CVE-2026-128131

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, aiohttp decompresses each member of a payload containing many concatenated gzip, deflate, or zstd streams by passing the entire remaining input to a new decompressor, causing quadratic CPU use. Empty...

CVE-2026-128131

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, aiohttp decompresses each member of a payload containing many concatenated gzip, deflate, or zstd streams by passing the entire remaining input to a new decompressor, causing quadratic CPU use. Empty...

CVE-2026-128089

The dnspython DNS toolkit for Python is vulnerable to excessive memory and CPU consumption in versions prior to 2.9.2 . The root cause is located in the from_text() parser for WKS records , which fails to validate that the service number is between 0 and 65535 before using it as a bitmap offset. ...

EUVD-2026-113348

Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer...

CVE-2026-125040

A flaw was found in the SRT and WebVTT subtitle parser in GStreamer's gst-plugins-base. While sanitizing inline subtitle markup, the parser repeatedly searches the remaining text with unanchored regular expressions. A crafted subtitle cue with a long line of unmatched markup-like text can force...

Allocation of Resources Without Limits or Throttling

Overview Microsoft.AspNetCore.App.Runtime.linux-x64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling ...

Allocation of Resources Without Limits or Throttling

Overview Microsoft.AspNetCore.App.Runtime.linux-musl-arm is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or...

Allocation of Resources Without Limits or Throttling

Overview Microsoft.AspNetCore.App.Runtime.win-x86 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in...

Allocation of Resources Without Limits or Throttling

Overview Microsoft.AspNetCore.App.Runtime.linux-arm is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling ...

Allocation of Resources Without Limits or Throttling

Overview Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the MultipartReader.ReadHeadersAsync method, which enforces the multipart HeadersCountLimit against the accumulator's distinct-key count rather than its total value count. An...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the MultipartReader.ReadHeadersAsync method, which enforces the multipart HeadersCountLimit against the accumulator's distinct-key count rather than its total value count. An...

Allocation of Resources Without Limits or Throttling

Overview Microsoft.AspNetCore.App.Runtime.win-arm64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling ...

Allocation of Resources Without Limits or Throttling

Overview Microsoft.AspNetCore.App.Runtime.osx-x64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in...

Allocation of Resources Without Limits or Throttling

Overview Microsoft.AspNetCore.App.Runtime.linux-musl-x64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or...

CVE-2026-125040

A flaw was found in the SRT and WebVTT subtitle parser in GStreamer's gst-plugins-base. While sanitizing inline subtitle markup, the parser repeatedly searches the remaining text with unanchored regular expressions. A crafted subtitle cue with a long line of unmatched markup-like text can force...

EUVD-2026-120150

A flaw was found in the SRT and WebVTT subtitle parser in GStreamer's gst-plugins-base. While sanitizing inline subtitle markup, the parser repeatedly searches the remaining text with unanchored regular expressions. A crafted subtitle cue with a long line of unmatched markup-like text can force...

CVE-2026-125040: Red Hat: A flaw was found in the SRT and WebVTT subtitle parser in GStreamer's gst-plugins-base

A flaw was found in the SRT and WebVTT subtitle parser in GStreamer's gst-plugins-base. While sanitizing inline subtitle markup, the parser repeatedly searches the remaining text with unanchored regular expressions. A crafted subtitle cue with a long line of unmatched markup-like text can force...

Dnspython < 2.9.0 DoS

The version of dnspython installed on the remote host is prior to 2.9.0. It is, therefore, affected by a denial of service vulnerability: - dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.fromwireparser follows attacker-controlled DNS compression pointer chains without a hop limit...

OESA-2026-4673 python-dns security update

\ Security Fixes: dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.fromwireparser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU us...