CLSA-2026-1773706636 TuxCare security update for json5 (1 CVE)

TuxCare rebuilt json5 to address 1 CVE. Fixed in 0.5.1-tuxcare.1...

CLSA-2026-1773793045 TuxCare security update for is-my-json-valid (2 CVEs)

TuxCare rebuilt is-my-json-valid to address 2 CVEs. Fixed in 2.10.1-tuxcare.1...

CLSA-2026-1773015261 TuxCare security update for ajv (1 CVE)

TuxCare rebuilt ajv to address 1 CVE. Fixed in 8.11.0-tuxcare.1...

CLSA-2026-1773015272 TuxCare security update for is-my-json-valid (2 CVEs)

TuxCare rebuilt is-my-json-valid to address 2 CVEs. Fixed in 2.12.2-tuxcare.1...

CLSA-2026-1773015260 TuxCare security update for ajv (1 CVE)

TuxCare rebuilt ajv to address 1 CVE. Fixed in 8.17.1-tuxcare.3...

CLSA-2025-1761091596 TuxCare security update for org.json:json (1 CVE)

TuxCare rebuilt org.json:json to address 1 CVE. Fixed in 20140107-tuxcare.2...

CLSA-2025-1761177997 TuxCare security update for org.json:json (1 CVE)

TuxCare rebuilt org.json:json to address 1 CVE. Fixed in 20090211-tuxcare.3...

CLSA-2025-1760313982 TuxCare security update for org.json:json (1 CVE)

TuxCare rebuilt org.json:json to address 1 CVE. Fixed in 20140107-tuxcare.1...

CVE-2026-68494

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength into a new setIntLength helper and invoked it...

CVE-2026-18401

The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length,...

CVE-2026-18401

The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length,...

datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`

Summarydatamodel-code-generator resolves JSON-Schema $ref targets that point at the local filesystem without restricting them to the input/base directory and without honoring the remote-reference security control. In the default configuration, an attacker who controls an input schema a "paste you...

datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)

SummaryJSON-Schema $ref values pointing at HTTP or HTTPS URLs are silently dereferenced by datamodel-code-generator with no IP/host validation, no scheme allow-list, and redirects followed unconditionally. The --allow-remote-refs gate added in 0.56.0 defaults to None, which only emits a deprecati...

`datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field

Summarydatamodel-code-generator is vulnerable to code injection when generating Python models from an attacker-controlled JSON Schema, OpenAPI, YAML, JSON, Avro, Protobuf, or XSD schema. When a property carries a "defaultfactory" key, its value is interpolated verbatim — as a raw Python expressio...

PYSEC-2026-3555 `datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field

Summary datamodel-code-generator is vulnerable to code injection when generating Python models from an attacker-controlled JSON Schema, OpenAPI, YAML, JSON, Avro, Protobuf, or XSD schema. When a property carries a "defaultfactory" key, its value is interpolated verbatim — as a raw Python expressi...

PYSEC-2026-3560 datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)

Summary JSON-Schema $ref values pointing at HTTP or HTTPS URLs are silently dereferenced by datamodel-code-generator with no IP/host validation, no scheme allow-list, and redirects followed unconditionally. The --allow-remote-refs gate added in 0.56.0 defaults to None, which only emits a...

`datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator

Summarydatamodel-code-generator honours a custom x-python-type JSON-Schema extension that lets a schema author override the generated Python type for a field. The value is forwarded verbatim into the generated Python source as the field annotation, with a single sanitisation pass that is trivial ...

PYSEC-2026-3562 `datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator

Summary datamodel-code-generator honours a custom x-python-type JSON-Schema extension that lets a schema author override the generated Python type for a field. The value is forwarded verbatim into the generated Python source as the field annotation, with a single sanitisation pass that is trivial...

PYSEC-2026-3595 Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

Summary With Redis configured, Open WebUI supports JWT revocation: POST /api/v1/auths/signout per-token jti and OIDC back-channel logout per-user revokedat record revocations in Redis, and HTTP auth getcurrentuser rejects revoked tokens with 401. The realtime authentication surfaces do not perfor...

Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

SummaryWith Redis configured, Open WebUI supports JWT revocation: POST /api/v1/auths/signout per-token jti and OIDC back-channel logout per-user revokedat record revocations in Redis, and HTTP auth getcurrentuser rejects revoked tokens with 401. The realtime authentication surfaces do not perform...