CVE-2026-102265

Name of the Vulnerable Software and Affected Versions PyJWT versions 2.13.0 through 2.13.x

Description The PyJWS. load function in jwt/api jws.py fails to catch RecursionError when processing a deeply nested token header via json.loads. Because the parser only catches ValueError, the RecursionError bypasses the standard error handling hierarchy. This allows an unauthenticated attacker to send a malformed token that triggers a request-level failure, resulting in an HTTP 500 error.

Recommendations Update to version 2.14.0.