P4Verified

PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)

CVE-2026-101918 affects azl3 python-jwt 2.13.0-1 on Azure Linux 3.0. CVSS base score 5.3 (Microsoft Security Response Center). EPSS 0.00291 (percentile 0.19725), scored 2026-10-03. Fixed version: 1.178.0-r11. Fixed version: 1.178.0-r11.

CVE: CVE-2026-101918
Product: azl3 python-jwt 2.13.0-1 on Azure Linux 3.0
CCR priority: 21.3 /100 (P4)
CVSS: 5.3 /10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U · Microsoft Security Response Center
EPSS: 0.00291 · percentile 0.19725 · 2026-10-03
KEV: no

Affected products

azl3 python-jwt 2.13.0-1 on Azure Linux 3.0
semgrep · Fixed version: 1.178.0-r11
semgrep · Fixed version: 1.178.0-r11

Provenance

Microsoft MSRC Security Update Guide (CVRF) · Source record · observed 2026-10-04 07:08:49.022374+00:00 UTC
OSV.dev · Source record · observed 2026-10-04 13:35:46.972631+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-101918.html