RHSA-2026:58420

When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed.

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context.

DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open().