RHSA-2026:6568

Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js.

Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an at…

Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in KJUR.crypto.DSA.setPublic (and the related DSA/X509 verificati…

PyJWT is a JSON Web Token implementation in Python.

pyasn1 is a generic ASN.1 library for Python.

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled.

Authlib is a Python library which builds OAuth and OpenID Connect servers.

Authlib is a Python library which builds OAuth and OpenID Connect servers.

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.

Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass.

During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have…

Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1…

Immutable.js provides many Persistent Immutable data structures.

Pillow is a Python imaging library.

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.

Axios is a promise based HTTP client for the browser and Node.js.

The net/url package does not set a limit on the number of query parameters in a query.

Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation.

pypdf is a free and open-source pure-python PDF library.

Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion.

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files.

Authlib is a Python library which builds OAuth and OpenID Connect servers.

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.

Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out.

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing.

archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened.