CVE-2026-102994 is a vulnerability in pypdf that allows an attacker to craft a PDF with long indirect object headers not terminated by whitespace, causing long runtimes and large memory usage during parsing. This can lead to denial of service conditions. The issue is fixed in pypdf version 6.18.0.
CVE-2026-102993 is a high-severity vulnerability in pypdf versions 3.0 up to but not including 3.3.17 that can cause large memory consumption when processing PDF documents with large Roman numeral page labels. This flaw allows an attacker to craft a malicious PDF that triggers excessive memory usage during page label retrieval. The issue has been fixed in pypdf version 3.3.17.
Multiple security vulnerabilities have been identified and fixed in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). These include memory disclosure, denial of service, heap out-of-bounds read, and a heap-buffer-overflow that allows arbitrary code execution via crafted inputs. The issues affect Red Hat Enterprise Linux 9.6 Extended Update Support and related variants. Red Hat has released updated packages to address these vulnerabilities.
CVE-2026-5241 is a high-severity vulnerability in python-transformers used by Red Hat AI Inference Server and Red Hat OpenShift AI. It allows arbitrary code execution when loading a malicious LightGlue model because the trust_remote_code security parameter can be overridden by untrusted configuration data. This flaw can lead to credential theft, unauthorized access, or backdoor deployment. The vulnerability affects all python-transformers versions before 5.5.0, with no current mitigation meeting Red Hat's criteria. Red Hat has not released a fix for this issue yet.
A denial-of-service (DoS) vulnerability exists in Qt's XML parsing due to unbounded recursion in the QDomNode destructor during QDomDocument parsing. This flaw allows a remote attacker to cause a crash by processing crafted untrusted XML input, potentially making the affected system unresponsive. Red Hat has issued an update for Red Hat Hardened Images RPMs including qt5-qtbase packages to address this issue. No mitigations meeting Red Hat's criteria are currently available. The vulnerability is rated medium severity by Red Hat.
Multiple security vulnerabilities have been identified and fixed in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). These include denial of service, memory disclosure, out-of-bounds reads, and a heap-buffer-overflow that could allow arbitrary code execution. The issues affect the xfreerdp client and related components. Red Hat has issued an important security update for Red Hat Enterprise Linux 7 Extended Lifecycle Support to address these flaws.
HTTPX2 versions prior to 0.12.16 decompress streaming response bodies fully per network read, causing large intermediate memory allocations. This decompression amplification can lead to significant memory pressure or out-of-memory termination when processing malicious compressed responses from untrusted servers. The issue affects compressed responses using gzip, deflate, brotli, or zstd encodings. The vulnerability is fixed in HTTPX2 version 0.12.16, which implements incremental decompression with bounded buffers.
HTTPX2 versions from 0.11.3 up to but not including 0.12.15 automatically add a Content-Length header even when a Transfer-Encoding header is present, resulting in conflicting HTTP/1.1 framing headers. This can cause ambiguous message boundaries leading to potential request smuggling or connection desynchronization when intermediaries interpret these headers differently. The issue is fixed in version 0.12.15.
HTTPX2 versions from 0.11.3 up to but not including 0.12.15 improperly serialize per-file Content-Type and custom headers in multipart/form-data requests without validating for control characters. This allows an attacker who can influence upload metadata to inject additional multipart part headers by including CR or LF characters, potentially altering part semantics or bypassing server-side checks. The vulnerability is fixed in HTTPX2 version 0.12.15, which rejects forbidden control characters and raises an error before serialization.
HTTPX2 versions before 0.12.8 have a Server-Sent Events (SSE) parser vulnerability where processing a long SSE line split across many small chunks causes CPU usage to grow quadratically. This can lead to denial of service by exhausting client CPU resources when consuming SSE from attacker-controlled or compromised endpoints. The issue is fixed in HTTPX2 0.12.8 by improving line buffering and limiting buffered event size.
HTTPX2 versions 2.6.0 through 2.9.1 and underlying httpcore2 before 2.10.0 do not initiate TLS for secure WebSocket (wss://) connections routed through SOCKS5 proxies. This results in the WebSocket handshake and subsequent frames being sent in plaintext through the proxy, exposing sensitive headers, cookies, and messages. An attacker controlling or observing the SOCKS proxy can intercept or modify this traffic, violating the expected confidentiality and integrity of wss connections. The issue is fixed in HTTPX2 and httpcore2 version 2.10.0 and later.
CVE-2026-82398 is a vulnerability in pypdf affecting versions >=3.0 and <3.3.16_1. It involves inefficient handling of inputs without whitespace in the read_until_whitespace function, which can cause long runtimes when processing crafted PDFs. The issue has been fixed in version 3.3.16_1.
CVE-2026-84311 is a vulnerability in pypdf that allows crafted PDF files with many XForm objects to cause long runtimes and large memory consumption during text extraction. This can degrade performance but does not indicate code execution or data corruption. The issue is fixed in pypdf version 6.16.1.