97 matches found
PYSEC-2026-83
LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB both sync and async, via aiosqlite. In version 1.0.9 and prior, LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can...
CVE-2026-28277 LangGraph: Unsafe msgpack deserialization in LangGraph checkpoint loading
LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB both sync and async, via aiosqlite. In version 1.0.9 and prior, LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can...
CVE-2026-28277 LangGraph: Unsafe msgpack deserialization in LangGraph checkpoint loading
LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB both sync and async, via aiosqlite. In version 1.0.9 and prior, LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can...
CVE-2026-28277
CVE-2026-28277 affects LangGraph checkpoint loading using an SQLite-backed checkpoint store. In versions ≤1.0.9, msgpack-encoded checkpoints may deserialize into Python objects, enabling an attacker with write access to the checkpoint store to craft payloads that trigger unsafe reconstruction whe...
SUSE CVE-2026-25899
Fiber is an Express inspired web framework written in Go. In versions on the v3 branch prior to 3.1.0, the use of the fiberflash cookie can force an unbounded allocation on any server. A crafted 10-character cookie value triggers an attempt to allocate up to 85GB of memory via unvalidated msgpack...
CVE-2026-27794
A flaw was found in LangGraph Checkpoint. This vulnerability allows a remote attacker with write access to the cache backend to achieve remote code execution. This occurs when applications enable cache backends that inherit from BaseCache and opt nodes into caching via CachePolicy. If msgpack...
langgraph 代码问题漏洞
Langgraph is a large-scale model framework developed by LangChain. Versions of Langgraph prior to 4.0.0 had code-related vulnerabilities. These vulnerabilities stemmed from the caching layer’s ability to deserialize cached values using pickle.loads when msgpack serialization fails, potentially...
CVE-2026-25899
Fiber is an Express inspired web framework written in Go. In versions on the v3 branch prior to 3.1.0, the use of the fiberflash cookie can force an unbounded allocation on any server. A crafted 10-character cookie value triggers an attempt to allocate up to 85GB of memory via unvalidated msgpack...
GHSA-2MR3-M5Q5-WGP6 Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation
Summary The use of the fiberflash cookie can force an unbounded allocation on any server. A crafted 10-character cookie value triggers an attempt to allocate up to 85GB of memory via unvalidated msgpack deserialization. No authentication is required. Every GoFiber v3 endpoint is affected regardle...
Memory Allocation with Excessive Size Value
Overview github.com/gofiber/fiber/v3 is an Express inspired web framework written in Go. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the parseAndClearFlashMessages function. An attacker can cause excessive memory allocation by sending a...
Fiber 安全漏洞
Fiber is an open-source web framework written in Go language. Versions of Fiber prior to 3.1.0 have a security vulnerability. This vulnerability stems from the fiberflash cookie, which can trigger excessive memory allocation through unvalidated msgpack deserialization, potentially leading to...
ai.mantik:ds_2.12 (>=0.3.0 <=0.3.1-rc2), ai.mantik:ds_2.13 (>=0.4.0 <=0.4.0-rc1) +1285 more potentially affected by CVE-2026-21452 via org.msgpack:msgpack-core (>=0.7.0-M1 <=0.9.10)
org.msgpack:msgpack-core MAVEN version =0.7.0-M1, =0.3.0, =0.4.0, =0.3.0, =0.4.0, =0.3.0, =0.4.0, =0.3.0, =0.4.0, =0.4.0, =0.3.0, =0.4.0, =0.3.0, =0.4.0, =0.3.0, =0.4.0, =0.4.0-rc1 and more Source cves: CVE-2026-21452 Source advisory: OSV:GHSA-CW39-R4H6-8J3X...
Memory Allocation with Excessive Size Value
Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the deserialization process of .msgpack files containing EXT32 objects. An attacker can exhaust system memory and cause service unavailability by submitting a specially crafted .msgpack fil...
ai.mantik:ds_2.12 (>=0.3.0 <=0.3.1-rc2), ai.mantik:ds_2.13 (>=0.4.0 <=0.4.0-rc1) +1283 more potentially affected by CVE-2026-21452 via org.msgpack:msgpack-core (>=0.7.0-M6 <=0.9.10)
org.msgpack:msgpack-core MAVEN version =0.7.0-M6, =0.3.0, =0.4.0, =0.3.0, =0.4.0, =0.3.0, =0.4.0, =0.3.0, =0.4.0, =0.4.0, =0.3.0, =0.4.0, =0.3.0, =0.4.0, =0.3.0, =0.4.0, =0.4.0-rc1 and more Source cves: CVE-2026-21452 Source advisory: SNYK:JAVA-ORGMSGPACK-14857714...
Litestar allows unbounded resource consumption (DoS vulnerability)
Summary Litestar offers multiple methods to return a parsed representation of the request body, as well as extractors that rely on those parsers to map request content to structured data types. Multiple of those parsers do not have size limits when reading the request body into memory, which allo...
Fedora: Security Advisory (FEDORA-2024-e7bb8bc2da)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] Fedora 40 Update: lua-mpack-1.0.12-1.fc40
mpack is a small binary serialization/RPC library that implements both the msgpack and msgpack-rpc specifications...
[SECURITY] Fedora 39 Update: lua-mpack-1.0.12-1.fc39
mpack is a small binary serialization/RPC library that implements both the msgpack and msgpack-rpc specifications...
