new file mode 100644
@@ -0,0 +1,121 @@
+From 5fde08a6cf906aa7698de2d6391d88b73006b17b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jos=C3=A9=20Padilla?= <jpadilla@users.noreply.github.com>
+Date: Tue, 22 Sep 2026 11:44:19 -0400
+Subject: [PATCH] fix: normalize recursive JWT payload errors
+
+CVE: CVE-2026-101918
+Upstream-Status: Backport [https://github.com/jpadilla/pyjwt/commit/5fde08a6cf906aa7698de2d6391d88b73006b17b]
+
+Backport Changes:
+- Add explicit exception chaining to the PyJWT 2.8.0 payload parser,
+ which lacks the upstream raise-from clause used by the regression tests.
+- Add DecodeError to the existing single-line jwt.exceptions import in
+ tests/test_jwks_client.py; newer upstream-only exceptions are absent.
+
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ jwt/api_jwt.py | 4 ++--
+ tests/test_api_jwt.py | 18 +++++++++++++++++-
+ tests/test_jwks_client.py | 22 +++++++++++++++++++++-
+ 3 files changed, 40 insertions(+), 4 deletions(-)
+
+diff --git a/jwt/api_jwt.py b/jwt/api_jwt.py
+index 48d739a..ae0dc35 100644
+--- a/jwt/api_jwt.py
++++ b/jwt/api_jwt.py
+@@ -176,8 +176,8 @@ class PyJWT:
+ """
+ try:
+ payload = json.loads(decoded["payload"])
+- except ValueError as e:
+- raise DecodeError(f"Invalid payload string: {e}")
++ except (ValueError, RecursionError) as e:
++ raise DecodeError(f"Invalid payload string: {e}") from e
+ if not isinstance(payload, dict):
+ raise DecodeError("Invalid payload string: must be a json object")
+ return payload
+diff --git a/tests/test_api_jwt.py b/tests/test_api_jwt.py
+index 2598b12..0a5f91c 100644
+--- a/tests/test_api_jwt.py
++++ b/tests/test_api_jwt.py
+@@ -6,6 +6,7 @@ from decimal import Decimal
+
+ import pytest
+
++import jwt as pyjwt
+ from jwt.api_jwt import PyJWT
+ from jwt.exceptions import (
+ DecodeError,
+@@ -16,7 +17,7 @@ from jwt.exceptions import (
+ InvalidIssuerError,
+ MissingRequiredClaimError,
+ )
+-from jwt.utils import base64url_decode
++from jwt.utils import base64url_decode, base64url_encode
+ from jwt.warnings import RemovedInPyjwt3Warning
+
+ from .utils import crypto_required, key_path, utc_timestamp
+@@ -34,6 +35,21 @@ def payload():
+
+
+ class TestJWT:
++ def test_decode_deeply_nested_payload_throws_decode_error(self) -> None:
++ nested_payload = b"[" * 100_000 + b"]" * 100_000
++ token = ".".join(
++ (
++ "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9",
++ base64url_encode(nested_payload).decode(),
++ "",
++ )
++ )
++
++ with pytest.raises(DecodeError, match="Invalid payload") as exc:
++ pyjwt.decode(token, options={"verify_signature": False})
++
++ assert isinstance(exc.value.__cause__, RecursionError)
++
+ def test_decodes_valid_jwt(self, jwt):
+ example_payload = {"hello": "world"}
+ example_secret = "secret"
+diff --git a/tests/test_jwks_client.py b/tests/test_jwks_client.py
+index ed730d7..43530df 100644
+--- a/tests/test_jwks_client.py
++++ b/tests/test_jwks_client.py
+@@ -13,7 +13,8 @@ import jwt
+ from jwt import PyJWKClient
+ from jwt.jwks_client import _NoRedirectHandler
+ from jwt.api_jwk import PyJWK
+-from jwt.exceptions import PyJWKClientConnectionError, PyJWKClientError
++from jwt.exceptions import DecodeError, PyJWKClientConnectionError, PyJWKClientError
++from jwt.utils import base64url_encode
+
+ from .utils import crypto_required
+
+@@ -103,6 +104,25 @@ def mocked_timeout():
+
+ @crypto_required
+ class TestPyJWKClient:
++ def test_get_signing_key_from_jwt_rejects_deeply_nested_payload(self) -> None:
++ nested_payload = b"[" * 100_000 + b"]" * 100_000
++ header = b'{"alg":"RS256","kid":"test-key"}'
++ token = ".".join(
++ (
++ base64url_encode(header).decode(),
++ base64url_encode(nested_payload).decode(),
++ "",
++ )
++ )
++
++ with mocked_success_response(RESPONSE_DATA_WITH_MATCHING_KID) as open_mock:
++ jwks_client = PyJWKClient("https://example.test/.well-known/jwks.json")
++ with pytest.raises(DecodeError, match="Invalid payload") as exc:
++ jwks_client.get_signing_key_from_jwt(token)
++
++ assert isinstance(exc.value.__cause__, RecursionError)
++ assert open_mock.call_count == 0
++
+ def test_fetch_data_rejects_redirect_without_contacting_destination(self) -> None:
+ destination_requests = 0
