pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a call to readuntilwhitespace with an input which does not have whitespace for a long time. PatchesThis has been fixed in pypdf==6.15.0. WorkaroundsIf you cannot upgrade yet, consider applyin...

Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`

SummaryWhile investigating Django REST Framework's request parsing behavior, I identified that DRF's high-level request.data parsing appears to bypass Django's configured DATAUPLOADMAXMEMORYSIZE protection for application/json and application/x-www-form-urlencoded request bodies.In the tested...

PYSEC-2026-3912 pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a call to readuntilwhitespace with an input which does not have whitespace for a long time. Patches This has been fixed in pypdf==6.15.0. Workarounds If you cannot upgrade yet, consider...

NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`

SummaryXMLCorpusView.readxmlfragment reads a corpus file in 1 KiB blocks, appendingeach block to a growing fragment string, then calls VALIDXMLRE.matchfragmenton the full accumulated buffer every iteration. Because each iteration rescans theentire accumulated fragment, the total amount of work...

Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

SummaryTornado parses application/x-www-form-urlencoded bodies with urllib.parse.parseqs and does not pass maxnumfields. A body made almost entirely of separators produces tens of millions of fields, and the parse happens on the event loop before the handler runs, so a single request stalls the...

PYSEC-2026-3928 Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

Summary Tornado parses application/x-www-form-urlencoded bodies with urllib.parse.parseqs and does not pass maxnumfields. A body made almost entirely of separators produces tens of millions of fields, and the parse happens on the event loop before the handler runs, so a single request stalls the...

PYSEC-2026-3911 pypdf: Possible long runtimes/large memory usage when extracting XForm objects

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires extracting the text of a page with lots of XForm objects, where some of them might be re-used. Patches This has been fixed in pypdf==6.16.1. Workarounds If you...

PYSEC-2026-3923 sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption

Summary When SQL is formatted with reindentation enabled, ReindentFilter repeatedly rebuilds prefixes of the current statement to calculate token offsets. An attacker who controls SQL sent to this opt-in formatting path can supply a parenthesized tuple list that remains just below the...

PYSEC-2026-3910 pypdf: Possible long runtimes/large memory usage when retrieving outlines

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires accessing the outlines of a document with either lots of entries or nested outlines with long re-used nesting paths. Patches This has been fixed in pypdf==6.16.1...

plone.app.event vulnerable to denial of service via iCalendar import

ImpactBy abusing the iCalendar import functionality, a logged-in editor could take the whole site offline, make the server reach into the internal network and read calendar files off disk SSRF, and store XSS. PatchesThe problem has been patched in plone.app.event. For Plone 6.2: upgrade to...

PYSEC-2026-3884 plone.app.portlets vulnerable to denial of service via RSS feed portlet

Impact By adding an RSS portlet, and giving this a link to a very large file, a member can cause a denial of service attack, because Plone will use lots of memory. The member could also use different urls to try to get information about the internal network and open port numbers SSRF. A malicious...

PYSEC-2026-3883 plone.app.event vulnerable to denial of service via iCalendar import

Impact By abusing the iCalendar import functionality, a logged-in editor could take the whole site offline, make the server reach into the internal network and read calendar files off disk SSRF, and store XSS. Patches The problem has been patched in plone.app.event. For Plone 6.2: upgrade to...

plone.app.portlets vulnerable to denial of service via RSS feed portlet

ImpactBy adding an RSS portlet, and giving this a link to a very large file, a member can cause a denial of service attack, because Plone will use lots of memory. The member could also use different urls to try to get information about the internal network and open port numbers SSRF. A malicious...

PYSEC-2026-3853 JupyterHub has Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login

Impact Invalid input to login resulted in unbounded logging output. Only form-based Authenticators the default PAM Authenticator, but not the more widely used OAuthenticator are affected. Patches Upgrade to 5.5.0. Workarounds Use an Authenticator that doesn't use a login form, such as...

JupyterHub has Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login

ImpactInvalid input to login resulted in unbounded logging output. Only form-based Authenticators the default PAM Authenticator, but not the more widely used OAuthenticator are affected. PatchesUpgrade to 5.5.0. WorkaroundsUse an Authenticator that doesn't use a login form, such as OAuthenticator...

icalendar has Algorithmic Complexity in Equality

SummaryComponent.eq compares subcomponents in O2^n time relative to nesting depth. Because the parser accepts arbitrarily nested components, a sub-kilobyte .ics file is enough to make a single equality check run for minutes or hang indefinitely. Any application that compares parsed components ==,...

Starlette-Admin's unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS

SummaryAffected versions of Starlette-Admin prior to 0.16.1 do not properly validate user-supplied sort and search parameters against the configured field allowlists. While the administrative UI restricts available fields based on field configuration, the backend accepts arbitrary field names...

PYSEC-2026-3851 icalendar has Algorithmic Complexity in Equality

Summary Component.eq compares subcomponents in O2^n time relative to nesting depth. Because the parser accepts arbitrarily nested components, a sub-kilobyte .ics file is enough to make a single equality check run for minutes or hang indefinitely. Any application that compares parsed components ==...

eml_parser has parser DoS via deeply nested parentheses in e-mail headers

Summaryemlparser uses the email.utils.getaddresses function from the CPython standard library to parse e-mail headers that contain e-mail addresses such as To, Cc, Bcc, From, Reply-To, Sender, .... When the input header contains a deeply nested CFWS comment / folding white space construct, the...

eml_parser vulnerable to DoS via deeply nested parens in Received headers

Summaryemlparser strips parenthesised CFWS comments from Received: headers using a regex-based fix-point loop. The loop has quadratic time complexity in the number of nested parens. A single Received: header containing 5,000 nested parens causes 1.3 seconds of CPU saturation per parsed message;...