Threats tagged 'brew-cycode-cve-2026-102265'

PyJWT versions from 2.13.0 up to but not including 2.14.0 contain a vulnerability where deeply nested JSON arrays in the JWT header cause a RecursionError during parsing. This error is not caught by the library's usual exception handling, resulting in an HTTP 500 server error and a full traceback logged. This allows unauthenticated attackers to cause a denial of service on JWT validation endpoints without crashing the server or exposing data. The issue is fixed in PyJWT 2.14.0.