RAG

pypdf: Possible long runtimes/large memory usage when retrieving outlines

pypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference streams

Certifi removes GLOBALTRUST root certificate

Werkzeug safe_join() allows Windows special device names

Starlette has possible denial-of-service vector when parsing large files in multipart forms

aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain

aiohttp: Multiple instances of excessive or unbounded memory/CPU use

PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)

pypdf has possible Infinite Loop when processing outlines/bookmarks

pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streams

AIOHTTP has CRLF injection through multipart part content type header construction

Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists

urllib3 streaming API improperly handles highly compressed data

Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)

virtualenv: Xonsh activation literals depend on the script decoding codec

pypdf: Possible infinite loop when hitting EOF in standard xref table

pypdf: Manipulated XMP metadata entity declarations can exhaust RAM

AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS

pypdf has possible long runtimes when retrieving page labels

PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)

virtualenv: Deletion recovery can change a symlink target's mode

urllib3 does not control redirects in browsers and Node.js

AIOHTTP: Secure attribute not enforced for shared cookie

virtualenv: Downloaded wheel selection and caching precede verification

pypdf has possible long runtimes for malformed startxref

aiohttp: HTTP/1 Pipelined Requests Queue Without Limit

Soup Sieve: General sibling combinator inside :has() matches untrusted HTML in quadratic time

aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

pypdf: Possible long runtimes for wrong size values in incremental mode

pypdf has possible large memory usage for exceptions in strict mode

pypdf has possible long runtimes for missing /Root object with large /Size values

pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size

Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching

pypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction

Vulnerable OpenSSL included in cryptography wheels

AIOHTTP vulnerable to brute-force leak of internal static file path components

Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction

virtualenv: Generated files can follow existing destination links

pypdf: Possible long runtimes for repeated malformed cross-reference entries

filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break

pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search

virtualenv Has TOCTOU Vulnerabilities in Directory Creation

Denial of service (DoS) via deformation `multipart/form-data` boundary

Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies

pypdf: Inefficient decoding of FlateDecode PNG predictor streams

pypdf: Unvalidated JPEG image data loading

pypdf: Possible long runtimes/large memory usage when parsing indirect objects