Threat database

A Denial-of-Service (DoS) vulnerability exists in pyasn1 version 0.6.1 due to memory exhaustion caused by malformed RELATIVE-OID values with excessive continuation octets during decoding. This can cause systems processing ASN.1 data, such as LDAP servers, TLS/SSL endpoints, and OCSP responders, to hang or stop services. The issue is fixed in pyasn1 version 9.0.9_2.

The httplib2 HTTP client library is vulnerable to a decompression bomb denial of service (DoS) attack via unbounded gzip or deflate response handling. A malicious HTTP server can send a small compressed payload that decompresses to a very large size in memory, causing the client process to run out of memory or crash. This affects any application using httplib2.Http().request() against untrusted or attacker-controlled HTTP endpoints. The vulnerability is fixed in version 10.2.1.

A vulnerability in pyasn1's univ.Real type causes excessive CPU and memory consumption when converting decoded REAL values with large exponents to Python floats. This can lead to denial of service when applications process untrusted ASN.1 data and perform operations like printing, logging, or comparing these values. The issue affects float conversion methods and is reachable via BER, CER, and DER decoders. It is fixed in pyasn1 version 0.20.0_1.

A denial of service vulnerability exists in pyasn1 versions >=0.15.0 and <0.20.0_1 due to quadratic time complexity in processing OBJECT IDENTIFIER and RELATIVE-OID values during ASN.1 decoding and encoding. This allows crafted payloads with many arcs to consume excessive CPU resources. The issue is fixed in version 0.20.0_1.

CVE-2026-59884 is a denial of service vulnerability in the pyasn1 library's BER/CER/DER decoders caused by unbounded long-form tag IDs. The decoder accumulates continuation octets without an upper limit, allowing crafted inputs to cause excessive CPU usage. On Python 3.11 and later, this can also trigger an unhandled ValueError during error message formatting, potentially bypassing error handling. The issue affects pyasn1 versions from 0.15.0 up to but not including 0.20.0_1 and is fixed in version 0.20.0_1.

The pydantic-settings library's NestedSecretsSettingsSource component, when used with secrets_nested_subdir=True, improperly follows symbolic links inside the configured secrets_dir that point outside this directory. This allows reading files outside the intended secrets directory into application settings, bypassing the configured secrets_dir_max_size limit. The flaw arises from inconsistent directory traversal methods used for size checking and loading secrets, enabling local file read and resource exhaustion via cyclic symlinks. The vulnerability requires the ability to place symlinks inside the secrets directory and is not remotely exploitable by itself. A fix is available in pydantic-settings version 0.19.0_2.

Starlette's request.form() method does not enforce configured limits on max_fields and max_part_size for application/x-www-form-urlencoded content types, allowing unauthenticated attackers to send requests with very large numbers of fields or very large field sizes. This leads to denial of service by blocking the event loop or causing excessive memory allocation. The issue is fixed in version 0.19.0_1 by enforcing these limits during parsing.

A vulnerability in Starlette versions >=0.13.1 and <0.19.0_1 allows an attacker to manipulate the reconstructed request URL's hostname by sending a request path that does not start with a slash. This causes the path to be interpreted as part of the URL authority, misleading code that relies on request.url.hostname for security decisions. The issue affects middleware or handlers that inspect request.url before routing and can lead to incorrect host-based authorization or logging. The vulnerability is fixed in version 0.19.0_1.

Starlette's HTTPEndpoint dispatches HTTP methods by lowercasing the method name and using getattr to call an attribute, without restricting to known HTTP verbs. If a route is registered without an explicit methods= argument, non-standard HTTP methods can invoke internal endpoint methods not intended as handlers. This can allow attackers to reach internal methods lacking authorization checks. The issue affects Starlette versions from 0.13.1 up to but not including 0.19.0 and frameworks built on it, such as FastAPI. A fix is available in version 0.19.0.

A vulnerability in Starlette versions >=0.13.1 and <0.17.2_1 allows an attacker to send a malformed HTTP Host header that causes the reconstructed request.url.path to differ from the actual requested path. This discrepancy can bypass security checks that rely on request.url.path for path-based authorization. The issue is fixed in version 0.17.2_1. The impact depends on application design, specifically if security decisions are based on request.url.path rather than the canonical ASGI path. Reverse proxies that validate Host headers can mitigate this risk.

Starlette's FileResponse component contains a vulnerability in its HTTP Range header parsing logic that leads to O(n^2) time complexity. An unauthenticated attacker can send a crafted Range header with many small, non-overlapping ranges, causing CPU exhaustion and denial of service. This affects any Starlette application serving files via FileResponse or StaticFiles, including frameworks built on Starlette such as FastAPI. The vulnerability is fixed in Starlette version 0.14.6_1.

Starlette versions from 0.13.1 up to but not including 0.14.1_1 have a denial-of-service vulnerability when parsing multipart forms containing large files. The issue arises because the main event thread blocks while rolling over large uploaded files to disk, preventing new connections from being accepted. This vulnerability has a medium severity with a CVSS score of 5.3 and does not impact confidentiality or integrity, only availability. A fix is available in version 0.14.1_1.

The pyasn1 library suffers from a Denial of Service vulnerability due to unbounded recursion when decoding ASN.1 data with deeply nested indefinite-length SEQUENCE or SET structures. An attacker can craft a payload that triggers recursive decoding calls without depth limits, causing the Python interpreter to crash with a RecursionError or exhaust memory, leading to service crashes or resource exhaustion. This affects services using pyasn1 for ASN.1 parsing such as LDAP, SNMP, Kerberos, and X.509 parsers. The vulnerability is fixed in pyasn1 versions 3.0.5 and 26.3.0_1.