io.spinnaker.echo:echo-api-tck (2.44.4), io.spinnaker.echo:echo-notifications (2.44.4) +6 more potentially affected by CVE-2026-32613 via io.spinnaker.echo:echo-pipelinetriggers (2.44.4)

io.spinnaker.echo:echo-pipelinetriggers MAVEN version 2.44.4 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.echo:echo-pipelinetriggers and may be impacted: - io.spinnaker.echo:echo-api-tck 2.44.4 - io.spinnaker.echo:echo-notifications...

io.spinnaker.echo:echo-api-tck (main-284), io.spinnaker.echo:echo-notifications (main-284) +6 more potentially affected by CVE-2026-32613 via io.spinnaker.echo:echo-pipelinetriggers (main-284)

io.spinnaker.echo:echo-pipelinetriggers MAVEN version main-284 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.echo:echo-pipelinetriggers and may be impacted: - io.spinnaker.echo:echo-api-tck main-284 - io.spinnaker.echo:echo-notifications...

io.spinnaker.echo:echo-api-tck (main-304), io.spinnaker.echo:echo-notifications (main-304) +6 more potentially affected by CVE-2026-32613 via io.spinnaker.echo:echo-pipelinetriggers (main-304)

io.spinnaker.echo:echo-pipelinetriggers MAVEN version main-304 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.echo:echo-pipelinetriggers and may be impacted: - io.spinnaker.echo:echo-api-tck main-304 - io.spinnaker.echo:echo-notifications...

io.spinnaker.echo:echo-api-tck (main-310), io.spinnaker.echo:echo-notifications (main-310) +6 more potentially affected by CVE-2026-32613 via io.spinnaker.echo:echo-pipelinetriggers (main-310)

io.spinnaker.echo:echo-pipelinetriggers MAVEN version main-310 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.echo:echo-pipelinetriggers and may be impacted: - io.spinnaker.echo:echo-api-tck main-310 - io.spinnaker.echo:echo-notifications...

io.spinnaker.echo:echo-api-tck (2.43.1), io.spinnaker.echo:echo-notifications (2.43.1) +6 more potentially affected by CVE-2026-32613 via io.spinnaker.echo:echo-pipelinetriggers (2.43.1)

io.spinnaker.echo:echo-pipelinetriggers MAVEN version 2.43.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.echo:echo-pipelinetriggers and may be impacted: - io.spinnaker.echo:echo-api-tck 2.43.1 - io.spinnaker.echo:echo-notifications...

io.spinnaker.echo:echo-api-tck (main-326), io.spinnaker.echo:echo-notifications (main-326) +6 more potentially affected by CVE-2026-32613 via io.spinnaker.echo:echo-pipelinetriggers (main-326)

io.spinnaker.echo:echo-pipelinetriggers MAVEN version main-326 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.echo:echo-pipelinetriggers and may be impacted: - io.spinnaker.echo:echo-api-tck main-326 - io.spinnaker.echo:echo-notifications...

io.spinnaker.echo:echo-api-tck (main-286), io.spinnaker.echo:echo-notifications (main-286) +6 more potentially affected by CVE-2026-32613 via io.spinnaker.echo:echo-pipelinetriggers (main-286)

io.spinnaker.echo:echo-pipelinetriggers MAVEN version main-286 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.echo:echo-pipelinetriggers and may be impacted: - io.spinnaker.echo:echo-api-tck main-286 - io.spinnaker.echo:echo-notifications...

core-aws (>=1.1.0, <=1.3.0), mind-castle (0.4.7) potentially affected by CVE-2026-6550 via aws-encryption-sdk (>=4.0.0, <=4.0.3)

aws-encryption-sdk PYPI version =4.0.0, =1.1.0, =1.3.0 - mind-castle 0.4.7 Source cves: CVE-2026-6550 Source advisory: SNYK:PYTHON-AWSENCRYPTIONSDK-16115497...

cloudformation-cli-python-lib (>=2.1.12, <=2.1.16), core-aws (>=1.0.0, <=1.0.4) +4 more potentially affected by CVE-2026-6550 via aws-encryption-sdk (>=3.1.0, <=3.3.0)

aws-encryption-sdk PYPI version =3.1.0, =2.1.12, =1.0.0, =1.0.1, =0.4.8, =25.13.0rc1, =0.9.1, =1.2.2 Source cves: CVE-2026-6550 Source advisory: SNYK:PYTHON-AWSENCRYPTIONSDK-16115497...

Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')

Overview aws-encryption-sdk is an AWS Encryption SDK implementation for Python Affected versions of this package are vulnerable to Selection of Less-Secure Algorithm During Negotiation 'Algorithm Downgrade' via the shared key cache. An attacker can bypass key commitment policy enforcement by...

io.spinnaker.echo:echo-api-tck (>=2026.0-19, <=2026.0-23), io.spinnaker.echo:echo-notifications (>=2026.0-19, <=2026.0-23) +6 more potentially affected by CVE-2026-32613 via io.spinnaker.echo:echo-pipelinetriggers (>=2026.0-19, <=2026.0-23)

io.spinnaker.echo:echo-pipelinetriggers MAVEN version =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-23 Source cves: CVE-2026-32613 Source advisory: MEND:CVE-2026-32613...

io.spinnaker.echo:echo-api-tck (>=main-272, <=2.47.2), io.spinnaker.echo:echo-notifications (>=main-272, <=2.47.2) +6 more potentially affected by CVE-2026-32613 via io.spinnaker.echo:echo-pipelinetriggers (>=main-272, <=2.47.2)

io.spinnaker.echo:echo-pipelinetriggers MAVEN version =main-272, =main-272, =main-272, =main-272, =main-272, =main-272, =main-272, =main-272, =main-272, =2.47.2 Source cves: CVE-2026-32613 Source advisory: MEND:CVE-2026-32613...

core-aws (>=1.1.0, <=1.3.0), mind-castle (0.4.7) potentially affected by CVE-2026-6550 via aws-encryption-sdk (>=4.0.0, <=4.0.3)

aws-encryption-sdk PYPI version =4.0.0, =1.1.0, =1.3.0 - mind-castle 0.4.7 Source cves: CVE-2026-6550 Source advisory: MEND:CVE-2026-6550...

aws-encryption-sdk-cli (>=1.8.0, <=3.1.0), cloud-backup (1.0.0) +7 more potentially affected by CVE-2026-6550 via aws-encryption-sdk (>=1.3.7, <=3.3.0)

aws-encryption-sdk PYPI version =1.3.7, =1.8.0, =2.1.9, =1.0.0, =1.0.1, =0.4.8, =25.13.0rc1, =0.9.1, =1.0.2, =1.0.17 Source cves: CVE-2026-6550 Source advisory: MEND:CVE-2026-6550...

CVE-2026-6550

The vulnerability CVE-2026-6550 affects the AWS Encryption SDK for Python in its caching layer. A cryptographic downgrade in the key cache could allow an authenticated local actor to bypass key commitment policy enforcement, enabling ciphertext to be decrypted into multiple possible plaintexts. A...

aws-lambda-sls (0.1.0), chalice (1.6.1) +4 more potentially affected by CVE-2026-3219 via pip (18.0.0)

pip PYPI version 18.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - aws-lambda-sls 0.1.0 - chalice 1.6.1 - lucterios =2.3.0.18073018, =2.3.0.18070609, =2.3.0.18070422, =2.3.1.18112821 - venv-update 3.1.1 Source cves:...

CVE-2026-6550: Selection of Less-Secure Algorithm During Negotiation

Cryptographic algorithm downgrade in the caching layer of Amazon AWS Encryption SDK for Python before version 3.3.1 and before version 4.0.5 might allow an authenticated local threat actor to bypass key commitment policy enforcement via a shared key cache, resulting in ciphertext that can be...

dagit (0.13.6), dagster-airflow (0.13.6) +31 more potentially affected by CVE-2026-41490 via dagster (0.13.6)

dagster PYPI version 0.13.6 is affected by a known vulnerability. The following packages have a transitive dependency on dagster and may be impacted: - dagit 0.13.6 - dagster-airflow 0.13.6 - dagster-aws 0.13.6 - dagster-azure 0.13.6 - dagster-celery 0.13.6 - dagster-celery-docker 0.13.6 -...

dagit (0.12.11rc0), dagster-airflow (0.12.11rc0) +28 more potentially affected by CVE-2026-41490 via dagster (0.12.11rc0)

dagster PYPI version 0.12.11rc0 is affected by a known vulnerability. The following packages have a transitive dependency on dagster and may be impacted: - dagit 0.12.11rc0 - dagster-airflow 0.12.11rc0 - dagster-aws 0.12.11rc0 - dagster-azure 0.12.11rc0 - dagster-cloud 0.12.11rc0 - dagster-dask...

dagit (0.13.10rc3), dagster-airflow (0.13.10rc3) +30 more potentially affected by CVE-2026-41490 via dagster (0.13.10rc3)

dagster PYPI version 0.13.10rc3 is affected by a known vulnerability. The following packages have a transitive dependency on dagster and may be impacted: - dagit 0.13.10rc3 - dagster-airflow 0.13.10rc3 - dagster-aws 0.13.10rc3 - dagster-azure 0.13.10rc3 - dagster-celery 0.13.10rc3 -...