RHSA-2026:2754

wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427.

Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass.

urllib3 is a user-friendly HTTP client library for Python.

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence…

The net/url package does not set a limit on the number of query parameters in a query.

Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion.

Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity.

auth0/node-jws is a JSON Web Signature implementation for Node.js.

runc is a CLI tool for spawning and running containers according to the OCI specification.

Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out.

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing.