{"vulnerability": "CVE-2026-101918", "sightings": [{"uuid": "a222efa5-9b75-4efa-824e-df80649ee1a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101918", "type": "seen", "source": "https://gist.github.com/alon710/3776e3a5a74b61b00e6cd607169510e6", "content": "# CVE-2026-101918: CVE-2026-101918: Unauthenticated Denial of Service via Recursion Exhaustion in PyJWT\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-09-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-101918\n\n## Summary\nA Denial of Service (DoS) vulnerability exists in the PyJWT library when parsing unverified token payloads containing deeply nested JSON structures. Because PyJWT fails to catch RecursionError during payload parsing, an unauthenticated remote attacker can crash the application thread or worker by sending a specially crafted token.\n\n## TL;DR\nAn unauthenticated remote attacker can crash Python web servers using PyJWT by transmitting a token with thousands of nested JSON brackets, triggering an uncaught RecursionError and resulting in a Denial of Service (DoS).\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-248 / CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.3 (Medium)\n- **EPSS Score**: 0.00291 (Percentile: 19.51%)\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Python web applications and microservices using PyJWT versions >= 2.0.0a1 and < 2.15.0 to decode tokens pre-verification or with disabled signature validation.\n- **pyjwt**: >= 2.0.0a1, < 2.15.0 (Fixed in: `2.15.0`)\n\n## Mitigation\n\n- Upgrade PyJWT to version 2.15.0 or higher.\n- Implement gateway-level validation of JWT structure to drop excessively nested payloads.\n- Apply API rate limiting and connection timeout caps on authorization endpoints.\n\n**Remediation Steps:**\n1. Identify all Python execution environments utilizing PyJWT.\n2. Update dependencies inside requirement files to lock pyjwt >= 2.15.0.\n3. Verify the configuration by running the application test suite with nested JSON test cases.\n\n## References\n\n- [GitHub Security Advisory GHSA-42vr-xj54-vc7v](https://github.com/jpadilla/pyjwt/security/advisories/GHSA-42vr-xj54-vc7v)\n- [PyJWT 2.15.0 Release Notes](https://github.com/jpadilla/pyjwt/releases/tag/2.15.0)\n- [NVD Vulnerability Details for CVE-2026-101918](https://nvd.nist.gov/vuln/detail/CVE-2026-101918)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-101918) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-30T16:30:28.000000Z"}]}