Threats affecting pkg:generic/libhevc

CVE-2026-119194 is a high-severity vulnerability in pyasn1 used by smbclient-ng (>=3.1.0) where schemaless decoding of BER, CER, or DER data with many distinct long tag IDs causes quadratic CPU usage. This can lead to CPU exhaustion and reduced service availability when processing attacker-controlled inputs. The vulnerability arises from inefficient handling of tag sets during decoding, causing excessive CPU consumption without affecting confidentiality or integrity.

pyasn1 versions up to 0.6.4 have a denial of service vulnerability in the decoding of binary-encoded ASN.1 REAL values with large mantissas. The decoding process is quadratic in CPU time relative to mantissa length, causing high CPU usage and potential exhaustion. This affects BER, CER, and DER decoders using the RealPayloadDecoder. The issue is fixed in pyasn1 0.6.5 by optimizing the decoding loop.

CVE-2026-119196 is a denial-of-service vulnerability in pyasn1 versions through 0.6.4 affecting the decoding of constructed BIT STRING values. The decoder repeatedly shifts and copies accumulated data, causing CPU time to grow quadratically with input size. This can lead to CPU exhaustion when processing attacker-controlled ASN.1 data. The vulnerability affects BER and CER decoders and certain schema-driven DER decoding paths. No confidentiality or integrity impact is reported. The issue requires untrusted input to reach the vulnerable decoder path and sufficient fragment count to cause exhaustion.

A denial of service vulnerability exists in pyasn1 version 0.6.4 and earlier due to quadratic-time complexity in decoding constructed OCTET STRINGs, certain constructed character strings, and indefinite-length ANY types. This can cause excessive CPU consumption when processing attacker-controlled ASN.1 inputs with many fragments. The issue affects BER and CER decoding paths and certain non-conforming DER inputs. No confidentiality or integrity impact is reported. The vulnerability has a CVSS score of 7.5 (high severity).

OAuthlib contains a vulnerability in its token grant handlers where an authenticated low-privilege client can supply a different client_id in the token request body, causing authorization checks to be performed under that other client identity. This affects the client_credentials and password grant flows. The flaw arises because OAuthlib does not require the authenticated client's client_id to match the client_id parameter in the request body during grant and scope validation. This can lead to token authorization bypass where a low-privilege client obtains tokens with scopes or grant types assigned to a higher-privilege client.

A denial of service vulnerability in Schemathesis's GraphQL-core validation occurs due to a memory leak when validations are aborted after exceeding the max_errors limit. The shared ValidationAbortedError instance retains traceback frames and validation context, causing memory to grow with each aborted validation request. This can exhaust memory and crash the process. The issue affects versions >=4.32.1 and <4.32.5 and is fixed in 4.32.5.

The Web 2.0 Directory plugin for WordPress is vulnerable to time-based SQL Injection via the 'w2dc_level_filter' parameter in all versions up to, and including, 2.10.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Because the parameter is used in integer context without surrounding quotes, WordPress's built-in addslashes/magic_quotes escaping provides no protection against time-based payloads such as SLEEP-based conditionals.

A vulnerability in joserfc 1.7.4 allows attacker-controlled segments to be allocated in memory before size validation rejects them. This occurs because the library calls bytes.split() on the input before checking its length, causing an additional allocation roughly the size of the payload. This undermines the intended size guard and can lead to excessive memory usage. The issue is fixed in version 5.2.5.

The joserfc library's decrypt_json() function for JWE General JSON Serialization does not limit the number of recipients in the 'recipients' array. This allows an attacker to craft a JWE with an unbounded number of recipients, causing the library to perform a costly RSA private-key decryption operation for each recipient. This results in a CPU exhaustion denial-of-service (DoS) vulnerability with a high severity score (CVSS 7.5). The library's existing mitigation option verify_all_recipients=False does not reduce CPU usage, as all recipients are decrypted before this flag is checked. A fix is available in version 5.2.3_1.

CVE-2026-119209 is a vulnerability in the pdfalyzer tool (pypdf library) that allows an attacker to craft a PDF file with cross-reference streams causing large memory usage when parsed. This can lead to denial of service due to resource exhaustion. The issue affects versions starting from 1.16.1. A fix is available in pypdf version 6.21.3. If upgrading is not immediately possible, applying the changes from the referenced pull request #4269 is recommended as a workaround.

CVE-2026-119208 is a vulnerability in pypdf (pdfalyzer) that allows an attacker to craft an encrypted PDF file with a manipulated /Count value, causing excessive runtimes and large memory usage when accessing the page count. This can lead to denial of service conditions due to resource exhaustion. The issue affects versions starting from 1.16.1 and has been fixed in pypdf version 6.21.3.

CVE-2026-119207 is a high-severity vulnerability in pdfalyzer's pypdf component that allows an attacker to craft a malicious PDF causing large memory usage when an invalid dictionary is loaded in strict mode. This can lead to resource exhaustion. The issue has been fixed in pypdf version 6.21.3. If upgrading is not immediately possible, applying the changes from the referenced pull request #4265 is recommended as a workaround.

CVE-2026-119206 is a vulnerability in the pdfalyzer product related to the pypdf library. It allows an attacker to craft a PDF file that causes long runtimes when retrieving page labels. This can lead to performance degradation or denial of service. The issue affects versions of pdfalyzer using pypdf from 1.16.1 onward. A fix is available in pypdf version 6.21.3. If upgrading is not immediately possible, applying the changes from pull request #4251 is recommended as a workaround.

CVE-2026-119205 is a vulnerability in pdfalyzer's pypdf component where cloning a DictionaryObject can cause an infinite loop. This flaw allows an attacker to craft a malicious PDF that triggers this behavior. The issue has been fixed in pypdf version 6.21.4. Users unable to upgrade immediately can apply the patch from the referenced pull request.

CVE-2026-119204 is a vulnerability in the pdfalyzer product related to the pypdf library. It allows an attacker to craft a malicious PDF that causes large memory usage during parsing of the page tree with many shared resources. This can lead to high resource consumption on the affected system. A fix is available in pypdf version 6.21.4. If upgrading is not possible, applying the changes from pull request #4290 is recommended as a workaround.

A vulnerability in pdfalyzer (pypdf) allows an attacker to craft a PDF file that causes an infinite loop when the parser encounters an incomplete file missing a trailer during the standard cross-reference table trailer search.