Priority HIGH 77
GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option.
RHSA-2026:92574
Technical preview of the satellite/iop-vmaas-rhel9 container image
Released 2026-10-29 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-vmaas-rhel9
Fixes 8 records
Priority HIGH 77
GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines.
TI-2026-63063 CVE-2026-93599 · GHSA-g42g-9vm4-7gfj
rustls-webpki before 0.103.13 Panic via empty BIT STRING
Priority HIGH 77
rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs.
TI-2026-45177 CVE-2026-63374 · GHSA-82r6-8w77-94w6
AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing
Priority MEDIUM 48
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio.
TI-2026-59936 CVE-2026-87819 · GHSA-g5vv-9gxw-82hx
GitPython before 3.1.60 Denial of Service via ReDoS
Priority MEDIUM 44
GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields.
TI-2026-58283 CVE-2026-84782 · GHSA-6w84-hw79-7wgf
DTLS Retransmits Handshake Messages From a Stale Buffer Offset
Priority MEDIUM 43
Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through.
Priority LOW 36
GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_remote forwards URLs without check_unsafe_protocols validation.
TI-2026-21021 CVE-2026-26007 · GHSA-r6ph-v2qm-q3c2
cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves
Priority LOW 36
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.