CVE-2026-102270
Fixed in a distro release EPSS <1%CVSS 4.4
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT is_pem_format is affected because lazy PEM regular expression backtracks extensively. This occurs when a certificate-like input contains repeated BEGIN markers without a matching END marker. As a result, is_pem_format performs unbounded backtracking while searching for a PEM end marker. Consequently, an attacker can cause intensive CPU consumption. This issue is fixed in version 2.14.0.
Products: jpadilla pyjwt
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | pyjwt | 2.14.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | authentik-fips-2026.5 | 2026.5.7-r7 |
| Chainguard | datadog-agent-7.78-core-integrations | no fix |
| Chainguard | datadog-agent-7.84-core-integrations | 7.84.1-r1 |
| Chainguard | datadog-agent-fips-7.78-core-integrations | no fix |
| Chainguard | datadog-agent-fips-7.84-core-integrations | 7.84.2-r3 |
| Chainguard | kserve-huggingfaceserver-cuda-13.3 | 0.21.0-r4 |
| Chainguard | nemo-rl-cuda-13.0-gym | 0.7.0-r2 |
| Chainguard | nemo-rl-cuda-13.0-vllm | 0.7.0-r2 |
| Chainguard | superset-fips-6.1 | 6.1.0-r7 |
| Debian 12 | pyjwt | no fix |
| Debian 13 | pyjwt | no fix |
| Debian 14 | pyjwt | 2.14.0-1 |
| SUSE Linux Enterprise Server 16.0 | python-PyJWT | 2.12.1-160000.3.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | python-PyJWT | 2.12.1-160000.3.1 |
| SUSE Linux Micro 6.0 | python-PyJWT | 2.9.0-159998.1.1 |
| SUSE Linux Micro 6.2 | python-PyJWT | 2.12.1-160000.3.1 |
| Ubuntu 22.04 LTS | pyjwt | no fix |
| Ubuntu 24.04 LTS | pyjwt | no fix |
| Ubuntu 26.04 LTS | pyjwt | no fix |
| Ubuntu 26.10 | pyjwt | no fix |
| Ubuntu Pro 16.04 LTS | pyjwt | no fix |
| Ubuntu Pro 18.04 LTS | pyjwt | no fix |
| Ubuntu Pro 20.04 LTS | pyjwt | no fix |
| Wolfi | datadog-agent-7.78-core-integrations | no fix |
| openSUSE Leap 16.0 | python-PyJWT | 2.12.1-160000.3.1 |
| openSUSE Tumbleweed | python-PyJWT | 2.15.1-1.1 |