Found 17 known vulnerabilities in 7 packages
Name             Version ID             Fix Versions Description
---------------- ------- -------------- ------------ -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
aiohttp          3.13.3  CVE-2026-34515 3.13.4       ### Summary  On Windows the static resource handler may expose information about a NTLMv2 remote path.  ### Impact  If an application is running on Windows, and using aiohttp's static resource handler (not recommended in production), then it may be possible for an attacker to extract the hash from an NTLMv2 path and then extract the user's credentials from there.  -----  Patch: https://github.com/aio-libs/aiohttp/commit/0ae2aa076c84573df83fc1fdc39eec0f5862fe3d
aiohttp          3.13.3  CVE-2026-34513 3.13.4       ### Summary  An unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation.  ### Impact  If an application makes requests to a very large number of hosts, this could cause the DNS cache to continue growing and slowly use excessive amounts of memory.  -----  Patch: https://github.com/aio-libs/aiohttp/commit/c4d77c3533122be353b8afca8e8675e3b4cbda98
aiohttp          3.13.3  CVE-2026-34516 3.13.4       ### Summary  A response with an excessive number of multipart headers may be allowed to use more memory than intended, potentially allowing a DoS vulnerability.  ### Impact  Multipart headers were not subject to the same size restrictions in place for normal headers, potentially allowing substantially more data to be loaded into memory than intended. However, other restrictions in place limit the impact of this vulnerability.  -----  Patch: https://github.com/aio-libs/aiohttp/commit/8a74257b3804c9aac0bf644af93070f68f6c5a6f
aiohttp          3.13.3  CVE-2026-34517 3.13.4       ### Summary  For some multipart form fields, aiohttp read the entire field into memory before checking client_max_size.  ### Impact  If an application uses `Request.post()` an attacker can send a specially crafted multipart request to force significant temporary memory allocation even when the request is ultimately rejected.  -----  Patch: https://github.com/aio-libs/aiohttp/commit/cbb774f38330563422ca0c413a71021d7b944145
aiohttp          3.13.3  CVE-2026-34519 3.13.4       ### Summary  An attacker who controls the `reason` parameter when creating a `Response` may be able to inject extra headers or similar exploits.  ### Impact  In the unlikely situation that an application allows untrusted data to be used in the response's `reason` parameter, then an attacker could manipulate the response to send something different from what the developer intended.  -----  Patch: https://github.com/aio-libs/aiohttp/commit/53b35a2f8869c37a133e60bf1a82a1c01642ba2b
aiohttp          3.13.3  CVE-2026-34518 3.13.4       ### Summary  When following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers.  ### Impact  The Cookie and Proxy-Authorizations headers could contain sensitive information which may be leaked to an unintended party after following a redirect.  -----  Patch: https://github.com/aio-libs/aiohttp/commit/5351c980dcec7ad385730efdf4e1f4338b24fdb6
aiohttp          3.13.3  CVE-2026-34520 3.13.4       ### Summary  The C parser (the default for most installs) accepted null bytes and control characters is response headers.  ### Impact  An attacker could send header values that are interpreted differently than expected due to the presence of control characters. For example, `request.url.origin()` may return a different value than the raw Host header, or what a reverse proxy interpreted it as., potentially resulting in some kind of security bypass.  -----  Patch: https://github.com/aio-libs/aiohttp/commit/9370b9714a7a56003cacd31a9b4ae16eab109ba4
aiohttp          3.13.3  CVE-2026-34525 3.13.4       ### Summary  Multiple Host headers were allowed in aiohttp.  ### Impact  Mostly this doesn't affect aiohttp security itself, but if a reverse proxy is applying security rules depending on the target Host, it is theoretically possible that the proxy and aiohttp could process different host names, possibly resulting in bypassing a security check on the proxy and getting a request processed by aiohttp in a privileged sub app when using `Application.add_domain()`.  -----  Patch: https://github.com/aio-libs/aiohttp/commit/e00ca3cca92c465c7913c4beb763a72da9ed8349 Patch: https://github.com/aio-libs/aiohttp/commit/53e2e6fc58b89c6185be7820bd2c9f40216b3000
aiohttp          3.13.3  CVE-2026-22815 3.13.4       ### Summary  Insufficient restrictions in header/trailer handling could cause uncapped memory usage.  ### Impact  An application could cause memory exhaustion when receiving an attacker controlled request or response. A vulnerable web application could mitigate these risks with a typical reverse proxy configuration.  -----  Patch: https://github.com/aio-libs/aiohttp/commit/0c2e9da51126238a421568eb7c5b53e5b5d17b36
aiohttp          3.13.3  CVE-2026-34514 3.13.4       ### Summary  An attacker who controls the `content_type` parameter in aiohttp could use this to inject extra headers or similar exploits.  ### Impact  If an application allows untrusted data to be used for the multipart `content_type` parameter when constructing a request, an attacker may be able to manipulate the request to send something other than what the developer intended.  -----  Patch: https://github.com/aio-libs/aiohttp/commit/9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06
ecdsa            0.19.1  CVE-2024-23342              python-ecdsa has been found to be subject to a Minerva timing attack on the P-256 curve. Using the `ecdsa.SigningKey.sign_digest()` API function and timing signatures an attacker can leak the internal nonce which may allow for private key discovery. Both ECDSA signatures, key generation, and ECDH operations are affected. ECDSA signature verification is unaffected. The python-ecdsa project considers side channel attacks out of scope for the project and there is no planned fix.
