Threats affecting pkg:generic/libucl

CVE-2026-119194 is a high-severity vulnerability in the Hermes agent's use of pyasn1 version 0.6.4, where schemaless decoding of BER, CER, or DER data with many distinct long tag IDs causes quadratic CPU usage. This can lead to CPU exhaustion and reduced service availability when processing attacker-controlled inputs. The issue arises from inefficient handling of TagSet insertions during decoding. A fix is available in version 2026.4.30.

OAuthlib contains a vulnerability in its token grant handlers where an authenticated low-privilege client can supply a different client_id in the token request body, causing grant and scope validation to be performed under that other client identity. This affects the client_credentials and password grant flows. The flaw allows a low-privilege client to obtain tokens with scopes or grant types intended for a higher-privilege client if the application validator authorizes based on the attacker-supplied client_id argument. The issue is fixed in version 2026.9.21_2.

pyasn1 versions 0.6.4 and earlier contain a denial of service vulnerability in the decoding of binary-encoded ASN.1 REAL values with large mantissas. The decoding process uses a quadratic-time algorithm that can exhaust CPU resources when processing attacker-controlled input. This affects BER, CER, and DER decoders using the shared RealPayloadDecoder. The issue is fixed in pyasn1 version 0.6.5 by replacing the inefficient loop with a more efficient integer conversion.

CVE-2026-119196 affects pyasn1 versions 0.6.4 and earlier, where decoding constructed BIT STRING values with many fragments causes quadratic CPU consumption. This occurs because the decoder repeatedly shifts and copies the accumulated value for each fragment, leading to CPU exhaustion during decode(). The vulnerability impacts BER and CER decoders and certain schema-driven DER decoding paths. An attacker supplying crafted ASN.1 data can cause denial of service by exhausting CPU resources. The CVSS score is 7.5, indicating high severity due to denial of service potential without confidentiality or integrity impact.

pyasn1 versions 0.6.4 and earlier contain a vulnerability where decoding constructed OCTET STRINGs or character strings composed of many fragments can cause quadratic-time CPU usage due to repeated copying during string reassembly. This also affects indefinite-length ANY decoding. An attacker supplying crafted ASN.1 input to an affected decoder can cause CPU exhaustion, resulting in a denial of service. The issue affects BER and CER decoding paths and certain non-DER constructed strings accepted by the DER decoder with specific schemas. No confidentiality or integrity impact is reported. The CVSS v3.1 base score is 7.5 (high severity).

CVE-2026-117681 is a vulnerability in konflux-ci where the user interface proxy disables TLS certificate verification for internal backend service connections in environments without a default service certificate authority. This allows an adjacent network attacker who can intercept traffic to capture a cluster-scoped authentication token with user impersonation rights, potentially leading to full administrative control of the cluster. The issue primarily affects non-OpenShift Kubernetes clusters where the service CA is not present by default.

CVE-2026-116964 is a high-severity vulnerability in konflux-ci that allows an attacker with repository write access to execute arbitrary code within the CI/CD workflow environment. The flaw arises from the injection of shell commands into environment export scripts, causing manifest synchronization scripts to evaluate unvalidated script output. Exploitation can lead to compromise of CI/CD pipelines, theft of authentication tokens and deployment credentials, and unauthorized access to production systems. Mitigation currently relies solely on user review of pull requests or merge requests, with no official patch or fix available.

CVE-2026-116086 is a code injection vulnerability in konflux-ci where an attacker with permission to trigger automated workflows can inject malicious filter commands via crafted issue titles. This leads to information disclosure of sensitive data such as API credentials, deployment keys, and internal notes in workflow logs. The vulnerability affects specific versions of konflux-ci and does not allow direct OS code execution or cluster compromise.

A vulnerability in konflux-ci causes sensitive GitHub access tokens to be stored in plaintext on CI runners without cleanup after execution. This allows a local attacker with access to the CI environment to read these tokens and gain unauthorized repository access, potentially modifying source code or release artifacts. Exploitation requires prior code execution on the runner, limiting remote exploitation. No effective mitigation is currently available according to the vendor advisory.

joserfc 1.7.4 has a vulnerability where the compact JWS size guard allocates attacker-controlled segments before rejecting them. The library calls bytes.split() on the input before validating size limits, causing it to allocate roughly one full payload in memory even if the input is ultimately rejected for being too large. This can lead to excessive memory usage. The issue is fixed in version 3.8.1_3.

The joserfc library's decrypt_json() function for JWE General JSON Serialization accepts an unbounded recipients array, causing it to perform a costly RSA private-key decryption operation for each recipient without limit. This allows an unauthenticated attacker to craft a single JWE JSON input with many recipients, forcing the server to perform excessive CPU-intensive RSA decryptions, resulting in a denial of service via CPU exhaustion. The library caps other JWE structural elements but does not limit the number of recipients. The documented mitigation option verify_all_recipients=false does not reduce CPU usage because all recipients are decrypted before this flag is checked. This vulnerability is tracked as CVE-2026-119283 with a CVSS 3.1 score of 7.5 (High).

CVE-2026-116672 is a vulnerability in Authlib's implementation of the OAuth 2.0 Dynamic Client Registration Management Protocol (RFC 7592). The provided example code for the ClientConfigurationEndpoint fails to bind the registration_access_token to the specific client being accessed, allowing an attacker with any valid token and knowledge of a client_id to bypass authorization and modify or delete client registrations. This flaw arises because the example implementations do not verify that the token belongs to the client identified in the request. The vulnerability affects Authlib versions from 3.2.4 up to but not including 3.8.1_3. A fix is available in version 3.8.1_3.