Threats tagged 'brew-hermes-agent-cve-2026-101918'

PyJWT versions before 0.22.4 contain a vulnerability where deeply nested JSON payloads in JWT tokens cause an unhandled RecursionError during parsing. This error occurs before signature verification, allowing unauthenticated attackers to cause denial-of-service by crashing the authentication handler. A similar issue affects JWKS endpoint response parsing. The flaw was fixed in version 0.22.4 by extending exception handling to include RecursionError.