Medium: python3.11-pip

Issue Overview: Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as "\u0660" N or "\u30fb" N + "\u6f22" utilize the...

Medium: python3.12-pip

Issue Overview: Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as "\u0660" N or "\u30fb" N + "\u6f22" utilize the...

Medium: python-pip

Issue Overview: Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as "\u0660" N or "\u30fb" N + "\u6f22" utilize the...

Amazon Linux 2023 : python3-pip, python3-pip-wheel (ALAS2023-2026-2092)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2092 advisory. Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions...

Amazon Linux 2023 : python3.12-pip, python3.12-pip-wheel (ALAS2023-2026-2091)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2091 advisory. Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions...

Amazon Linux 2023 : python3.11-pip, python3.11-pip-wheel (ALAS2023-2026-2090)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2090 advisory. Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions...

Amazon Linux 2023 : python3.13-pip, python3.13-pip-wheel (ALAS2023-2026-2089)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2089 advisory. Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions...

CVE-2026-81319

Deserialization of Untrusted Data vulnerability in ash-project ashcloak allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node, by triggering unbounded atom creation or a decompression bomb during decryption. AshCloak.Calculations.Decrypt decodes the decrypte...

EEF-CVE-2026-81319 Unsafe deserialization of decrypted terms enables node DoS in AshCloak

Summary Deserialization of Untrusted Data vulnerability in ash-project ashcloak allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node, by triggering unbounded atom creation or a decompression bomb during decryption. AshCloak.Calculations.Decrypt decodes the...

CVE-2026-81319

CVE-2026-81319 is a deserialization of untrusted data flaw in ash_cloak (an Erlang/BEAM encryption library by ash-project), affecting versions 0.1.0 through before 0.4.0 . The root cause is that AshCloak.Calculations.Decrypt decodes the decrypted binary using Ash.Helpers.non_executable_binary_to_...

CVE-2026-81319 Unsafe deserialization of decrypted terms enables node DoS in AshCloak

Deserialization of Untrusted Data vulnerability in ash-project ashcloak allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node, by triggering unbounded atom creation or a decompression bomb during decryption. AshCloak.Calculations.Decrypt decodes the decrypte...

EUVD-2026-68281

Deserialization of Untrusted Data vulnerability in ash-project ashcloak allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node, by triggering unbounded atom creation or a decompression bomb during decryption. AshCloak.Calculations.Decrypt decodes the decrypte...

CVE-2026-81319 Unsafe deserialization of decrypted terms enables node DoS in AshCloak

Deserialization of Untrusted Data vulnerability in ash-project ashcloak allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node, by triggering unbounded atom creation or a decompression bomb during decryption. AshCloak.Calculations.Decrypt decodes the decrypte...

CVE-2026-81319 Unsafe deserialization of decrypted terms enables node DoS in AshCloak

Deserialization of Untrusted Data vulnerability in ash-project ashcloak allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node, by triggering unbounded atom creation or a decompression bomb during decryption. AshCloak.Calculations.Decrypt decodes the decrypte...

CVE-2026-81319: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ash-project ashcloak allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node, by triggering unbounded atom creation or a decompression bomb during decryption. AshCloak.Calculations.Decrypt decodes the decrypte...

PT-2026-83624

Deserialization of Untrusted Data vulnerability in ash-project ash cloak allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node, by triggering unbounded atom creation or a decompression bomb during decryption. AshCloak.Calculations.Decrypt decodes the decrypt...

CVE-2026-58107

CodeChecker's massStoreRun processing path performs one-shot decompression of attacker-controlled, Base64-encoded zlib data without enforcing a maximum decompressed size. An authenticated user with permission to store analysis runs can submit a highly compressed payload that expands to a...

EUVD-2026-67717

CodeChecker's massStoreRun processing path performs one-shot decompression of attacker-controlled, Base64-encoded zlib data without enforcing a maximum decompressed size. An authenticated user with permission to store analysis runs can submit a highly compressed payload that expands to a...

PT-2026-83138

CodeChecker's massStoreRun processing path performs one-shot decompression of attacker-controlled, Base64-encoded zlib data without enforcing a maximum decompressed size. An authenticated user with permission to store analysis runs can submit a highly compressed payload that expands to a...

GHSA-6CCX-9C9F-327W gRPC Erlang package has unbounded gzip decompression (decompression bomb)

Summary An unauthenticated remote peer can crash any gRPC server built on this library by sending a small gzip-compressed frame that decompresses to gigabytes, exhausting the BEAM node's heap and triggering an OOM kill denial of service. Introduced in...