density-maps

aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

AIOHTTP has CRLF injection through multipart part content type header construction

PyTorch susceptible to local Denial of Service

AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS

Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

aiohttp: HTTP/1 Pipelined Requests Queue Without Limit

aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path

Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching

PyTorch: `torch.load` with `weights_only=True` leads to remote code execution

AIOHTTP vulnerable to brute-force leak of internal static file path components

setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write

Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`

Pillow has a heap buffer overflow with nested list coordinates

Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)

AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass

aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines

Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix

AIOHTTP's unicode processing of header values could cause parsing discrepancies

AIOHTTP vulnerable to denial of service through large payloads

AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow

pytest has vulnerable tmpdir handling

PyTorch Improper Resource Shutdown or Release vulnerability

Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading

AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections

AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect

Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch

aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect

AIOHTTP accepts duplicate Host headers

PyTorch Tuple Handler is Vulnerable to Memory Corruption through Manipulation of None Argument

Pillow affected by out-of-bounds write when loading PSD images

Jinja2 vulnerable to sandbox breakout through attr filter selecting format method

AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

setuptools vulnerable to Command Injection via package URL

PyTorch is Vulnerable to Memory Consumption through pad_packed_sequence Function

AIOHTTP Vulnerable to Cookie Parser Warning Storm

Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images

aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup

tqdm CLI arguments injection attack

AIOHTTP vulnerable to DoS through chunked messages

Jinja has a sandbox breakout through malicious filenames

setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+

Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter

AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector

AIOHTTP is vulnerable to cross-origin redirect with per-request cookies

aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges

AIOHTTP is Vulnerable to Deserialization of Untrusted Data