A Regular Expression Denial of Service (ReDoS) vulnerability exists in the PyJWT library's is_pem_format function. The vulnerability arises from a regex pattern that exhibits quadratic time complexity when processing malformed PEM-like input consisting of repeated '-----BEGIN CERTIFICATE-----' lines without a matching '---- END' line. This can cause excessive CPU usage, potentially leading to resource exhaustion and service unavailability. The issue affects PyJWT versions >=0.21.6 and <0.22.4. A fix was released in PyJWT 2.14.0 on 2026-09-11.