Threats tagged 'brew-hermes-agent-cve-2026-48525'

PyJWT versions from 2.4.0 up to but not including 2.12.1 contain a vulnerability in the handling of detached JWS tokens with the unencoded-payload option (b64=false). The library performs Base64URL decoding of the payload segment before enforcing detached payload rules, causing unnecessary CPU and memory usage even if the signature is invalid. This allows an unauthenticated remote attacker to cause a denial of service (DoS) by sending tokens with large payload segments, amplifying resource consumption on the server.