Threat database

Starlette's HTTPEndpoint dispatches HTTP methods by lowercasing the method name and using getattr without restricting to known HTTP verbs. If an HTTPEndpoint subclass is registered via Route without specifying allowed methods, any HTTP method, including non-standard ones, can invoke attributes on the endpoint. This allows attackers to call internal methods not intended as HTTP handlers, potentially bypassing authorization checks. The issue affects Starlette versions from 0.4.3 up to but not including 0.5.5 and frameworks built on it like FastAPI. A fix is available in version 0.5.5 by explicitly specifying allowed HTTP methods in Route registrations.

Starlette versions from 0.4.3 up to but not including 0.5.4_1 have a vulnerability where the HTTP Host header is not validated before reconstructing request.url. This allows an attacker to craft a malformed Host header that causes request.url.path to differ from the actual requested path, potentially bypassing path-based security checks that rely on request.url.path. The issue is fixed in version 0.5.4_1 by validating the Host header against RFC 9112 and RFC 3986 grammar and falling back to a safe value if malformed.

A vulnerability in pyasn1's univ.Real type causes excessive CPU and memory consumption when converting decoded REAL values with large exponents to Python floats. This can lead to denial of service when applications process untrusted ASN.1 data and perform float conversions such as printing or comparisons. The issue is fixed in pyasn1 version 0.6.4, which handles large exponents safely. Applications that do not handle ASN.1 REAL values or avoid converting these values from untrusted sources are not affected.

A vulnerability in the pyasn1 library causes quadratic time complexity when processing OBJECT IDENTIFIER and RELATIVE-OID values during ASN.1 decoding and encoding. This can lead to denial of service when applications decode or re-encode crafted ASN.1 data containing many arcs in OIDs. The issue affects BER, CER, and DER codecs. It is fixed in pyasn1 version 0.6.4. Users should limit the size of untrusted ASN.1 input as a workaround.

CVE-2026-59884 is a denial of service vulnerability in the pyasn1 library's BER/CER/DER decoders. The flaw arises from unbounded long-form tag IDs that cause excessive CPU consumption and can trigger unhandled exceptions on Python 3.11+. Applications decoding untrusted ASN.1 data with affected pyasn1 versions are vulnerable. The issue is fixed in pyasn1 version 0.6.4 and later.

The pyasn1 library contains a denial of service vulnerability caused by unbounded recursion when decoding ASN.1 data with deeply nested indefinite-length SEQUENCE or SET tags. An attacker can supply a crafted payload that triggers recursive decoding calls without depth checks, leading to a RecursionError or out-of-memory crash. This vulnerability affects services parsing untrusted ASN.1 data, such as LDAP, SNMP, Kerberos, and X.509 parsers, allowing remote attackers to crash service workers with small payloads.

A Denial-of-Service (DoS) vulnerability exists in pyasn1 version 0.6.1 due to improper handling of malformed RELATIVE-OID values with excessive continuation octets during decoding. This flaw can cause memory exhaustion leading to system hangs or service outages. The vulnerability affects applications that decode ASN.1 data such as LDAP servers, TLS/SSL endpoints, and OCSP responders. A fix is available in pyasn1 version 5.14.0_7.

The httplib2 HTTP client library has a vulnerability where it performs unbounded decompression of gzip or deflate encoded HTTP response bodies. A malicious server can send a small compressed payload that decompresses to a very large size in memory, causing the client process to run out of memory or crash. This decompression bomb attack affects any application using httplib2.Http().request() against untrusted HTTP endpoints. The vulnerability is fixed in version 5.14.0_15.

CVE-2026-71870 is a vulnerability in pypdf affecting versions from 3.0 up to but not including 3.3.16_1. It allows an attacker to craft a PDF with a large /ToUnicode stream in a font, causing excessive memory consumption during parsing, such as text extraction. This issue has been fixed in pypdf version 3.3.16_1.

CVE-2026-71852 is a vulnerability in pypdf that allows an attacker to craft a PDF file with large CID font width ranges, causing long runtimes and large memory usage during parsing, such as text extraction. This issue has been fixed in pypdf version 6.15.0. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.

A vulnerability in pypdf allows an attacker to craft a PDF with image dimensions that are much larger than the actual image data, causing excessive memory usage when the PDF is processed. This issue has been fixed in pypdf version 6.14.0. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.

CVE-2026-59937 is a vulnerability in pypdf that allows an attacker to craft a PDF with repeated malformed cross-reference streams, causing long runtimes during processing. This issue has been fixed in pypdf version 6.14.0. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.

CVE-2026-59936 is a high-severity vulnerability in pypdf that allows an attacker to craft a PDF containing a not terminated inline image, causing an infinite loop during content stream parsing such as text extraction. This flaw has been fixed in pypdf version 6.14.1. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.

CVE-2026-59935 is a high-severity vulnerability in pypdf that allows an attacker to craft a PDF containing a not terminated inline image using ASCII85 or ASCIIHex filters, causing an infinite loop during content stream parsing such as text extraction. This issue affects pypdf versions from 3.0 up to but not including 3.3.15_3. A fix is available in version 3.3.15_3.

CVE-2026-57204 is a vulnerability in pypdf where missing stream length values cause the parser to ignore defined limits, potentially leading to excessive memory usage. This occurs when parsing a PDF content stream without a /Length value. The issue has been fixed in pypdf version 6.13.3.