90 matches found
PYSEC-2026-4064 lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard
Summary LightRAG's native markdown parser downloads external images referenced by an uploaded markdown or textpack document. The only SSRF guard, validatedaddresses in lightrag/parser/markdown/parser.py, resolves the image host and rejects it when the resolved IP is not isglobal. That check is...
lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard
SummaryLightRAG's native markdown parser downloads external images referenced by an uploaded markdown or textpack document. The only SSRF guard, validatedaddresses in lightrag/parser/markdown/parser.py, resolves the image host and rejects it when the resolved IP is not isglobal. That check is...
PT-2026-105820
Summary LightRAG's native markdown parser downloads external images referenced by an uploaded markdown or textpack document. The only SSRF guard, validated addresses in lightrag/parser/markdown/parser.py, resolves the image host and rejects it when the resolved IP is not is global. That check is...
lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard
Summary LightRAG's native markdown parser downloads external images referenced by an uploaded markdown or textpack document. The only SSRF guard, validatedaddresses in lightrag/parser/markdown/parser.py, resolves the image host and rejects it when the resolved IP is not isglobal. That check is...
Server-side Request Forgery (SSRF)
Overview lightrag-hku is a LightRAG: Simple and Fast Retrieval-Augmented Generation Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the unwrapembeddedipv4 function in lightrag/parser/markdown/parser.py, where the RFC 8215 local-use NAT64 prefix...
CVE-2026-85740 LightRAG: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, validatedaddresses in lightrag/parser/markdown/parser.py evaluates the literal resolved address with ipaddress.isglobal without consistently classifying an IPv4 address embedded in an IPv6 transition wrapper. A call...
CVE-2026-85740
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, validatedaddresses in lightrag/parser/markdown/parser.py evaluates the literal resolved address with ipaddress.isglobal without consistently classifying an IPv4 address embedded in an IPv6 transition wrapper. A call...
CVE-2026-85740: Server-Side Request Forgery (SSRF)
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, validatedaddresses in lightrag/parser/markdown/parser.py evaluates the literal resolved address with ipaddress.isglobal without consistently classifying an IPv4 address embedded in an IPv6 transition wrapper. A call...
PT-2026-94387
Name of the Vulnerable Software and Affected Versions Soup Sieve versions prior to 2.9 Description A Regular Expression Denial of Service ReDoS exists in the selector parser located in src/soupsieve/css parser.py. The IDENTIFIER pattern uses adjacent quantified groups over overlapping character...
CVE-2026-55618: Improper Encoding or Escaping of Output
emlparser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, the cleanfounduri function in emlparser/parser.py validates potential URL strings before unescaping HTML entities used for colon, slash,...
CLSA-2026-1785886363 Fix CVE(s): CVE-2025-69534
SECURITY UPDATE: unhandled NotImplementedError denial-of-service in the html.parser module when parsing malformed markup declarations - debian/patches/CVE-2025-69534.patch: narrow the marked-section dispatch in parsehtmldeclaration in Lib/html/parser.py so only "!CDATA" is routed to...
CLSA-2026-1784297320 Fix CVE(s): CVE-2026-15308
SECURITY UPDATE: CPU denial-of-service in the html.parser module via repeated unterminated markup declarations quadratic complexity in the incremental HTMLParser - debian/patches/CVE-2026-15308.patch: accumulate pending data in feed and parse on a doubling threshold instead of rescanning the whol...
CLSA-2026-1784270796 Fix CVE(s): CVE-2026-15308
SECURITY UPDATE: CPU denial-of-service in the html.parser module via repeated unterminated markup declarations quadratic complexity in the incremental HTMLParser - debian/patches/CVE-2026-15308.patch: accumulate pending data in feed and parse on a doubling threshold instead of rescanning the whol...
PYSEC-2026-1878 FaucetSDN Ryu Denial of Service Vulnerability
An issue was discovered in OFPQueueGetConfigReply in parser.py in FaucetSDN Ryu version 4.34, allows remote attackers to cause a denial of service DoS infinite loop...
CVE-2026-3816: Improper Resource Shutdown or Release
A security vulnerability has been detected in OWASP DefectDojo up to 2.55.4. This vulnerability affects the function inputzip.read of the file parser.py of the component SonarQubeParser/MSDefenderParser. The manipulation leads to denial of service. The attack can be initiated remotely. The exploi...
CVE-2024-34487
OFPFlowStats in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service infinite loop via inst.length=0...
EUVD-2023-2220
Malicious code in bioql PyPI...
EUVD-2023-2205
Malicious code in bioql PyPI...