Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation

SummaryAutobahn Python enforces maxMessagePayloadSize against the compressed WebSocket frame length before permessage-deflate inflation, then delivers the inflated message to application callbacks without a second size check. A client frame that is only 22 compressed bytes can inflate to 4096 byt...

Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation

SummaryAutobahn Python enforces maxMessagePayloadSize against the compressed WebSocket frame length before permessage-deflate inflation, then delivers the inflated message to application callbacks without a second size check. A client frame that is only 22 compressed bytes can inflate to 4096 byt...

PYSEC-2026-4027 Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation

Summary Autobahn Python enforces maxMessagePayloadSize against the compressed WebSocket frame length before permessage-deflate inflation, then delivers the inflated message to application callbacks without a second size check. A client frame that is only 22 compressed bytes can inflate to 4096...

PYSEC-2026-4031 Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation

Summary Autobahn Python enforces maxMessagePayloadSize against the compressed WebSocket frame length before permessage-deflate inflation, then delivers the inflated message to application callbacks without a second size check. A client frame that is only 22 compressed bytes can inflate to 4096...

geometron (>=0.0.1.dev7, <=0.0.3), metaplex-python-api (>=1.0.0, <=1.3.0) +1 more potentially affected by CVE-2026-63374 via anyio (3.3.4)

anyio PYPI version 3.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - geometron =0.0.1.dev7, =1.0.0, =1.4.46, =3.0.3 Source cves: CVE-2026-63374 Source advisory: OSV:PYSEC-2026-4025...

geometron (>=0.0.1.dev7, <=0.0.3), metaplex-python-api (>=1.0.0, <=1.3.0) +1 more potentially affected by CVE-2026-64847 via anyio (3.3.4)

anyio PYPI version 3.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on anyio and may be impacted: - geometron =0.0.1.dev7, =1.0.0, =1.4.46, =3.0.3 Source cves: CVE-2026-64847 Source advisory: OSV:PYSEC-2026-4024...

fpx (>=0.4.0, <=0.4.9), hcaptcha-challenger (>=0.4.2, <=0.4.2.1) +4 more potentially affected by CVE-2026-85078 via sanic (22.6.2)

sanic PYPI version 22.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on sanic and may be impacted: - fpx =0.4.0, =0.4.2, =0.4.0, =2.2.0, =3.4.5.dev8, =3.4.10.dev2 Source cves: CVE-2026-85078 Source advisory: OSV:PYSEC-2026-4162...

python-signal-cli-rest-api (>=22.9.1, <=22.10.6) potentially affected by CVE-2026-85078 via sanic (22.9.0)

sanic PYPI version 22.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on sanic and may be impacted: - python-signal-cli-rest-api =22.9.1, =22.10.6 Source cves: CVE-2026-85078 Source advisory: OSV:PYSEC-2026-4162...

PickleScan has multiple stdlib modules with direct RCE not in blocklist

Summarypicklescan v1.0.3 latest does not block at least 7 Python standard library modules that provide direct arbitrary command execution or code evaluation. A malicious pickle file importing these modules is reported as having 0 issues CLEAN scan. This enables remote code execution that bypasses...

PYSEC-2026-4134 PickleScan has multiple stdlib modules with direct RCE not in blocklist

Summary picklescan v1.0.3 latest does not block at least 7 Python standard library modules that provide direct arbitrary command execution or code evaluation. A malicious pickle file importing these modules is reported as having 0 issues CLEAN scan. This enables remote code execution that bypasse...

PYSEC-2026-4133 Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.fetch_completions

Summary Using idlelib.autocomplete.AutoComplete.fetchcompletions, which is a built-in python library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to...

Picklescan missing detection when calling built-in python library function timeit.timeit()

SummaryUsing timeit.timeit function, which is a built-in python library function to execute remote pickle file. DetailsPickle’s deserialization process is known to allow execution of function via reduce method. While Picklescan is meant to detect such exploits, this attack evades detection by...

PYSEC-2026-4135 Picklescan missing detection when calling built-in python library function timeit.timeit()

Summary Using timeit.timeit function, which is a built-in python library function to execute remote pickle file. Details Pickle’s deserialization process is known to allow execution of function via reduce method. While Picklescan is meant to detect such exploits, this attack evades detection by...

SUSE-SU-2026:4411-1 Security update for python

This update for python fixes the following issues: - CVE-2026-6879: quadratic behavior in xml.etree.ElementPath index predicates can lead to a denial of service via high CPU usage bsc1273148. - CVE-2026-9669: crafted input can cause a stack buffer overflow bsc1267974. - CVE-2026-15806:...

Security update for python

This update for python fixes the following issues: CVE-2026-6879: quadratic behavior in xml.etree.ElementPath index predicates can lead to a denial of service via high CPU usage bsc1273148. CVE-2026-9669: crafted input can cause a stack buffer overflow bsc1267974. CVE-2026-15806:...

cellmerge (>=0.1.0, <=0.1.1), jupyter-quant (2606.1.0) +5 more potentially affected by CVE-2026-102830 via jupyterlab (>=4.6.0, <=4.6.2)

jupyterlab PYPI version =4.6.0, =0.1.0, =1.2.0, =0.1.0, =0.1.1 - tiatoolbox 2.1.3 Source cves: CVE-2026-102830 Source advisory: GHSA-3JQQ-PW4J-PQCJ...

cellmerge (>=0.1.0, <=0.1.1), jupyter-quant (2606.1.0) +5 more potentially affected by CVE-2026-102831 via jupyterlab (>=4.6.0, <=4.6.2)

jupyterlab PYPI version =4.6.0, =0.1.0, =1.2.0, =0.1.0, =0.1.1 - tiatoolbox 2.1.3 Source cves: CVE-2026-102831 Source advisory: GHSA-6966-VJJ6-99XV...

ablator (0.0.1b3), apollo-sdk (>=0.2.0, <=0.2.11) +29 more potentially affected by CVE-2026-102937 via virtualenv (20.21.0)

virtualenv PYPI version 20.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ablator 0.0.1b3 - apollo-sdk =0.2.0, =0.8.3b20231012, =0.8.3b20231012, =0.6.1, =1.2.1, =0.1.3, =0.7.2, =0.2.8, =0.0.1, =1.7.16, =0.4.0rc6,...

cabrita (>=2.2.2b1, <=2.2.2b2), kaze-python (>=0.7.8, <=0.8.9) +2 more potentially affected by CVE-2026-102937 via virtualenv (16.0.0)

virtualenv PYPI version 16.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cabrita =2.2.2b1, =0.7.8, =0.7.2, =1.7.2, =1.11.0 Source cves: CVE-2026-102937 Source advisory: OSV:GHSA-X78J-V8H9-3J2Q...

nova-prompt-optimizer (>=1.0.48, <=1.1.0), pkg-15903 (>=0.1.20, <=0.1.55) +9 more potentially affected by CVE-2026-102937 via virtualenv (20.31.2)

virtualenv PYPI version 20.31.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - nova-prompt-optimizer =1.0.48, =0.1.20, =0.1.1, =0.1.0, =1.0.0, =0.4.9, =0.5.3 Source cves: CVE-2026-102937 Source advisory:...