CVE-2026-59951

A flaw was found in the Model Context Protocol MCP Python SDK. Stateful streamable HTTP servers fail to enforce idle session expiration or limits on active sessions, preventing terminated or rejected requests from releasing their resources. A remote attacker can exploit this issue by repeatedly...

CVE-2026-102946 joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.4, joserfc.jws.deserializejson accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verifygeneraljson loop performs no...

CVE-2026-102946 joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.4, joserfc.jws.deserializejson accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verifygeneraljson loop performs no...

Anthropic Claude Agent SDK for Python: Input validation vulnerability

The Anthropic Claude Agent SDK for Python versions prior to 0.2.121 contain security vulnerabilities. These vulnerabilities stem from the resumption option being passed as an independent token to the Claude CLI without verification. Values starting with a dash are interpreted as independent CLI...

Astra Linux – Vulnerability in Pypy

In the http.cookiejar.py module of Python, prior to version 3.7.3, the domain validation mechanism was not properly implemented. This vulnerability could allow existing cookies to be sent to the wrong server. Attackers could exploit this flaw by using a server whose hostname contains another vali...

Astra Linux – Vulnerability in Pypy, Jython

The documentation XML-RPC server in Python, from versions 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4, has XSS vulnerabilities due to the servertitle field. This issue occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If the setservertitle function ...

Astra Linux – vulnerability in python-urllib3

In the urllib3 library up to version 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter...

Astra Linux – vulnerability in python3.11, python3.7

When given a user-controlled command, the poplib module can inject additional commands via newline characters. Mitigation rejects commands containing control characters...

Astra Linux – vulnerability in python3.7, python2.7, pypy

An issue was found in Python versions prior to 3.8.18, 3.9.x prior to 3.9.18, 3.10.x prior to 3.10.13, and 3.11.x prior to 3.11.5. It primarily affects servers such as HTTP servers that employ TLS client authentication. When a TLS server-side socket is created, data is received into its buffer, a...

Astra Linux – Vulnerability found in Python 3.11, Python 2.7, Python 3.7, and Pypy

The email module in Python, as of version 3.11.3, incorrectly parses email addresses that contain special characters. The incorrect portion of the RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism by allowing access to...

Astra Linux – vulnerability in python2.7, python3.7

The urllib.parse.urlsplit and urlparse functions improperly validate bracketed hosts , allowing hosts that are not IPv6 or IPvFuture. This behavior does not comply with RFC 3986 and may enable SSRF if a URL is processed by multiple URL parsers...

Astra Linux – vulnerability in python-tornado

Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data was the maxbodysize setting default 100MB. Since parsing occurs synchronously on the main thread, this creates the possibility...

Astra Linux – Vulnerability in Python-Werkzeug

Werkzeug is a comprehensive WSGI web application library. Browsers may allow “nameless” cookies that look like =value instead of key=value. A vulnerable browser may allow a compromised application on a neighboring subdomain to exploit this to set a cookie like =Host-test=bad for another subdomain...

Astra Linux – Vulnerabilities in Python 2.7, Python 3.11, Python 3.7

When constructing nested elements using XMLDom.minidom methods like appendChild, which rely on clearidcache, the algorithm has a quadratic complexity. This can affect the availability of documents when they are constructed with excessively nested structures...

Astra Linux – Vulnerability in python-jwcrypto

JWCrypto implements the JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker could cause a denial-of-service attack by passing in a malicious JWE Token with a high compression ratio. When the server processed this token, it would consume a lot of memory...

Astra Linux – Vulnerabilities in Python 2.7, Python 3.7, and Pypy

A XXE issue was discovered in Python through version 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to prevent XML vulnerabilities...

Astra Linux – vulnerability in python2.7, python3.7

An issue was found in comparedigest within Lib/hmac.py for Python up to version 3.9.1. Constant-time-defeating optimizations could be applied to the accumulator variable used in hmac.comparedigest...

Astra Linux – Vulnerability in python-urllib3

The urllib3 library before version 1.24.2 in Python mishandles certain cases where the desired set of CA certificates differs from the CA certificates stored in the operating system’s store. As a result, SSL connections succeed in situations where a verification failure would be the correct...

Astra Linux – vulnerability in lxml

Lxml is a library for processing XML and HTML in Python. Prior to version 6.1.0, using either of the two parsers with the default configuration with resolveentities=True allowed untrusted XML input to read local files. Setting the resolveentities option explicitly to resolveentities='internal' or...

Astra Linux – Vulnerability in python-cryptography

A flaw was discovered in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which could result in the exposure of confidential or sensitive data...