CVE-2026-102274

The record

PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications can experience authentication failures or request-level denial of service. This issue is fixed in version 2.14.0.

Affected packages

Related vulnerabilities

• CVE-2026-109618 PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort… CWE-755
• CVE-2026-109619 PHP has various global state that temporarily points into request memory. CWE-755
• CVE-2026-105757 vLLM is an inference and serving engine for large language models. CWE-755
• CVE-2026-49305 Permission control vulnerability in the Wi-Fi enhancement module. Impact: Successful… CWE-755
• CVE-2026-45819 baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on… CWE-755
• CVE-2026-52856 Wings is the server control plane for Pterodactyl, a free, open-source game server… CWE-755
• CVE-2026-59952 Valibot helps validate data using a schema. CWE-755
• CVE-2026-16730 A flaw was found in dbus-broker. CWE-755