HTTPX2 versions prior to 0.12.16 decompress streaming response bodies fully per network read, causing large intermediate memory allocations. This decompression amplification can lead to significant memory pressure or out-of-memory termination when processing malicious compressed responses from untrusted servers. The issue affects compressed responses using gzip, deflate, brotli, or zstd encodings. The vulnerability is fixed in HTTPX2 version 0.12.16, which implements incremental decompression with bounded buffers.
HTTPX2 versions from 0.11.3 up to but not including 0.12.15 automatically add a Content-Length header even when a Transfer-Encoding header is present, resulting in conflicting HTTP/1.1 framing headers. This can cause ambiguous message boundaries leading to potential request smuggling or connection desynchronization when intermediaries interpret these headers differently. The issue is fixed in version 0.12.15.
HTTPX2 versions from 0.11.3 up to but not including 0.12.15 improperly serialize per-file Content-Type and custom headers in multipart/form-data requests without validating for control characters. This allows an attacker who can influence upload metadata to inject additional multipart part headers by including CR or LF characters, potentially altering part semantics or bypassing server-side checks. The vulnerability is fixed in HTTPX2 version 0.12.15, which rejects forbidden control characters and raises an error before serialization.
HTTPX2 versions before 0.12.8 have a Server-Sent Events (SSE) parser vulnerability where processing a long SSE line split across many small chunks causes CPU usage to grow quadratically. This can lead to denial of service by exhausting client CPU resources when consuming SSE from attacker-controlled or compromised endpoints. The issue is fixed in HTTPX2 0.12.8 by improving line buffering and limiting buffered event size.
HTTPX2 versions 2.6.0 through 2.9.1 and underlying httpcore2 before 2.10.0 do not initiate TLS for secure WebSocket (wss://) connections routed through SOCKS5 proxies. This results in the WebSocket handshake and subsequent frames being sent in plaintext through the proxy, exposing sensitive headers, cookies, and messages. An attacker controlling or observing the SOCKS proxy can intercept or modify this traffic, violating the expected confidentiality and integrity of wss connections. The issue is fixed in HTTPX2 and httpcore2 version 2.10.0 and later.
Multiple security vulnerabilities have been identified in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). These include memory disclosure, denial of service, heap out-of-bounds read, and a heap-buffer-overflow that allows arbitrary code execution. The vulnerabilities affect the xfreerdp client and can be triggered via crafted RDP update orders, smartcard cache requests, and RPC responses. Red Hat has issued an important security advisory with updates for affected Red Hat Enterprise Linux 8.8 variants to address these issues.
CVE-2026-82398 is a vulnerability in pypdf affecting versions >=3.0 and <3.3.16_1. It involves inefficient handling of inputs without whitespace in the read_until_whitespace function, which can cause long runtimes when processing crafted PDFs. The issue has been fixed in version 3.3.16_1.
CVE-2026-84311 is a vulnerability in pypdf that allows crafted PDF files with many XForm objects to cause long runtimes and large memory consumption during text extraction. This can degrade performance but does not indicate code execution or data corruption. The issue is fixed in pypdf version 6.16.1.
CVE-2026-84309 is a vulnerability in pypdf where an attacker can craft a malicious PDF that triggers an infinite loop in the TreeObject.insert_child function. This issue affects versions from 3.0 up to but not including 3.3.16_2. The vulnerability has been fixed in pypdf version 3.3.16_2. If upgrading is not immediately possible, applying the changes from the referenced pull request is recommended as a workaround.
CVE-2026-84310 is a vulnerability in pypdf that allows an attacker to craft a PDF causing long runtimes and large memory usage when retrieving document outlines with many or deeply nested entries. This issue has been fixed in pypdf version 6.16.1. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.
CVE-2025-47907 is a race condition vulnerability in the database/sql package used by Red Hat Trusted Artifact Signer (RHTAS) Operator. It occurs when concurrent queries are cancelled during a Scan method call on returned Rows, potentially causing inconsistent data to be returned to applications. The vulnerability primarily affects applications that cancel queries while running multiple queries concurrently. Red Hat classifies this issue as moderate severity due to its limited exploitation scope and unlikely direct compromise in typical deployments. No fix or mitigation meeting Red Hat's criteria is currently available.
A server-side request forgery (SSRF) vulnerability exists in the vLLM batch runner component of Red Hat AI Inference 3.4.4 (spyre). An attacker who can control batch input JSON may exploit this flaw to force the server to make arbitrary HTTP/HTTPS requests, potentially accessing internal services such as cloud metadata endpoints or internal APIs. This could lead to information disclosure or further compromise of the host system. Currently, no effective mitigation or fix meeting Red Hat's criteria is available.
Starlette versions from 0.4.3 up to but not including 0.5.10 have a vulnerability where an unvalidated HTTP request path can manipulate the reconstructed request URL's hostname. This occurs because the path is concatenated directly after the host without ensuring it starts with a '/', allowing an attacker to craft a path that changes the authority portion of the URL. This can mislead code that relies on request.url.hostname for security decisions. The issue is mitigated by upgrading to version 0.5.10 or later.