 contain a vulnerability in the PyJWKClient component, which follows HTTP redirects when fetching JSON Web Key Sets (JWKS) without validating the redirect destination. This allows a trusted JWKS endpoint to redirect requests to an attacker-controlled host, potentially exposing sensitive request headers and enabling JWKS trust poisoning. The vulnerability is fixed in PyJWT 2.14.0.
PyJWT versions prior to 0.22.4 contain a vulnerability where empty HMAC keys supplied via oct JWKs are accepted during HS256 token verification, bypassing the library's empty-key validation. This allows an attacker to forge valid HS256 JWTs if the application uses an empty symmetric JWK key, potentially leading to unauthorized token acceptance.
PyJWT versions prior to 2.14.0 contain a vulnerability where deeply nested JSON arrays in the JWT header cause a RecursionError during decoding. This error is not caught by the library's usual exception handling, resulting in an unhandled exception that leads to HTTP 500 server errors and full tracebacks logged. The issue allows an unauthenticated attacker to cause a denial of service on JWT validation endpoints by sending crafted tokens with excessively nested headers. The flaw is fixed in PyJWT 2.14.0 by catching RecursionError and converting it to a DecodeError.
PyJWT versions up to 2.13.0 have a denial-of-service vulnerability where unauthenticated requests with unknown 'kid' values cause repeated JWKS endpoint fetches without rate limiting or caching of negative results. This leads to excessive outbound HTTP requests and JSON parsing on the victim server, potentially exhausting resources and causing authentication outages. The issue was fixed in PyJWT 2.14.0 by adding a cooldown period to limit forced JWKS refreshes on unknown kids.