cpython: Python HTMLParser quadratic complexity

A denial-of-service DoS vulnerability has been discovered in Python's html.parser.HTMLParser class. When processing specially malformed HTML input, the parsing runtime can become quadratic with respect to the input size. This significantly increased processing time can lead to excessive resource...

python: Quadratic complexity in os.path.expandvars() with user-controlled template

A vulnerability in Python’s os.path.expandvars function that can cause performance degradation. When processing specially crafted, user-controlled input with nested environment variable patterns, the function exhibits quadratic time complexity, potentially leading to excessive CPU usage and denia...

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations

A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit CPU resources. This leads to...

CVE-2026-105812

Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values...

CVE-2026-105812 Code injection via unencoded configuration values during Python code generation in Bedrock AgentCore Starter Toolkit agent import

Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values...

EUVD-2026-94001

Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values...

CVE-2026-105812 Code injection via unencoded configuration values during Python code generation in Bedrock AgentCore Starter Toolkit agent import

Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values...

AZL-106712 CVE-2026-106454 affecting package python-twisted 22.10.0-6

Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and earlier, wildcardToRegexp in twisted/mail/imap4.py translates the IMAP asterisk and percent wildcards but passes all other characters from an authenticated client's LIST or LSUB pattern directly t...

CVE-2026-106441

Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.6 and 1.4.0.dev9, Hydra passes Python logging configuration to logging.config.dictConfig without applying Hydra's target policy to handler class values or formatter, filter, handler, queue, and listener factories. A...

CVE-2026-102266 affecting package python-jwt for versions less than 2.15.1-1

CVE-2026-102266 affecting package python-jwt for versions less than 2.15.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-102270 affecting package python-jwt for versions less than 2.15.1-1

CVE-2026-102270 affecting package python-jwt for versions less than 2.15.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-102269 affecting package python-jwt for versions less than 2.15.1-1

CVE-2026-102269 affecting package python-jwt for versions less than 2.15.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-101917 affecting package python-jwt for versions less than 2.15.1-1

CVE-2026-101917 affecting package python-jwt for versions less than 2.15.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-102267 affecting package python-jwt for versions less than 2.15.1-1

CVE-2026-102267 affecting package python-jwt for versions less than 2.15.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-102274 affecting package python-jwt for versions less than 2.15.1-1

CVE-2026-102274 affecting package python-jwt for versions less than 2.15.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-102265 affecting package python-jwt for versions less than 2.15.1-1

CVE-2026-102265 affecting package python-jwt for versions less than 2.15.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-102271 affecting package python-jwt for versions less than 2.15.1-1

CVE-2026-102271 affecting package python-jwt for versions less than 2.15.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-102275 affecting package python-jwt for versions less than 2.15.1-1

CVE-2026-102275 affecting package python-jwt for versions less than 2.15.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-101918 affecting package python-jwt for versions less than 2.15.1-1

CVE-2026-101918 affecting package python-jwt for versions less than 2.15.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-102268 affecting package python-jwt for versions less than 2.15.1-1

CVE-2026-102268 affecting package python-jwt for versions less than 2.15.1-1. An upgraded version of the package is available that resolves this issue...