A vulnerability in pdfly's pypdf library allows crafted PDF files with cross-reference streams to cause large memory usage. This issue has been fixed in pypdf version 6.21.3. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.
CVE-2026-119208 is a vulnerability in pdfly's pypdf component that allows an attacker to craft an encrypted PDF file with a manipulated page count (/Count) value. Accessing the page count in such a file can cause excessive runtimes and large memory usage. This issue affects versions 0.4.0 and later and has been fixed in pypdf version 6.21.3.
CVE-2026-119207 is a vulnerability in pdfly's pypdf component that allows an attacker to craft a malicious PDF causing large memory usage when an invalid dictionary is loaded in strict mode. This can lead to resource exhaustion. The issue affects versions 0.4.0 and later. A fix is available in pypdf version 6.21.3. If upgrading is not possible, applying the changes from pull request #4265 is recommended as a workaround.
CVE-2026-119206 is a vulnerability in pdfly's pypdf component where crafted PDF files can cause long runtimes when retrieving page labels. This can lead to denial-of-service conditions due to resource exhaustion. The issue affects versions 0.4.0 and later. A fix is available in pypdf version 6.21.3. Users unable to upgrade immediately can apply the changes from pull request #4251 as a workaround.
A vulnerability in pdfly's pypdf library allows an attacker to craft a PDF that triggers an infinite loop when cloning or duplicating a DictionaryObject. This can cause denial of service due to resource exhaustion. The issue affects versions from 0.4.0 onward and has been fixed in pypdf version 6.21.4.
A vulnerability in pdfly's pypdf component allows an attacker to craft a PDF that causes large memory usage when parsing the page tree with many shared resources. This can lead to resource exhaustion. The issue is fixed in pypdf version 6.21.4.
A vulnerability in pdfly's pypdf library allows an attacker to craft a PDF that causes an infinite loop when the file is incomplete and missing a trailer. This issue has been addressed in version 6.21.4 of pypdf.
Wireshark Release Candidate 5.0.0 was published on October 31, 2026, signaling the upcoming release of a new major version of the Wireshark network protocol analyzer. No specific security vulnerabilities or threats are described in this announcement.
YARA-X version 1.22.1 is a bugfix release that addresses two bugs. This release does not include the new built-in functions for reading 64-bit integers that are present in YARA 4.6.0. YARA-X has effectively replaced YARA as the tool for pattern matching and malware research.
YARA-X version 1.22.0 was released on October 25, 2026, introducing 11 improvements and 9 bug fixes. Among the enhancements is the addition of built-in functions to read 64-bit integers in various formats. There is no indication of security vulnerabilities or threats associated with this release.
OAuthlib contains a vulnerability in its token grant handlers where an authenticated low-privilege client can supply a different client_id in the token request body, causing grant and scope validation to be performed under that other client identity. This affects the client_credentials and password grant flows. The flaw allows a low-privilege client to obtain tokens with scopes or grant types assigned to a higher-privilege client if the application validator authorizes based on the attacker-supplied client_id argument. The issue is fixed in OAuthlib version 5.5.0.
pyasn1 versions up to 0.6.4 have a denial-of-service vulnerability in decoding binary-encoded ASN.1 REAL values with large mantissas. The decoding process is quadratic in the mantissa length, causing excessive CPU consumption. This affects BER, CER, and DER decoders using the shared RealPayloadDecoder. An attacker supplying crafted ASN.1 REAL values to an application using these decoders can cause CPU exhaustion during decoding. The issue is fixed in pyasn1 version 0.6.5.
CVE-2026-119196 is a vulnerability in pyasn1 versions through 0.6.4 where decoding constructed BIT STRING values with many fragments causes quadratic CPU consumption. This can lead to CPU exhaustion and denial of service when processing attacker-controlled ASN.1 data. The issue affects BER and CER decoders and certain schema-driven DER decoding paths. No confidentiality or integrity impact is reported. The vulnerability has a CVSS score of 7.5, indicating high severity.