DailyCVE@dailycve
🟠 PyJWT, ReDoS, #CVE-2026-102270 (Medium) -DC-Sep2026-2659 https://dailycve.com/pyjwt-redos-cve-2026-102270-medium-dc-sep2026-2659/
0000026
238 followersView on X
CVE-2026-102270
LOWCVSS 4.4 · MEDIUMSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT is_pem_format is affected because lazy PEM regular expression backtracks extensively. This occurs when a certificate-like input contains repeated BEGIN markers without a matching END marker. As a result, is_pem_format performs unbounded backtracking while searching for a PEM end marker. Consequently, an attacker can cause intensive CPU consumption. This issue is fixed in version 2.14.0.
0.0/ 10 priority
Sources & remediation
Other references
Weakness type (CWE)
CWE-1333
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day