Astra Linux – Vulnerability in python-urllib3

urllib3 is a HTTP client library for Python. The streaming API of urllib3 is designed for efficiently handling large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP...

Astra Linux – Vulnerability in pyasn1

pyasn1 is a generic ASN.1 library for Python. Prior to version 0.6.3, the pyasn1 library was vulnerable to a Denial of Service DoS attack caused by uncontrolled recursion during the decoding of ASN.1 data with deeply nested structures. An attacker could provide a crafted payload containing...

Quadratic Behavior in xml.etree.ElementPath Index Predicates

...

CVE-2026-71554 h2: Duplicate Host header could facilitate request smuggling

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request...

ROOT-APP-PYPI-CVE-2025-24793 CVE-2025-24793 in snowflake-connector-python - Patched by Root

Root has patched CVE-2025-24793 in the snowflake-connector-python package for Root:PyPI. Multiple fixed versions available...

MAL-2026-11503 Malicious code in instalogin1234 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c7d01985e4b5c4afe1e4aafc0eb9a3d97feb1eacae68ef70adf962846392460 The package presents itself as a 'Modern Instagram CLI' but its login command displays a fake Instagram login prompt that reads a username and passwo...

[SECURITY] Fedora 43 Update: GitPython-3.1.55-1.fc43

GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. It provides abstractions of git objects for easy access of repository data, a nd additionally allows you to access the git repository more directly using eith er a...

BIT-LIBPYTHON-2026-11972 tarfile opened in streaming mode mishandles EOF

When using the "tarfile" module with a file opened in "streaming mode" mode="r|" the tarfile module did not properly handle EOF, making archive parsing take exponentially longer...

CVE-2026-62995

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. in versions 1.7.1 and prior, joserfc accepts JWTs with trailing padding == which are not conforming to the JOSE specifications. This leads to malleability of the JWTs when...

UBUNTU-CVE-2026-62995

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. in versions 1.7.1 and prior, joserfc accepts JWTs with trailing padding == which are not conforming to the JOSE specifications. This leads to malleability of the JWTs when...

CVE-2026-62995

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. in versions 1.7.1 and prior, joserfc accepts JWTs with trailing padding == which are not conforming to the JOSE specifications. This leads to malleability of the JWTs when...

RockyLinux 8 : python-urllib3 (RLSA-2026:36732)

The remote RockyLinux 8 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2026:36732 advisory. urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers CVE-2026-44431 Tenable has extracted the preceding description...

K000162114: Python urllib3 vulnerability CVE-2025-66418

Security Advisory Description urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps, leading to...

SUSE SLED15 / SLES15 Security Update : python-pyasn1 (SUSE-SU-2026:3238-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3238-1 advisory. - CVE-2026-59884: BER/CER/DER decoder denial of service via unbounded long-form tag IDs bsc1271464. -...

[SECURITY] Fedora 43 Update: python-idna-3.18-1.fc43

A library to support the Internationalised Domain Names in Applications IDNA protocol as specified in RFC 5891 . This version of the protocol is often referred to as "IDNA2008" and can produce different results from the earlier standard from 2003. The library is also intended to act as a suitable...

[SECURITY] Fedora 44 Update: python-libcst-1.8.6-4.fc44

LibCST parses Python source code as a CST tree that keeps all formatting details comments, whitespaces, parentheses, etc. It's useful for building automated refactoring codemod applications and linters. LibCST creates a compromise between an Abstract Syntax Tree AST and a traditional Concrete...

Linux Distros Unpatched Vulnerability : CVE-2026-47183

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming.logexceptiondebug and the four QuietLogger...

UBUNTU-CVE-2026-49852

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.6.8, joserfc.jwt.decode accepts attacker-forged HMAC-signed tokens when the caller-supplied verification key is the empty string or None, because HMACAlgorithm.sign...

CVE-2026-49852

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.6.8, joserfc.jwt.decode accepts attacker-forged HMAC-signed tokens when the caller-supplied verification key is the empty string or None, because HMACAlgorithm.sign...

CVE-2026-48487

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.16, readcharacterstring and readstring in src/zeroconf/protocol/incoming.py advanced self.offset by attacker-declared RDLENGTH without checking it against self.datalen, allowing unauthenticated hosts on th...