CVE-2026-49264 is a medium severity vulnerability affecting multiple versions of the python-oauthlib package. It involves security issues fixed in the python313-oauthlib-4.0.0-1.1 package on openSUSE Tumbleweed. The vulnerability has a CVSS 3.1 base score of 6.1, indicating a network attack vector with low attack complexity, no privileges required, but requires user interaction. It results in partial confidentiality and integrity impact but no availability impact. The affected versions include >=0.6.1 <4.0.0, >=5.4.0 <5.5.0, and <3.1.1-5.oe2203sp4. A patch is available for this vulnerability. There are no known exploits in the wild at this time.
Multiple vulnerabilities have been identified in OpenSSL affecting TLS/SSL and QUIC implementations. These include excessive memory allocation from crafted certificates causing potential denial of service, QUIC server amplification attacks due to address validation bypass, CPU exhaustion from inefficient QUIC stream reassembly, and timing side-channel leakage in elliptic-curve scalar multiplication. The vulnerabilities can lead to denial of service or private key exposure under specific conditions. A security update addressing these issues is available.
Multiple security vulnerabilities have been identified in OpenSSL affecting Red Hat Enterprise Linux 10.0 Extended Update Support and related variants. These include information disclosure, data tampering, denial of service, acceptance of forged messages, unbounded memory growth, and use-after-free issues in various cryptographic operations. Red Hat has issued an important security advisory with updates to address these issues.
A denial of service vulnerability (CVE-2026-84445) exists in the gRPC-Go library used by the rhc client tool and daemon in Red Hat Enterprise Linux 9. This flaw allows denial of service via malformed RPC requests. Red Hat has released updated rhc packages to address this issue across multiple architectures and variants of Red Hat Enterprise Linux 9. No known exploits are reported in the wild. The Helm CLI for Red Hat OpenShift v4.3.0 is unrelated to this vulnerability fix.
GitPython versions prior to 3.27.0 and certain other version ranges contain a vulnerability where the clone_from() and clone() methods do not block the --separate-git-dir option by default. This allows an attacker controlling input to specify an arbitrary path for the Git metadata directory outside the intended clone destination, potentially leading to arbitrary directory and file creation limited by filesystem permissions. The vulnerability is due to an omission in the denylist of unsafe_git_clone_options. A patch is available for affected versions.
A vulnerability in GitPython's TagReference.create() method allows an attacker to read arbitrary local files by bypassing unsafe option guards with a specially crafted positional argument. This causes the contents of arbitrary files to be returned in the annotated tag message. The issue affects GitPython versions up to 3.1.58 and requires the embedding application to forward a user-controlled reference value. A fix is available that properly checks positional arguments or separates them with '--' to prevent this bypass. This vulnerability is relevant to Red Hat Satellite and related container images as noted in the Red Hat security advisory.
## Summary
A timing side-channel vulnerability exists in the PKCE (RFC 7636) implementation
of the Authorization Code Grant flow. The `code_challenge_method_plain` function
uses Python's standard `==` operator for string comparison instead of a
constant-time comparison function, potentially allowing timing-based attacks.
## Affected Component
- File: `oauthlib/oauth2/rfc6749/grant_types/authorization_code.py`
- Functions: `code_challenge_method_plain`, `code_challenge_method_s256`
- Vulnerability Type: CWE-208 (Observable Timing Discrepancy)
## Technical Details
Python's `==` operator uses short-circuit evaluation when comparing strings:
1. Returns `False` immediately if lengths differ
2. Compares characters left-to-right, stopping at first mismatch
This means comparison time varies linearly with the length of the common prefix
between the attacker-supplied verifier and the stored challenge, creating a
measurable timing oracle.
