RHSA-2026:8746

PyJWT is a JSON Web Token implementation in Python.

A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API.

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.

vLLM is an inference and serving engine for large language models (LLMs).

A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.

Heap buffer overflow in libvpx.

A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path.

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers.

When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length.

The issue was addressed with improved memory handling.

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.

A flaw was found in GnuTLS.

The poplib module, when passed a user-controlled command, can have additional commands injected using newlines.

The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines.

The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.