GitHub Advisory Databaseの情報
10月22日(木)昨日
virtualenv: Builtin creation follows linked environment directories
影響: pip:virtualenv < 21.14.9 → 21.14.9 The builtin creator accepts existing directory symlinks through ensure_dir() and writes environment files through those directories. This permits writes outside the requested destination. Anthropic's OSS Scanner reported this as ANT-2026-MUFJEG11 in virtualenv-20261015-005, received on 15 October 2026. Affected area Directory preparation before environment files are created. Attacker-controlled input Another account must be able to prepare linked entries below the chosen destination before crea…
virtualenv: Deletion recovery can change a symlink target's mode
影響: pip:virtualenv < 21.14.9 → 21.14.9 The deletion error handler obtains permission bits with lstat() but applies them through chmod(), which follows symlinks. On an eligible unlink failure this can change permissions outside the destination. Anthropic's OSS Scanner reported this as ANT-2026-UK90QC27 in virtualenv-20261015-005, received on 15 October 2026. Affected area Permission recovery after a filesystem deletion error. Attacker-controlled input A deletion must fail on a symbolic-link entry and enter the permission-recovery bra…
virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax
影響: pip:virtualenv < 21.14.9 → 21.14.9 A destination path supplied to virtualenv can be interpreted as shell syntax by a generated POSIX console launcher. The app-data seeder and pip delegate launcher generation to distlib but supply the interpreter path in a form that does not preserve it as literal data in the shell wrapper. Affected area POSIX console scripts generated by the app-data seeder or pip when the interpreter path requires a shell wrapper. Windows executable launchers are not affected by this path. Attacker-controlled i…
Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags
影響: pip:Pillow <= 12.3.0 → 13.0.0 ============================================================================ Memory disclosure and segfault in libtiff encoder via crafted TIFF tags Location: src/encode.c:1014 in PyImaging_LibTiffEncoderNew() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ A crafted TIFF file of a few hundred bytes makes Pillow copy an attacker-chosen amount of its own process memory into the TIFF it writes back out, or crash the pro…
Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
影響: pip:Pillow >= 2.0.0, < 13.0.0 → 13.0.0 ============================================================================ Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO Location: src/libImaging/TiffDecode.c:94 in _tiffWriteProc() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ Pillow can write attacker-chosen data past the end of a heap buffer when it saves a TIFF image to an in-memory destination such as io.BytesIO rather than to a file. The…
Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer
影響: pip:pillow >= 11.3.0, < 13.0.0 → 13.0.0 Saving an image as TIFF to an in-memory buffer can trigger a heap use-after-free if libtiff rejects a tag at encode time. When TIFFWriteScanline fails, the encoder frees its output buffer but leaves the libtiff handle open. Later, when the encoder object is torn down, TIFFClose flushes buffered bytes through the write callback and writes into the freed buffer. An application that re-encodes attacker-influenced images to TIFF in memory can be crashed and is a candidate for remote code execution.…
Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle
影響: pip:Pillow >= 5.1.0, < 13.0.0 → 13.0.0 ============================================================================ Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle Location: src/PIL/PdfParser.py:505 in PdfParser.rewrite_pages() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ A PDF file of a few hundred bytes makes Pillow hang forever, holding one processor core at 100%, when an application tries to append an image to it. Anyone who can s…
Pillow: APNG background disposal allocates full canvas before decompression bomb check
影響: pip:Pillow >= 8.1.0, < 13.0.0 → 13.0.0 ============================================================================ APNG background disposal allocates full canvas before decompression bomb check Location: src/PIL/PngImagePlugin.py:1000 in PngImageFile._seek() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ A 126-byte animated PNG file makes Pillow's Image.open() allocate and fill memory sized by the image dimensions the file claims, before Pillow's built-i…
Pillow: MSP RLE decoder expands a tiny file into unbounded memory
