VulnSocial

CVE-2026-102274

LOWCVSS 5.9 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications can experience authentication failures or request-level denial of service. This issue is fixed in version 2.14.0.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-755

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-09-29: 209-29
Referenced assets1 URL
Full discourse2 posts
  • SecDim@secdim

    We found CVE-2026-102274 in PyJWT: one malformed RSA key could stop an entire JWK Set from loading. Fixed in 2.14.0. Technical writeup: https://t.co/LRCezomROi

    1000063
    283 followersView on X
  • SecDim@secdim

    https://secdim.com/blog/post/cve-2026-102274-malformed-rsa-jwk-aborts-pyjwt-jwk-set-parsing-21159/

    0000028
    283 followersView on X

Explore more

Back to dashboard