ecdsa            0.19.1  CVE-2026-33936 0.19.2       ## Summary  An issue in the low-level DER parsing functions can cause unexpected exceptions to be raised from the public API functions.  1. `ecdsa.der.remove_octet_string()` accepts truncated DER where the encoded length exceeds the available buffer. For example, an OCTET STRING that declares a length of 4096 bytes but provides only 3 bytes is parsed successfully instead of being rejected.  2. Because of that, a crafted DER input can cause `SigningKey.from_der()` to raise an internal exception (`IndexError: index out of bounds on dimension 1`) rather than cleanly rejecting malformed DER (e.g., raising `UnexpectedDER` or `ValueError`). Applications that parse untrusted DER private keys may crash if they do not handle unexpected exceptions, resulting in a denial of service.  ## Impact  Potential denial-of-service when parsing untrusted DER private keys due to unexpected internal exceptions, and malformed DER acceptance due to missing bounds checks in DER helper functions.  ## Reproduction  Attach and run the following PoCs:  ###  poc_truncated_der_octet.py  ```python from ecdsa.der import remove_octet_string, UnexpectedDER  # OCTET STRING (0x04) # Declared length: 0x82 0x10 0x00  -> 4096 bytes # Actual body: only 3 bytes -> truncated DER bad = b"\x04\x82\x10\x00" + b"ABC"  try:     body, rest = remove_octet_string(bad)     print("[BUG] remove_octet_string accepted truncated DER.")     print("Declared length=4096, actual body_len=", len(body), "rest_len=", len(rest))     print("Body=", body)     print("Rest=", rest) except UnexpectedDER as e:     print("[OK] Rejected malformed DER:", e) ```  - Expected: reject malformed DER when declared length exceeds available bytes - Actual: accepts the truncated DER and returns a shorter body - Example output: ``` Parsed body_len= 3 rest_len= 0 (while declared length is 4096) ```  ### poc_signingkey_from_der_indexerror.py  ```python from ecdsa import SigningKey, NIST256p import ecdsa  print("ecdsa version:", ecdsa.__version__)  sk = SigningKey.generate(curve=NIST256p) good = sk.to_der() print("Good DER len:", len(good))   def find_crashing_mutation(data: bytes):     b = bytearray(data)      # Try every OCTET STRING tag position and corrupt a short-form length byte     for i in range(len(b) - 4):         if b[i] != 0x04:  # OCTET STRING tag             continue          L = b[i + 1]         if L >= 0x80:             # skip long-form lengths for simplicity             continue          max_possible = len(b) - (i + 2)         if max_possible <= 10:             continue          # Claim more bytes than exist -> truncation         newL = min(0x7F, max_possible + 20)         b2 = bytearray(b)         b2[i + 1] = newL          try:             SigningKey.from_der(bytes(b2))         except Exception as e:             return i, type(e).__name__, str(e)      return None   res = find_crashing_mutation(good) if res is None:     print("[INFO] No exception triggered by this mutation strategy.") else:     i, etype, msg = res     print("[BUG] SigningKey.from_der raised unexpected exception type.")     print("Offset:", i, "Exception:", etype, "Message:", msg) ```  - Expected: reject malformed DER with `UnexpectedDER` or `ValueError` - Actual: deterministically triggers an internal `IndexError` (DoS risk) - Example output: ``` Result: (5, 'IndexError', 'index out of bounds on dimension 1') ```  ## Suggested fix  Add “declared length must fit buffer” checks in DER helper functions similarly to the existing check in `remove_sequence()`:  - `remove_octet_string()` - `remove_constructed()` - `remove_implicit()`  Additionally, consider catching unexpected internal exceptions in DER key parsing paths and re-raising them as `UnexpectedDER` to avoid crashy failure modes.  ## Credit  Mohamed Abdelaal (@0xmrma)
pyasn1           0.6.2   CVE-2026-30922 0.6.3        ### Summary The `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing nested `SEQUENCE` (`0x30`) or `SET` (`0x31`) tags with Indefinite Length (`0x80`) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a `RecursionError` or consumes all available memory (OOM), crashing the host application.  ### Details The vulnerability exists because the decoder iterates through the input stream and recursively calls `decodeFun` (the decoding callback) for every nested component found, without tracking or limiting the recursion depth. Vulnerable Code Locations: 1. `indefLenValueDecoder` (Line 998): ```for component in decodeFun(substrate, asn1Spec, allowEoo=True, **options):``` This method handles indefinite-length constructed types. It sits inside a `while True` loop and recursively calls the decoder for every nested tag.  2. `valueDecoder` (Lines 786 and 907): ```for component in decodeFun(substrate, componentType, **options):``` This method handles standard decoding when a schema is present. It contains two distinct recursive calls that lack depth checks: Line 786: Recursively decodes components of `SEQUENCE` or `SET` types. Line 907: Recursively decodes elements of `SEQUENCE OF` or `SET OF` types.  4. `_decodeComponentsSchemaless` (Line 661): ```for component in decodeFun(substrate, **options):``` This method handles decoding when no schema is provided.  In all three cases, `decodeFun` is invoked without passing a `depth` parameter or checking against a global `MAX_ASN1_NESTING` limit.  ### PoC ``` import sys from pyasn1.codec.ber import decoder  sys.setrecursionlimit(100000)  print("[*] Generating Recursion Bomb Payload...") depth = 50_000 chunk = b'\x30\x80'  payload = chunk * depth  print(f"[*] Payload size: {len(payload) / 1024:.2f} KB") print("[*] Triggering Decoder...")  try:     decoder.decode(payload) except RecursionError:     print("[!] Crashed: Recursion Limit Hit") except MemoryError:     print("[!] Crashed: Out of Memory") except Exception as e:     print(f"[!] Crashed: {e}") ```  ``` [*] Payload size: 9.77 KB [*] Triggering Decoder... [!] Crashed: Recursion Limit Hit ```  ### Impact - This is an unhandled runtime exception that typically terminates the worker process or thread handling the request. This allows a remote attacker to trivially kill service workers with a small payload (<100KB), resulting in a Denial of Service. Furthermore, in environments where recursion limits are increased, this leads to server-wide memory exhaustion. - Service Crash: Any service using `pyasn1` to parse untrusted ASN.1 data (e.g., LDAP, SNMP, Kerberos, X.509 parsers) can be crashed remotely. - Resource Exhaustion: The attack consumes RAM linearly with the nesting depth. A small payload (<200KB) can consume hundreds of megabytes of RAM or exhaust the stack.  ### Credits Vulnerability discovered by Kevin Tu of TMIR at ByteDance.
pygments         2.19.2  CVE-2026-4539  2.20.0       A security flaw has been discovered in pygments before 2.20.0. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
pytest           9.0.2   CVE-2025-71176 9.0.3        pytest through 9.0.2 on UNIX relies on directories with the `/tmp/pytest-of-{user}` name pattern, which allows local users to cause a denial of service or possibly gain privileges.
python-multipart 0.0.22  CVE-2026-40347 0.0.26       ### Summary  A denial of service vulnerability exists when parsing crafted `multipart/form-data` requests with large preamble or epilogue sections.  ### Details  Two inefficient multipart parsing paths could be abused with attacker-controlled input.  Before the first multipart boundary, the parser handled leading CR and LF bytes inefficiently while searching for the start of the first part. After the closing boundary, the parser continued processing trailing epilogue data instead of discarding it immediately. As a result, parsing time could grow with the size of crafted data placed before the first boundary or after the closing boundary.  ### Impact  An attacker can send oversized malformed multipart bodies that consume excessive CPU time during request parsing, reducing request-handling capacity and delaying legitimate requests. This issue degrades availability but does not typically result in a complete denial of service for the entire application.  ### Mitigation  Upgrade to version `0.0.26` or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.
requests         2.32.5  CVE-2026-25645 2.33.0       ### Impact The `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one.  ### Affected usages **Standard usage of the Requests library is not affected by this vulnerability.** Only applications that call `extract_zipped_paths()` directly are impacted.  ### Remediation Upgrade to at least Requests 2.33.0, where the library now extracts files to a non-deterministic location.  If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.
Name    Skip Reason
------- ----------------------------------------------------------------------
mop-sdk Dependency not found on PyPI and could not be audited: mop-sdk (0.1.0)
