CVE-2026-48525

Name of the Vulnerable Software and Affected Versions PyJWT versions 2.8.0 through 2.12.1

Description When verifying detached JWS tokens using the unencoded-payload option ("b64": false, RFC 7797), the software performs Base64URL decoding of the compact-serialization payload segment before enforcing detached-payload rules. Because the decoded payload is later discarded and replaced with the caller-provided detached payload, the middle segment can be used as a work amplifier. A remote client can provide an arbitrarily large Base64URL payload segment, forcing excessive CPU work and memory allocations regardless of whether the signature is valid. This results in an unauthenticated Denial of Service (DoS) against any endpoint verifying detached JWS.

Recommendations Update to version 2.13.0.