GHSA-F54X-CMQ8-QG57 pypdf: Possible large memory usage when parsing arrays and dictionaries

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing arrays and/or dictionaries with lots of elements. Patches This has been fixed in pypdf==6.21.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR 4218...

EUVD-2026-107330

pypdf: Possible large memory usage when parsing arrays and dictionaries...

pypdf: Possible large memory usage when parsing arrays and dictionaries

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing arrays and/or dictionaries with lots of elements. Patches This has been fixed in pypdf==6.21.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR 4218...

npm: Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays

npm: Next.js: Unauthenticated Remote Code Execution in use cache functions returning typed arrays vulnerability discovered by ? in WordPress npm next versions = 16.0.0, = 16.4.0...

DEBIAN-CVE-2026-113790

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing arrays or dictionaries with many elements, causing parsing to consume large amounts of memory. This issue is fixed in version 6.21.0...

CVE-2026-113790 pypdf: Possible large memory usage when parsing arrays and dictionaries

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing arrays or dictionaries with many elements, causing parsing to consume large amounts of memory. This issue is fixed in version 6.21.0...

CVE-2026-113790

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing arrays or dictionaries with many elements, causing parsing to consume large amounts of memory. This issue is fixed in version 6.21.0...

CVE-2026-113790 pypdf: Possible large memory usage when parsing arrays and dictionaries

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing arrays or dictionaries with many elements, causing parsing to consume large amounts of memory. This issue is fixed in version 6.21.0...

CVE-2026-113790

The pypdf pure-python PDF library is vulnerable to uncontrolled resource consumption prior to version 6.21.0 . An attacker can craft a malicious PDF containing arrays or dictionaries with a large number of elements, which causes the library to consume excessive amounts of memory during parsing. T...

CVE-2026-114115

Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parseIfExp that reads nested arrays with narrower inner bounds using the wider result type's memory layout. When a ternary selects the narrower array, inner arrays after the first are read at wrong offsets, causing...

EUVD-2026-106918

Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parseIfExp that reads nested arrays with narrower inner bounds using the wider result type's memory layout. When a ternary selects the narrower array, inner arrays after the first are read at wrong offsets, causing...

CVE-2026-114115

Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parseIfExp that reads nested arrays with narrower inner bounds using the wider result type's memory layout. When a ternary selects the narrower array, inner arrays after the first are read at wrong offsets, causing...

CVE-2021-48020 Vyper before 0.3.0 Memory Corruption via Internal Function Calls in Arrays

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are performed inside arrays. Contracts placing internal calls in nested array elements, external call arguments, struct literals, or rawlog topics can...

CVE-2021-48020

Vyper versions 0.1.0b4 before 0.3.0 are vulnerable to a memory corruption issue (CWE-787) triggered by an incorrect stack tip pointer . This occurs when internal function calls are performed within arrays . Specifically, contracts that place internal calls in nested array elements, external call ...

CVE-2020-37287

Vyper versions prior to 0.2.6 are susceptible to a call stack corruption vulnerability. The root cause is an incorrect assumption by the compiler that each subtype size is 32, which occurs when complex types with non-base members are passed as function arguments. This flaw leads to corrupted func...

CVE-2020-37287 Vyper before 0.2.6 Call Stack Corruption via Complex Type Function Arguments

Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passed as arguments. Contracts passing multi-dimensional arrays or structs to internal or external functions receive corrupted values because the...

PT-2026-120241

Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse IfExp that reads nested arrays with narrower inner bounds using the wider result type's memory layout. When a ternary selects the narrower array, inner arrays after the first are read at wrong offsets, causing...

Stack overflow when parsing deeply nested input in pest_grammars

Impact In affected versions, parsing deeply nested input with pestgrammars::json::JsonParser can exhaust the native stack and abort the hosting process. Applications that accept attacker-controlled JSON without suitable resource limits may therefore be vulnerable to denial of service. The reporte...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Avoid field-overflowing memcpy In preparation for FORTIFYSOURCE, we are performing compile-time and run-time field bounds checking for memcpy, memmove, and memset. Avoid intentionally writing across neighboring fields...

Astra Linux – Vulnerability in Jackson-Databind

In FasterXML Jackson-Databind before version 2.13.4, resource exhaustion can occur due to the lack of a check in BeanDeserializer.deserializeFromArray, which prevents the use of deeply nested arrays. An application becomes vulnerable only with certain customized choices for deserialization...