## Proof of Concept
Tested locally against oauthlib source (network jitter eliminated to isolate
pure Python execution time):
| Input | Result | Time (10M iterations) |
|---|---|---|
| Wrong first char (`B` + `A`*49) | Fast reject | 0.34106s |
| 49 chars correct (`A`*49 + `B`) | Deep compare | 0.37847s |
| **Difference** | | **0.03741s** |
The ~37ms delta over 10M iterations corresponds to nanosecond-level differences
per call, which are statistically exploitable under controlled conditions.
## Attack Scenario
1. Attacker intercepts `authorization_code` via Custom URI Scheme Hijacking
2. PKCE blocks token request — attacker lacks `code_verifier`
3. Attacker sends repeated requests to `/token` endpoint measuring response times
4. Using timing oracle, attacker recovers `code_verifier` character by character
5. Attacker obtains Access Token → Account Takeover
> **Note:** Practical exploitability is limited due to the single-use nature of
> authorization codes and real-world network noise. However, the vulnerable
> pattern should be corrected as a defense-in-depth measure.
## Recommended Fix
Replace `==` with `hmac.compare_digest()` for constant-time comparison:
cr: Elvin Latifli
This security advisory addresses vulnerabilities in the Expat XML parsing library used in Red Hat Enterprise Linux 8 and related distributions. The update fixes a denial of service vulnerability caused by quadratic complexity in attribute processing (CVE-2026-66046) and an XML injection vulnerability via malformed UTF-16 input (CVE-2026-93990). The vulnerabilities have been rated as important by Red Hat Product Security. Updated packages are available for multiple architectures including x86_64, s390x, ppc64le, and aarch64. The advisory provides links to the official Red Hat errata and update instructions.
CVE-2026-103044 is a critical XML injection vulnerability, also known as blind XPath injection, in the Mediawiki EasyTimeline extension maintained by The Wikimedia Foundation. This flaw allows attackers to inject malicious XML content, potentially impacting confidentiality, integrity, and availability. The vulnerability affects versions before 1.43.10, 1.45.5, and 1.46.1 of the EasyTimeline extension. It has a high CVSS score of 9.8, indicating severe risk if exploited.
CVE-2026-102793 is a critical command injection vulnerability in Ziroom ZHOME A0101 version 1.0.1.0. It affects the set_time_zone function in the /api/ZRFirmware/set_time_zone endpoint. The vulnerability arises from improper handling of the hostname/zonename argument, allowing remote attackers to execute arbitrary commands. Exploit code has been published, but no vendor response or patch is currently available.
An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted request.
An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access Portal to obtain unauthorized Mobile VPN with SSL access through a specially crafted request.
CVE-2026-13046 is a high-severity vulnerability in WatchGuard Fireware OS affecting its SAML single sign-on session handling component (samld). It involves deserialization of untrusted data, allowing an attacker with file write access on the appliance to execute arbitrary code within the samld service context. The vulnerability affects multiple version ranges of Fireware OS prior to certain patch levels.
A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a specially crafted management API request.
An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of the system's diagnostic tools by repeatedly starting and aborting a specially crafted diagnostic task through the web UI.
An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other web applications they are not authorized for by sending a specially crafted request for a different resource which they are authorized to access.
anchorme versions up to 3.0.8 contain a regular expression denial of service (ReDoS) vulnerability in the IPv6 host extraction regex. This vulnerability arises from catastrophic backtracking in the regex engine when processing specially crafted input strings, which can block the Node.js event loop and cause denial of service.
LightLLM versions up to 1.2.0 have a memory exhaustion vulnerability in the NCCL control channel when started with the --pd_trans_mode nccl option. This flaw allows unauthenticated attackers to invoke the exposed_set_value method to store unlimited key-value pairs without size restrictions, leading to exhaustion of KV-transfer worker memory. The resulting memory exhaustion causes the worker process to crash and triggers node failure.
LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. Attackers can send crafted serialized objects to exposed cache methods to execute arbitrary code with service privileges.
LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enable_profiling flag. The service exposes an unauthenticated RPyC server with pickle deserialization enabled, allowing attackers to execute arbitrary code by sending crafted serialized objects to the profiler command queue.