{"items":[{"id":"NVI-00013107","kind":"vulnerability","title":"PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-8wjv-2p76-3863","CVE-2026-102265"],"plain_summary":"GitHub lists this reviewed advisory for pyJWT. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-62a28f7afa2ef541b9a2e56a376b2bc8"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-29T23:43:07.000Z","value":"5.3 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-62a28f7afa2ef541b9a2e56a376b2bc8"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-62a28f7afa2ef541b9a2e56a376b2bc8","url":"https://github.com/advisories/GHSA-8wjv-2p76-3863","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-8wjv-2p76-3863","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T07:24:25.558Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-62a28f7afa2ef541b9a2e56a376b2bc8"],"technology":"pyJWT","known_exclusions":[],"conditions_summary":"## Package\n\npyjwt (PyPI)\n\n## Affected versions\n\ntested & verified on: 2.13.0. Every version whose `PyJWS._load()` translates only `ValueError` is affected\n\n## Description\n\n`PyJWS._looad()` (`jwt/api_jws.py:337`) splits the compact token, base64url decodes the header segment and hands it to `json.loads()` before `_verify_signature()` runs. The parse is wrapped in `except ValueError as e: raise DecodeError(...)`. That is what makes the documented contract sufficient for untrusted input: `except jwt.PyJWTError` (or `InvalidTokenError`) around `jwt.decode(token, key, algorithms=[...])`.\n\nCPython's JSON decoder raises `RecursionError` (a `RuntimeError` subclass, not a `ValueError`) once nesting crosses the native stack guard. That exception leaves `_load()`, then `jwt.decode()`, and matches no `PyJWTError` handlerr at all. No key and no valid signature are needed: the header is parsed first, so a single unauthenticated request with an unsigned token suffices.\n\nScope: the recursion threshold is ~65,000 nesting levels; below it the same input yields a clean `DecodeError` (a 346,800-byte flat header is rejected normally, so depth, not size, is the trigger). A token this large cannot ride i","public_affected_ranges":[">= 2.13.0, < 2.14.0"]}],"null_published_at":"2026-11-01T07:29:12.922Z","source_updated_at":"2026-09-29T23:43:07.000Z","source_disclosed_at":"2026-09-29T23:43:06.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T07:24:25.558Z"}],"next_cursor":null,"snapshot_revision":"42594"}