影響: pip:pillow >= 4.1.0, < 13.0.0 → 13.0.0 The MSP RLE decoder expands run-length data into an in-memory buffer with no cap tied to the declared image size. A small file that passes the pixel-count check can force hundreds of megabytes or more of allocation when the application loads pixels. Details The MSP decoder writes each run into an unbounded io.BytesIO and can expand roughly 85x per run: - src/PIL/MspImagePlugin.py:144-146 Impact Memory-exhaustion denial of service from a tiny crafted image in any application that loads pixels. T…
Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)
影響: pip:Pillow >= 5.1.0, < 13.0.0 → 13.0.0 ============================================================================ Quadratic-time DoS in PDF save_all (PdfParser.next_object_id) Location: src/PIL/PdfParser.py:629 in next_object_id() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ Pillow's PDF writer takes time proportional to the square of the number of frames when it saves a multi-frame image as a multi-page PDF. Anyone who can get an application to conve…
Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()
影響: pip:Pillow >= 5.1.0, < 13.0.0 → 13.0.0 PdfParser's get_value() can recurse without any limit and crash with an uncaught RecursionError. It is reachable through Image.save(im, fp= , format="PDF", append=True) when the existing PDF file is attacker-controlled. This is the same class of bug as https://github.com/advisories/GHSA-r73j-pqj5-w3x7 (the /Prev trailer chain loop, fixed earlier this year), in the same file, but in two different functions that fix did not touch. Details get_value() in src/PIL/PdfParser.py This is a clas…
Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes
影響: pip:Pillow <= 12.3.0 → 13.0.0 ============================================================================ ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes Location: src/PIL/XbmImagePlugin.py:58 in XbmImageFile._open() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ A crafted 512-byte file makes Pillow's Image.open() spend about six minutes of processor time on one core before it gives up with UnidentifiedImageError. Anyone w…
Pillow: Image.quantize() with empty palette leaks uninitialized stack memory
影響: pip:Pillow >= 9.1.0, < 13.0.0 → 13.0.0 ============================================================================ Image.quantize() with empty palette leaks uninitialized stack memory Location: src/libImaging/Palette.c:216 in ImagingPaletteCacheUpdate() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ When an application lets a user supply the palette image for Pillow's Image.quantize(palette=...), the user can get back 512 bytes of the server process's st…
Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()
影響: pip:Pillow >= 5.4.0, < 13.0.0 → 13.0.0 ============================================================================ Quadratic GIF comment concatenation allows DoS in Image.open() Location: src/PIL/GifImagePlugin.py:266 in GifImageFile._seek() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ Opening a crafted GIF file with Image.open() takes time that grows with the square of the file's size, so anyone who can submit an image to a service that uses Pillow ca…
Pillow: Infinite loop in MIC n_frames when the embedded TIFF
影響: pip:Pillow >= 7.2.0, < 13.0.0 → 13.0.0 ============================================================================ Infinite loop in MIC n_frames when the embedded TIFF has 3+ IFDs Location: src/PIL/MicImagePlugin.py:86 in MicImageFile.tell() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ A crafted 5.6 KB image file makes Pillow loop forever at 100% CPU when an application asks how many frames the image has. This only affects installations that have the o…
Pillow: Quadratic GIF comment copying during save
影響: pip:pillow >= 9.2.0, < 13.0.0 → 13.0.0 On Pillow 12.3.0 and upstream main (ad277e2761b489681e71b51e91367d46b0ceabb9), a GIF with a long comment makes _get_global_header() copy portions of the comment repeatedly when saving, including comments carried over from untrusted images. I suggest provisional Moderate severity for crafted-image CPU denial of service, with CVSS-B 6.9 assuming a network service automatically opens unauthenticated uploads and they are resaved as GIFs; impact depends on input-size, concurrency, and worker CPU lim…
Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images
影響: pip:Pillow <= 12.3.0 → 13.0.0 ============================================================================ NULL dereference in ImagingExpand via rank filters on zero-size images Location: src/libImaging/Filter.c:79 in ImagingExpand() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ Applying Pillow's median, minimum, maximum or rank filter to an image with zero width or zero height crashes the whole Python process instead of raising an error. Empty…
Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0
影響: pip:pillow >= 12.0.0, < 13.0.0 → 13.0.0 Image.merge() checks the mode of every input band except band 0. If band 0 is a single-band I or F image, the native merge routine reads a pixel pointer that is NULL for those modes and the process crashes. The IPTC plugin reaches this from a plain Image.open() followed by a load, and IPTC has no magic-byte prefilter, so a crafted file with no recognizable header can drive it. Details The validation loop skips band 0: - src/PIL/Image.py:3795 iterates for band in bands[1:] and checks mod…
Pillow: Invalid free in FreeType glyph rendering when a stroker is active
影響: pip:pillow >= 10.0.0, < 13.0.0 → 13.0.0 When text is drawn with a non-zero stroke width, Pillow creates a FreeType stroker and then loads each glyph. If FT_Load_Glyph fails for a glyph, the cleanup path calls FT_Done_Glyph on the glyph variable. That variable is not initialized before the first measurement loop, and in the render loop it is not reset to NULL after each glyph is freed. A malformed font loaded from untrusted bytes can force the load error and reach this free. This is a latent memory-safety defect; whether it cr…
Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform
影響: pip:Pillow <= 12.3.0 → 13.0.0 ============================================================================ Double free in ImagingScaleAffine on calloc failure via Image.transform Location: src/libImaging/Geometry.c:866 in ImagingScaleAffine() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ There is a double free in Pillow's Image.transform() that crashes the process when an oversized transform runs out of memory. Instead of only raising MemoryErro…
Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size
影響: pip:Pillow <= 12.3.0 → 13.0.0 On main, even with the guard in #9725, it's possible to have these decoders read 1 to 3 bytes past the end of the passed buffer with a suitable width/height. Details ImagingRawDecode and the P;2L / P;4L unpackers disagree about how many bytes a line of data occupies. The raw decoder derives the line size from the bits per pixel c state->bytes = (state->xsize state->bits + 7) / 8; and uses it both for the bounds check and to advance to the next line. For P;2L and P;4L, bits is 2 and 4 re…
Pillow: Argument Injection in Ghostscript call, potentially leading into RCE
影響: pip:Pillow >= 2.6.0, < 13.0.0 → 13.0.0 PIL.EpsImagePlugin.Ghostscript() builds the Ghostscript command line using the input file path (fp.name) without sanitization, placing it at -f . A filename beginning with - is interpreted by Ghostscript as an option, giving command-line argument injection; chainable to RCE (see Impact). Reproduces with Pillow's default invocation (with -dSAFER enabled). Details _Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer._ Type CWE…
pypdf: Unvalidated JPEG image data loading
影響: pip:pypdf < 6.21.1 → 6.21.1 An attacker who uses this vulnerability can craft a PDF which leads to arbitrary image parsers being called. This requires loading an image which claims to use the /DCTDecode filter (JPEG data). Users which do not have the optional Pillow dependency installed in their environment are not affected. Patches This has been fixed in [pypdf==6.21.1](https://github.com/py-pdf/pypdf/releases/tag/6.21.1). Workarounds If you cannot upgrade yet, consider applying the changes from PR [#4222](https:/…
djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool
影響: pip:djust >= 0.9.0, <= 1.0.9 → 1.0.10, pip:djust >= 1.1.0, <= 1.1.6 → 1.1.7, pip:djust >= 1.2.0.dev0, <= 1.2.3 → 1.2.4, pip:djust >= 1.3.0.dev0, <= 1.3.0rc7 → 1.3.0rc8 Affected version / file / line Version: djust v1.1.4 (latest release, published 2026-09-23). File: python/djust/mcp/server.py:354-433 (MCP tool find_handlers_for_template). Confirmed identical on the commit used for triage, a7e4fafd1667b4db0b1465652d4a63cb17117a07. Description @mcp.tool() def find_handlers_for_template(template_path: str) -> str: """ Args: template_path: Either a logical template name (e.g. 'demos/counter.html' — what you'd pass to render) OR an absolute filesystem path. Both a…
pypdf: Possible infinite loop in PdfWriter.find_outline_item
影響: pip:pypdf < 6.20.1 → 6.20.1 An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires calling find_outline_item on a PdfWriter. Patches This has been fixed in [pypdf==6.20.1](https://github.com/py-pdf/pypdf/releases/tag/6.20.1). Workarounds If you cannot upgrade yet, consider applying the changes from PR [#4188](https://github.com/py-pdf/pypdf/pull/4188).
pypdf: Possible infinite loop when removing tree items
影響: pip:pypdf < 6.20.1 → 6.20.1 An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires removing an object from a tree, for example an outline item. Patches This has been fixed in [pypdf==6.20.1](https://github.com/py-pdf/pypdf/releases/tag/6.20.1). Workarounds If you cannot upgrade yet, consider applying the changes from PR [#4188](https://github.com/py-pdf/pypdf/pull/4188).
pypdf: Possible infinite loop when hitting EOF in standard xref table
影響: pip:pypdf < 6.20.0 → 6.20.0 An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires an incomplete file which ends inside the xref table. Patches This has been fixed in [pypdf==6.20.0](https://github.com/py-pdf/pypdf/releases/tag/6.20.0). Workarounds If you cannot upgrade yet, consider applying the changes from PR [#4170](https://github.com/py-pdf/pypdf/pull/4170). Notes This has been reported through both the secure channel and as a public issue at [#4169](https://gith…
virtualenv bash activate runs commands from an environment name with a backslash before $
影響: pip:virtualenv <= 21.14.6 → 21.14.7 The bash activate script escapes the environment name for only one of the two passes bash makes over PS1, so a backslash in the name undoes the escaping and a name containing \$(...) runs as commands in the user's shell each time bash draws the prompt. Affected area src/virtualenv/activation/bash/activate.sh, the block that prepends the environment name to PS1. Attacker-controlled input The environment name: the environment directory's name, or the --prompt or VIRTUALENV_PROMPT value. A…
pypdf: Possible large memory usage for streams with multiple filters
影響: pip:pypdf < 6.20.0 → 6.20.0 An attacker who uses this vulnerability can craft a PDF which leads to large memory consumption. This requires accessing any stream with a large amount of filters or multiple filters which pass around large amounts of data. Patches This has been fixed in [pypdf==6.20.0](https://github.com/py-pdf/pypdf/releases/tag/6.20.0). Workarounds If you cannot upgrade yet, consider applying the changes from PR [#4173](https://github.com/py-pdf/pypdf/pull/4173).
virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST
影響: pip:virtualenv <= 21.14.3 → 21.14.4 zsh users activate an environment with the bash activate script, which puts the environment name into PS1. Since 21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when BASH_VERSION is set, so zsh gets the raw value. With the PROMPT_SUBST option set, zsh runs parameter expansion, command substitution and arithmetic expansion on PS1 each time it draws the prompt. A name that contains $(...), backticks or ${...} then runs as commands in the user's she…
virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote
影響: pip:virtualenv <= 21.14.1 → 21.14.2 FishActivator defines no quote(), so it inherits ViaTemplateActivator.quote, which returns shlex.quote(string). That function follows POSIX sh rules, where a backslash inside single quotes stays a literal character. fish reads \' inside single quotes as an escaped quote and \\ as an escaped backslash. A value with a backslash before a quote therefore ends the literal somewhere other than where shlex.quote put the end, and fish expands the command substitution that follows. The environmen…
virtualenv activation scripts run code from a path that contains a placeholder name
影響: pip:virtualenv >= 20.26.6, <= 21.14.1 → 21.14.2 ViaTemplateActivator.instantiate_template replaces the placeholders in an activation template one key at a time, each across the whole text. When a value that it already substituted and quoted contains the name of a later placeholder, the later pass rewrites that name inside the quoted literal. The inserted value brings its own quotes, which close the outer literal, and the rest of the path runs as code when a user activates the environment. __VIRTUAL_NAME__ holds the environment's direc…
10月21日(水)
Pillow: Out-of-bounds access in _imagingmorph on a zero-width image
影響: pip:Pillow <= 12.3.0 → 13.0.0 A PPM or PGM file can declare a width of 0, which Pillow accepts, producing an image of size (0, N). Passing that image to ImageMorph.MorphOp.apply() makes the native morphology code index a row buffer at outrow[width - 1], which is outrow[-1] when the width is 0. The process crashes. Details The PPM parser reads width and height with no lower-bound check: - src/PIL/PpmImagePlugin.py:119 The native apply() writes the row edges with no guard that the width is positive: - src/_imagingmorp…
Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
影響: pip:Pillow >= 9.2.0, < 13.0.0 → 13.0.0 ============================================================================ GIF seek keeps rejected size after DecompressionBombError, allowing DoS Location: src/PIL/GifImagePlugin.py:293 in GifImageFile._seek() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ A GIF of about 60 bytes can make Pillow allocate gigabytes of memory. This affects applications that catch the "image too large" error raised while stepping to…
Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit
影響: pip:Pillow >= 2.3.0, <= 12.3.0 → 13.0.0 ============================================================================ EPS load(scale) lets Ghostscript render past the decompression bomb limit Location: src/PIL/EpsImagePlugin.py:92 in Ghostscript() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ When an application opens an untrusted Encapsulated PostScript file and asks Pillow to render it at a larger scale, Pillow has Ghostscript produce an image several ti…
Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
影響: pip:Pillow >= 5.3.0, < 13.0.0 → 13.0.0 ============================================================================ TiffDecode returns uninitialized memory as pixels for short JPEG strips Location: src/libImaging/TiffDecode.c:554 in _decodeStrip() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ Pillow hands back leftover process memory as image pixels when it opens a small crafted TIFF file. Anyone who can get an application to open their image, and can se…
Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
影響: pip:Pillow <= 12.3.0 → 13.0.0 A small attacker-supplied TIFF can be opened and loaded normally, then reach an out-of-bounds read when an application saves it back to TIFF with retained metadata. The fixed reproducer is a 1×1, 16-bit grayscale, PackBits-compressed TIFF containing tag 320 (ColorMap) with 768 SHORT values: three zero-filled planes of 256 entries each. No Python object is forged and no metadata is injected after loading. Pillow's TIFF encoder allocates 768 × 2 = 1536 bytes, then passes three plane point…
Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
影響: pip:pillow >= 5.1.0, < 13.0.0 → 13.0.0 When an application appends to an existing PDF with Image.save(..., format="PDF", append=True), Pillow parses that file with PdfParser. Two recursive parsers have no effective bound. linearize_page_tree follows /Kids with no visited set or depth limit, so a cyclic or duplicated page tree recurses without end. read_prev_trailer rejects only an exactly repeated /Prev offset, so a long chain of unique offsets still recurses. The trailer-loop guard added for CVE-2026-42310 does not cover ei…
Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)
影響: pip:pillow >= 8.2.0, < 13.0.0 → 13.0.0 Pillow's libImaging _decodeTile decoder, used to decode tiled TIFF images, allocates a per-tile buffer using realloc(state->buffer, TIFFTileSize(tiff)). After each TIFFReadTile it then iterates tile_y from 0 up to current_tile_length and calls the configured row unpacker (here copy4) with the source pointer state->buffer + tile_y row_byte_size. When libtiff returns a tile_bytes_size smaller than the worst-case row_byte_size tile_length, the inner stride-and-copy loop walks past the real…
Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels
影響: pip:Pillow >= 8.1.0, < 13.0.0 → 13.0.0 ============================================================================ OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels Location: src/libImaging/TiffDecode.c:483 in _decodeTile() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ============================================================================ Pillow reads past the end of a heap buffer when decoding certain malformed compressed TIFF files, and copies the bytes it reads into the pixels of the image it re…
Pillow: Heap buffer overflow in ImagingJpegDecode
影響: pip:Pillow <= 12.3.0 → 13.0.0 JpegImageFile.draft() — which Image.thumbnail() calls automatically — requests 1/2, 1/4 or 1/8 scaled JPEG output and shrinks self._size and the tile extents to match, so _setimage() allocates a single-row decode buffer of ceil(W/s) samples. ImagingJpegDecode() sets cinfo.scale_num/scale_denom, calls jpeg_start_decompress(), and then reads scanlines into that buffer without ever comparing cinfo.output_width, cinfo.output_height or cinfo.out_color_components against state->xsize, state->…
AIOHTTP: Absolute-form request targets can spoof Request.scheme
影響: pip:aiohttp <= 3.14.3 → 3.14.4 An attacker sending an absolute-form request can spoof the scheme used. Impact If user code depends on the Request.scheme attribute for anything security related, an attacker may be able to circumvent this logic, tricking the application into thinking a connection is encrypted when it is not, or vice versa. Workaround A WAF rule to reject absolute-form requests (legitimate requests should only use this form for proxies).
AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies
影響: pip:aiohttp <= 3.14.3 → 3.14.4 A subdomain can remove the Host-Only flag from an existing cookie to a parent domain. Impact A user accessing untrusted subdomains could see their Host-Only protections stripped from cookies. Given most usecases won't reflect these cookies to a browser, the impact is limited.
AIOHTTP: Connector pool exhaustion via Max-Age overflow
影響: pip:aiohttp <= 3.14.3 → 3.14.4 An overflow in Max-Age processing can skip closing a connection. Impact An attacker may be able to exhaust the connection pool temporarily, until garbage collection resolves the connections.
AIOHTTP: Pure-Python parser request smuggling
影響: pip:aiohttp <= 3.14.3 → 3.14.4 The pure Python parser is vulnerable to an HTTP request smuggling attack. Impact If users are using the Python parser (AIOHTTP_NO_EXTENSIONS, or not a standard wheel installed), then an application may be vulnerable to a request smuggling attack. Workaround Switch to the default C parser.
AIOHTTP: File descriptor exhaustion in multipart requests
影響: pip:aiohttp >= 2.0.0, < 3.14.4 → 3.14.4 An attacker can exhaust file descriptors with specially crafted multipart requests. Impact If a handler uses Request.post(), it may be possible for an attacker to use an unlimited number of file descriptors, potentially resulting in resource exhaustion.
uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
影響: pip:uv < 0.13.4 → 0.13.4 By default, uv verifies TLS connections against a vendored copy of the webpki-root-certs bundle. Versions before 0.13.4 include the emSign ECC Root CA - G3 root. Eight eMudhra intermediate CA certificates that chain to that root have compromised private keys, and the CA has revoked them. An attacker with one of the compromised keys can issue certificates that uv accepts for any hostname, and can be used to issue certificates to enable MITM attacks. uv 0.13.4 removes the root from its vendored b…
certifi bundles emSign root CAs with compromised intermediate CA keys
影響: pip:certifi >= 2019.03.09, < 2026.10.19 → 2026.10.19 Certifi versions before 2026.10.18 include the emSign ECC Root CA - G3 root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them. An attacker with one of the compromised keys can issue valid-looking certificates for any hostname. If the attacker is also on-path, they can intercept or modify TLS traffic from clients that trust the certifi bundle. Examples include requests, urllib3 and p…
10月20日(火)
aiohttp server lacks an initial request/header timeout
影響: pip:aiohttp <= 3.14.3 → 3.14.4 The keepalive timeout was not used during the initial portion of a request. Impact An attacker could keep an idle connection open indefinitely before sending any data. Workaround Use a reverse proxy (as recommended for all production deployments) with sensible keepalive limits.
AIOHTTP: Secure attribute not enforced for shared cookie
影響: pip:aiohttp <= 3.14.3 → 3.14.4 The Secure attribute was not being enforced for the shared cookie. Impact It may be possible to send a shared cookie marked Secure through an unencrypted request.