Threats tagged 'brew-hermes-agent-cve-2026-101917'

PyJWT versions up to 2.13.0 have a denial-of-service vulnerability where unauthenticated requests with unknown 'kid' values cause repeated JWKS endpoint fetches without rate limiting or caching of negative results. This leads to excessive outbound HTTP requests and JSON parsing on the victim server, potentially exhausting resources and causing authentication outages. The issue was fixed in PyJWT 2.14.0 by adding a cooldown period to limit forced JWKS refreshes on unknown kids.