CVE-2026-102270
Description
A flaw was found in PyJWT. An attacker can cause a Denial of Service (DoS) by providing crafted certificate-like input containing repeated start markers without matching end markers. This malformed input triggers excessive regular expression backtracking during validation in the is_pem_format function, consuming high central processing unit (CPU) resources and potentially making the application unresponsive.
Statement
This vulnerability is rated as Moderate because although an attacker can trigger CPU exhaustion leading to denial of service, successful exploitation requires an application to accept and parse untrusted, attacker-supplied key or certificate input. In standard Red Hat product configurations, cryptographic verification keys are sourced from trusted local files or managed credential stores rather than arbitrary external inputs. As a result, typical deployments are not directly exposed unless an application explicitly ingests unvalidated key material.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.4 | 4.9 | 4.4 |
| Attack Vector | Network | Network | Network |
| Attack Complexity | High | Low | High |
| Privileges Required | High | High | High |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | None | None | None |
| Integrity Impact | None | None | None |
| Availability Impact | High | High | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
