RHSA-2026:73987

Starlette is a lightweight ASGI framework/toolkit.

protobufjs compiles protobuf definitions into JavaScript (JS) functions.

NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function, allowing attackers to inject dangerous JVM flags.

sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the import_module_class helper within sentence_transformers/u…

Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length).

node-tar is a tar archive manipulation library for Node.js.

vLLM is an inference and serving engine for large language models (LLMs).

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability.

nltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem().

NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the intended data root.

NLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen (and callers nltk.data.load, nltk.downloader.Downloader.index/download) when an HTTP proxy is configured.

GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from().

NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root.

node-tar is a tar archive manipulation library for Node.js.

Pillow is a Python imaging library.

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability.

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.

Pillow is a Python imaging library.

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature.

GitPython is a python library used to interact with Git repositories.

The brace-expansion library generates arbitrary strings containing a common prefix and suffix.

GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbi…

js-yaml is a JavaScript YAML parser and dumper.

Pillow is a Python imaging library.

Pillow is a Python imaging library.

Pillow is a Python imaging library.

ws is an open source WebSocket client and server for Node.js.

basic-ftp is an FTP client for Node.js.

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing.

PyJWT is a JSON Web Token implementation in Python.

The DataRow.Decode function fails to properly validate field lengths.

pyasn1 is a generic ASN.1 library for Python.

NLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code.

NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure inpu…

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in `keras/src/utils/file_utils.py`.

A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py.

Pillow is a Python imaging library.

PyJWT is a JSON Web Token implementation in Python.

Jupyter Server is the backend for Jupyter web applications.

ws is an open source WebSocket client and server for Node.js.

NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incr_download methods that allows attackers to overwrite files outside the install root through…

python-dotenv reads key-value pairs from a .env file and can set them as environment variables.

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation.

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

Memory-safety vulnerability in github.com/jackc/pgx/v5.

Memory-safety vulnerability in github.com/jackc/pgx/v5.

The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains a command-line argument injection vulnerability in its Kubeflow component (robustness_evaluation_fgsm_pytorch.py).

gRPC-Go is the Go language implementation of gRPC.

When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request.

The Verify() method for FIDO/U2F security key types ([email protected], [email protected]) did not check the User Presence flag.

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label.

A flaw was found in the `guardrails-detectors` component.

Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe bindings.

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings.

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop.

gRPC-Go is the Go language implementation of gRPC.

NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user-supplied regular expressions without validation or timeout.

FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF strea…

Black is the uncompromising Python code formatter.

Tornado is a Python web framework and asynchronous networking library.

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability.

vLLM is an inference and serving engine for large language models (LLMs).

The net/url package does not set a limit on the number of query parameters in a query.

LangChain is a framework for building agents and LLM-powered applications.

Jupyter Server is the backend for Jupyter web applications.

A flaw was found in the Red Hat OpenShift AI (RHOAI) overlay for the training operator.

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture.

Hugging Face peft's LoRA-GA and CorDA initialization modules (src/peft/tuners/lora/corda.py lines ~102 and ~163, and src/peft/tuners/lora/loraga.py line ~101) call torch.load on config-specified cache/covariance files wi…

FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image wi…

ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension.

The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression.

js-yaml is a JavaScript YAML parser and dumper.

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools.

FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying…

pyasn1 is a generic ASN.1 library for Python.

pyasn1 is a generic ASN.1 library for Python.

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not.

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface.

Tornado is a Python web framework and asynchronous networking library.

urllib3 is an HTTP client library for Python.

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

multipart is a fast multipart/form-data parser for python.

A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI).

brace-expansion through 5.0.6 is vulnerable to denial of service.

Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments.

Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin.

fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions.

ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length.

urllib3 is a user-friendly HTTP client library for Python.

pyasn1 is a generic ASN.1 library for Python.

Starlette is a lightweight ASGI framework/toolkit.

The RSA and DSA public key parsers did not enforce size limits on key parameters.

Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter.

SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malici…

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-b…

In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture.

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution in…

urllib3 is an HTTP client library for Python.

Jupyter Server is the backend for Jupyter web applications.

Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://).

React Router is a router for React.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream tha…

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

SQLite before 3.53.2 contains an out-of-bounds read vulnerability in the FTS5 full-text search extension that allows attackers to crash the process by supplying a crafted database with a malformed FTS5 leaf page.

js-yaml is a JavaScript YAML parser and dumper.

A flaw was found in `guardrails-detectors`, a component of Red Hat OpenShift AI.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a sec…

JupyterLab (pip package 'jupyterlab') versions >=4.1.0,<=4.5.9 and >=4.6.0,<=4.6.1 contain a plugin manager lock-rule enforcement bypass.

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate.