Security update for python-fsspec (important)

openSUSE security update: security update for python-fsspec ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22028-1 Rating: important References: bsc1284173 Cross-References: CVE-2026-104851 Affected Products: openSUSE Leap 16.0...

python: Quadratic complexity in os.path.expandvars() with user-controlled template

A vulnerability in Python’s os.path.expandvars function that can cause performance degradation. When processing specially crafted, user-controlled input with nested environment variable patterns, the function exhibits quadratic time complexity, potentially leading to excessive CPU usage and denia...

cpython: Python HTMLParser quadratic complexity

A denial-of-service DoS vulnerability has been discovered in Python's html.parser.HTMLParser class. When processing specially malformed HTML input, the parsing runtime can become quadratic with respect to the input size. This significantly increased processing time can lead to excessive resource...

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations

A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit CPU resources. This leads to...

CVE-2026-105812

Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values...

EUVD-2026-94001

Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values...

CVE-2026-105812 Code injection via unencoded configuration values during Python code generation in Bedrock AgentCore Starter Toolkit agent import

Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values...

CVE-2026-105812

Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values...

CVE-2026-105812 Code injection via unencoded configuration values during Python code generation in Bedrock AgentCore Starter Toolkit agent import

Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values...

AZL-106712 CVE-2026-106454 affecting package python-twisted 22.10.0-6

Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and earlier, wildcardToRegexp in twisted/mail/imap4.py translates the IMAP asterisk and percent wildcards but passes all other characters from an authenticated client's LIST or LSUB pattern directly t...

CVE-2026-106441

Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.6 and 1.4.0.dev9, Hydra passes Python logging configuration to logging.config.dictConfig without applying Hydra's target policy to handler class values or formatter, filter, handler, queue, and listener factories. A...

CVE-2026-102275 affecting package python-jwt for versions less than 2.15.1-1

CVE-2026-102275 affecting package python-jwt for versions less than 2.15.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-102272 affecting package python-jwt for versions less than 2.15.1-1

CVE-2026-102272 affecting package python-jwt for versions less than 2.15.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-101917 affecting package python-jwt for versions less than 2.15.1-1

CVE-2026-101917 affecting package python-jwt for versions less than 2.15.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-102267 affecting package python-jwt for versions less than 2.15.1-1

CVE-2026-102267 affecting package python-jwt for versions less than 2.15.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-103001 affecting package python-jwt for versions less than 2.15.1-1

CVE-2026-103001 affecting package python-jwt for versions less than 2.15.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-102274 affecting package python-jwt for versions less than 2.15.1-1

CVE-2026-102274 affecting package python-jwt for versions less than 2.15.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-102268 affecting package python-jwt for versions less than 2.15.1-1

CVE-2026-102268 affecting package python-jwt for versions less than 2.15.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-102265 affecting package python-jwt for versions less than 2.15.1-1

CVE-2026-102265 affecting package python-jwt for versions less than 2.15.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-102271 affecting package python-jwt for versions less than 2.15.1-1

CVE-2026-102271 affecting package python-jwt for versions less than 2.15.1-1. An upgraded version of the package is available that resolves this issue...