CVE-2026-48525

{
  "id": "CVE-2026-48525",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-28T16:16:29.533",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "PyJWT is a JSON Web Token implementation in Python. From 2.8.0 to 2.12.1, when verifying detached JWS tokens using the unencoded-payload option (\"b64\": false, RFC 7797), PyJWT performs Base64URL decoding of the compact-serialization payload segment before enforcing the detached-payload rules. For b64=false, PyJWT later discards that decoded payload and replaces it with the caller-provided detached_payload. In practice, this turns the middle segment into an attacker-controlled “work amplifier”: a remote client can supply an arbitrarily large Base64URL payload segment that forces CPU work + memory allocations even if the signature is invalid. This creates an unauthenticated DoS vector against any endpoint that verifies detached JWS using PyJWT. This vulnerability is fixed in 2.13.0."
    },
    {
      "lang": "es",
      "value": "PyJWT es una implementación de JSON Web Token en Python. Desde la versión 2.8.0 hasta la 2.12.1, al verificar tokens JWS separados utilizando la opción de carga útil no codificada (’b64’: false, RFC 7797), PyJWT realiza la decodificación Base64URL del segmento de carga útil de serialización compacta antes de aplicar las reglas de carga útil separada. Para b64=false, PyJWT descarta posteriormente esa carga útil decodificada y la reemplaza con la “detached_payload” proporcionada por el llamador. En la práctica, esto convierte el segmento intermedio en un ’amplificador de trabajo’ controlado por el atacante: un cliente remoto puede suministrar un segmento de carga útil Base64URL arbitrariamente grande que fuerza trabajo de CPU + asignaciones de memoria incluso si la firma es inválida. Esto crea un vector de DoS no autenticado contra cualquier punto final que verifique JWS separados utilizando PyJWT. Esta vulnerabilidad se corrige en la versión 2.13.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "jpadilla",
          "product": "pyjwt",
          "versions": [
            {
              "version": ">= 2.8.0, < 2.13.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-28T15:58:48.873096Z",
          "id": "CVE-2026-48525",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:pyjwt_project:pyjwt:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2.8.0",
              "versionEndIncluding": "2.12.1",
              "matchCriteriaId": "71DC0C43-352F-449C-B411-5040A311A35F"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}