RHSA-2026:43038

Starlette is a lightweight ASGI framework/toolkit.

vLLM is an inference and serving engine for large language models (LLMs).

In versions 3.0.0a1 through 3.2.0 of Mistune, there is a ReDoS (Regular Expression Denial of Service) vulnerability in `LINK_TITLE_RE` that allows an attacker who can supply Markdown for parsing to cause denial of servic…

httplib2 is a comprehensive HTTP client library for Python.

A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py.

PyJWT is a JSON Web Token implementation in Python.

Jupyter Server is the backend for Jupyter web applications.

python-dotenv reads key-value pairs from a .env file and can set them as environment variables.

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards.

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture.

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label.

LangChain is a framework for building agents and LLM-powered applications.

Jupyter Server is the backend for Jupyter web applications.

urllib3 is an HTTP client library for Python.

Python-Multipart is a streaming multipart parser for Python.

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture.

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs.

Starlette is a lightweight ASGI framework/toolkit.

In Jupyter Notebook versions 7.0.0 through 7.5.5, JupyterLab versions 4.5.6 and earlier, and the corresponding @jupyter-notebook/help-extension and @jupyterlab/help-extension packages before 7.5.6 and 4.5.7, a stored cro…

fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization.

urllib3 is an HTTP client library for Python.

Jupyter Server is the backend for Jupyter web applications.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API.