PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a result, documented PyJWT exception handling does not contain the failure. Consequently, an unauthenticated request can raise an exception that may produce an HTTP 500 response. The advisory-defined affected implementation also includes jwt/api_jwt.py, verify_signature=False. This issue is fixed in version 2.15.0.
Weakness
An exception is thrown from a function, but it is not caught.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Pyjwt | Pyjwt_project | 2.0.0 (including) | 2.15.0 (excluding) |
| Red Hat AI Inference Server 3.5 | RedHat | rhaii/vllm-rocm-rhel9:1791425869 | * |
| Red Hat AI Inference Server 3.5 | RedHat | rhaii/vllm-gaudi-rhel9:1791427182 | * |
| Red Hat AI Inference Server 3.5 | RedHat | rhaii/vllm-cuda-rhel9:1791473631 | * |
| Red Hat AI Inference Server 3.5 | RedHat | rhaii/vllm-spyre-rhel9:1791818357 | * |
| Red Hat AI Inference Server 3.5 | RedHat | rhaii/vllm-cpu-rhel9:1791473614 | * |
| Pyjwt | Ubuntu | esm-infra-legacy/xenial | * |
| Pyjwt | Ubuntu | esm-infra/bionic | * |
| Pyjwt | Ubuntu | esm-infra/focal | * |
| Pyjwt | Ubuntu | jammy | * |
| Pyjwt | Ubuntu | noble | * |
| Pyjwt | Ubuntu | resolute | * |
| Pyjwt | Ubuntu | stonking | * |
| Pyjwt | Ubuntu | upstream | * |