PT-2026-44397 · Pypi · Pyjwt
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
PyJWT versions 2.8.0 through 2.12.1
Description
When verifying detached JWS tokens using the unencoded-payload option (
"b64": false, RFC 7797), the software performs Base64URL decoding of the compact-serialization payload segment before enforcing detached-payload rules. Because the decoded payload is later discarded and replaced with the caller-provided detached payload, the middle segment can be used as a work amplifier. A remote client can provide an arbitrarily large Base64URL payload segment, forcing excessive CPU work and memory allocations regardless of whether the signature is valid. This results in an unauthenticated Denial of Service (DoS) against any endpoint verifying detached JWS.Recommendations
Update to version 2.13.0.
Exploit
Fix
DoS
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Pyjwt