RHSA-2026:54395

Pillow is a Python imaging library.

form-data is a library for creating readable multipart/form-data streams.

Pillow is a Python imaging library.

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API.

js-yaml is a JavaScript YAML parser and dumper.

Pillow is a Python imaging library.

Pillow is a Python imaging library.

Pillow is a Python imaging library.

Pillow is a Python imaging library.

Pillow is a Python imaging library.

Pillow is a Python imaging library.

Pillow is a Python imaging library.

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation.

When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request.

The Verify() method for FIDO/U2F security key types ([email protected], [email protected]) did not check the User Presence flag.

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label.

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop.

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a malicious or machine-in-the-middle broker to freeze the client event loop by supplying an excessively…

shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`.

pyasn1 is a generic ASN.1 library for Python.

urllib3 is an HTTP client library for Python.

fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs.

brace-expansion through 5.0.6 is vulnerable to denial of service.

pyasn1 is a generic ASN.1 library for Python.

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.

The RSA and DSA public key parsers did not enforce size limits on key parameters.

fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization.

nanoid is a secure, URL-friendly, unique string ID generator for JavaScript.

Podman is a tool for managing OCI containers and pods.

A flaw was found in Red Hat Quay's repository-level mirror configuration feature.

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a sec…

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate.