Is CVE-2026-102270 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102270 being exploited in the wild.

How severe is CVE-2026-102270?

Medium severity, with a CVSS score of 4.4, published 28 September 2026.

Which products and versions are affected?

Jpadilla PyJWT before 2.14.0; pyjwt (PyPI) <= 2.13.0, ECOSYSTEM:introduced=0,fixed=2.14.0.

Is there a fix for CVE-2026-102270?

Yes. pyjwt (PyPI): upgrade to 2.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-102270 attacked?

It is attacked over the network.

Am I affected by CVE-2026-102270?

Check whether you run Jpadilla PyJWT or pyjwt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102270: PyJWT denial of service in PEM format validation

Q: Is there a fix for CVE-2026-102270?

Yes. pyjwt (PyPI): upgrade to 2.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-102270 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-102270?

Check whether you run Jpadilla PyJWT or pyjwt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102270 · Severity: medium · CVSS 4.4 · Published 2026-09-28

PyJWT is a Python library for creating and validating JSON Web Tokens (JWTs), a standard security mechanism used in APIs and web applications. A flaw in the library's PEM format validation logic allows an attacker to craft a malicious certificate-like input that triggers excessive CPU consumption, potentially causing a denial of service. An affected application could become unresponsive or crash when processing a malicious JWT token.

Technologies: Jpadilla PyJWT, pyjwt (PyPI). Vendors: Jpadilla, PyPI.

Quick answers

Is CVE-2026-102270 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102270 being exploited in the wild.
How severe is CVE-2026-102270?: Medium severity, with a CVSS score of 4.4, published 28 September 2026.
Which products and versions are affected?: Jpadilla PyJWT before 2.14.0; pyjwt (PyPI) <= 2.13.0, ECOSYSTEM:introduced=0,fixed=2.14.0.
Is there a fix for CVE-2026-102270?: Yes. pyjwt (PyPI): upgrade to 2.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102270 attacked?: It is attacked over the network.
Am I affected by CVE-2026-102270?: Check whether you run Jpadilla PyJWT or pyjwt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pyjwt (PyPI): upgrade to 2.14.0 or later
```
pip install "pyjwt>=2.14.0"
```

Technical details

The is_pem_format function in PyJWT uses a regular expression with lazy quantifiers that exhibits catastrophic backtracking when processing input containing repeated BEGIN markers without a matching END marker. An attacker can provide a certificate-like string that causes the regex engine to perform unbounded backtracking, resulting in CPU-intensive processing. The vulnerability is fixed by rejecting loader-accepted PEM variants and is resolved in version 2.14.0.

Affected products

jpadilla PyJWT before 2.14.0

Identifiers

CVE-2026-102270
GHSA-jwrc-g2q2-pq5p
PYSEC-2026-4148

Timeline

2026-09-28: disclosed
2026-09-11: patched: Fix released in version 2.14.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.