CVE-2026-102270 in PyJWT
Summary
by MITRE • 09/29/2026
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT is_pem_format is affected because lazy PEM regular expression backtracks extensively. This occurs when a certificate-like input contains repeated BEGIN markers without a matching END marker. As a result, is_pem_format performs unbounded backtracking while searching for a PEM end marker. Consequently, an attacker can cause intensive CPU consumption. This issue is fixed in version 2.14.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified in PyJWT prior to version 2.14.0 represents a significant availability risk stemming from improper input validation within the library's PEM format detection logic. PyJWT, widely used for encoding and decoding JSON Web Tokens in Python applications, includes utility functions that assist developers in handling various cryptographic key formats. One such function is designed to determine if an input string conforms to the Privacy-Enhanced Mail (PEM) standard by searching for specific header and footer markers. The core technical flaw lies in the implementation of the regular expression used within the _is_pem_format helper method, which suffers from catastrophic backtracking when processing malformed or maliciously crafted inputs.
The mechanism of this vulnerability exploits a classic Regular Expression Denial of Service (ReDoS) pattern. When the function receives an input string that resembles a PEM certificate but contains repeated BEGIN markers without corresponding END markers, the regular expression engine enters a state of unbounded backtracking. Instead of quickly determining that the format is invalid or incomplete, the regex engine attempts numerous combinations to find a match for the end marker sequence. This computational explosion results in intensive CPU consumption, effectively creating a denial-of-service condition against any application relying on PyJWT and invoking this validation function with attacker-controlled data.
From an operational perspective, this vulnerability allows remote attackers to degrade or completely halt service availability by sending specially crafted token payloads or key inputs that trigger the flawed regex logic. Since JWTs are often processed during authentication and authorization flows in web applications, an attacker could potentially exhaust server resources simply by submitting a malformed token header or payload component designed to exploit this parsing inefficiency. This impacts not only the immediate application performance but can also lead to cascading failures if the affected service is part of a larger distributed system where resource exhaustion on one node affects overall cluster stability.
The issue was addressed in PyJWT version 2.14.0 by optimizing the regular expression or replacing it with more efficient parsing logic that avoids backtracking traps. To mitigate this risk, organizations using PyJWT must ensure they upgrade to version 2.14.0 or later immediately. For environments where an immediate upgrade is not feasible due to dependency constraints, temporary mitigations include implementing strict input length limits and validating token structures at the network perimeter before they reach the application layer. Additionally, deploying Web Application Firewalls with rules capable of detecting abnormal CPU spikes associated with regex processing can provide a secondary layer of defense against exploitation attempts targeting this specific flaw.
This vulnerability aligns with CWE-400, which covers Uncontrolled Resource Consumption, specifically highlighting how inefficient algorithmic complexity in input validation leads to resource exhaustion. It also maps to the MITRE ATT&CK technique T1496, Resource Hijacking, where attackers leverage system resources for denial-of-service purposes rather than data exfiltration or privilege escalation. By understanding this vector as a classic ReDoS attack, security teams can better prioritize patching efforts and enhance monitoring capabilities to detect similar patterns in other libraries that rely on complex regular expressions for format validation.