+
+--
+2.35.6
new file mode 100644
@@ -0,0 +1,109 @@
+From 9bc06658f875b9b40091539140bbbdc4639161c3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jos=C3=A9=20Padilla?= <jpadilla@users.noreply.github.com>
+Date: Wed, 23 Sep 2026 09:32:36 -0400
+Subject: [PATCH] fix: make recursive payload tests deterministic
+
+CVE: CVE-2026-101918
+Upstream-Status: Backport [https://github.com/jpadilla/pyjwt/commit/9bc06658f875b9b40091539140bbbdc4639161c3]
+
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ tests/test_api_jwt.py | 22 ++++++++++------------
+ tests/test_jwks_client.py | 24 +++++++++++-------------
+ 2 files changed, 21 insertions(+), 25 deletions(-)
+
+diff --git a/tests/test_api_jwt.py b/tests/test_api_jwt.py
+index 0a5f91c..67d9a8a 100644
+--- a/tests/test_api_jwt.py
++++ b/tests/test_api_jwt.py
+@@ -3,6 +3,7 @@ import time
+ from calendar import timegm
+ from datetime import datetime, timedelta, timezone
+ from decimal import Decimal
++from unittest import mock
+
+ import pytest
+
+@@ -17,7 +18,7 @@ from jwt.exceptions import (
+ InvalidIssuerError,
+ MissingRequiredClaimError,
+ )
+-from jwt.utils import base64url_decode, base64url_encode
++from jwt.utils import base64url_decode
+ from jwt.warnings import RemovedInPyjwt3Warning
+
+ from .utils import crypto_required, key_path, utc_timestamp
+@@ -35,18 +36,15 @@ def payload():
+
+
+ class TestJWT:
+- def test_decode_deeply_nested_payload_throws_decode_error(self) -> None:
+- nested_payload = b"[" * 100_000 + b"]" * 100_000
+- token = ".".join(
+- (
+- "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9",
+- base64url_encode(nested_payload).decode(),
+- "",
+- )
+- )
++ def test_decode_payload_recursion_error_throws_decode_error(self) -> None:
++ token = "eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.e30."
+
+- with pytest.raises(DecodeError, match="Invalid payload") as exc:
+- pyjwt.decode(token, options={"verify_signature": False})
++ with mock.patch(
++ "jwt.api_jwt.json.loads",
++ side_effect=[{"alg": "none", "typ": "JWT"}, RecursionError()],
++ ):
++ with pytest.raises(DecodeError, match="Invalid payload") as exc:
++ pyjwt.decode(token, options={"verify_signature": False})
+
+ assert isinstance(exc.value.__cause__, RecursionError)
+
+diff --git a/tests/test_jwks_client.py b/tests/test_jwks_client.py
+index 43530df..4333722 100644
+--- a/tests/test_jwks_client.py
++++ b/tests/test_jwks_client.py
+@@ -14,7 +14,6 @@ from jwt import PyJWKClient
+ from jwt.jwks_client import _NoRedirectHandler
+ from jwt.api_jwk import PyJWK
+ from jwt.exceptions import DecodeError, PyJWKClientConnectionError, PyJWKClientError
+-from jwt.utils import base64url_encode
+
+ from .utils import crypto_required
+
+@@ -104,21 +103,20 @@ def mocked_timeout():
+
+ @crypto_required
+ class TestPyJWKClient:
+- def test_get_signing_key_from_jwt_rejects_deeply_nested_payload(self) -> None:
+- nested_payload = b"[" * 100_000 + b"]" * 100_000
+- header = b'{"alg":"RS256","kid":"test-key"}'
+- token = ".".join(
+- (
+- base64url_encode(header).decode(),
+- base64url_encode(nested_payload).decode(),
+- "",
+- )
+- )
++ def test_get_signing_key_from_jwt_rejects_payload_recursion_error(self) -> None:
++ token = "eyJhbGciOiJSUzI1NiIsImtpZCI6InRlc3Qta2V5In0.e30."
+
+ with mocked_success_response(RESPONSE_DATA_WITH_MATCHING_KID) as open_mock:
+ jwks_client = PyJWKClient("https://example.test/.well-known/jwks.json")
+- with pytest.raises(DecodeError, match="Invalid payload") as exc:
+- jwks_client.get_signing_key_from_jwt(token)
++ with mock.patch(
++ "jwt.api_jwt.json.loads",
++ side_effect=[
++ {"alg": "RS256", "kid": "test-key"},
++ RecursionError(),
++ ],
++ ):
++ with pytest.raises(DecodeError, match="Invalid payload") as exc:
++ jwks_client.get_signing_key_from_jwt(token)
+
+ assert isinstance(exc.value.__cause__, RecursionError)
+ assert open_mock.call_count == 0
+--
+2.35.6
@@ -18,6 +18,8 @@ SRC_URI += " \
file://CVE-2026-102271.patch \
file://CVE-2026-101917.patch \
file://CVE-2026-102275.patch \
+ file://CVE-2026-101918_p1.patch \
+ file://CVE-2026-101918_p2.patch \
"
SRC_URI[sha256sum] = "57e28d156e3d5c10088e0c68abb90bfac3df82b40a71bd0daa20c65ccd5c23de"