Threats affecting pkg:generic/libhevc

A vulnerability in psutils' pypdf component allows an attacker to craft encrypted PDF files with incorrect page count values, causing excessive runtimes and large memory usage when accessing the page count. This issue has been fixed in pypdf version 6.21.3.

CVE-2026-119207 is a high-severity vulnerability in the psutils product affecting versions 3.0 and later. It allows an attacker to craft a malicious PDF that triggers large memory usage by loading an invalid dictionary in strict mode. This can lead to resource exhaustion. The issue has been fixed in pypdf version 6.21.3. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.

CVE-2026-119206 is a vulnerability in the pypdf library used by psutils that allows an attacker to craft a malicious PDF file causing long runtimes when retrieving page labels. This can lead to denial of service due to resource exhaustion. The issue affects pypdf versions 3.0 and later and has been fixed in version 6.21.3. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.

A vulnerability in psutils' pypdf library allows an attacker to craft a PDF that triggers an infinite loop when cloning or duplicating a DictionaryObject. This can cause denial of service by exhausting resources. The issue affects versions 3.0 and later and has been fixed in pypdf version 6.21.4.

CVE-2026-119204 is a vulnerability in the pypdf library used by psutils that can cause large memory usage when parsing a PDF page tree with many shared resources. This issue can be triggered by an attacker crafting a malicious PDF. The vulnerability is fixed in pypdf version 6.21.4.

A vulnerability in psutils' pypdf library allows an attacker to craft a PDF file that causes an infinite loop when the file is incomplete and lacks a trailer section. This issue is fixed in pypdf version 6.21.4.

OAuthlib contains a vulnerability in its token grant handlers where an authenticated low-privilege client can supply a different client_id in the token request body, causing grant and scope validation to be performed under that other client identity. This affects the client_credentials and password grant flows. The flaw allows a low-privilege client to obtain tokens with scopes or grant types assigned to a higher-privilege client if the application validator authorizes based on the attacker-supplied client_id argument. The issue is fixed in OAuthlib version 5.5.0.

pyasn1 versions up to 0.6.4 have a denial-of-service vulnerability in decoding binary-encoded ASN.1 REAL values with large mantissas. The decoding process is quadratic in the mantissa length, causing excessive CPU consumption. This affects BER, CER, and DER decoders using the shared RealPayloadDecoder. An attacker supplying crafted ASN.1 REAL values to an application using these decoders can cause CPU exhaustion during decoding. The issue is fixed in pyasn1 version 0.6.5.

CVE-2026-119196 is a vulnerability in pyasn1 versions through 0.6.4 where decoding constructed BIT STRING values with many fragments causes quadratic CPU consumption. This can lead to CPU exhaustion and denial of service when processing attacker-controlled ASN.1 data. The issue affects BER and CER decoders and certain schema-driven DER decoding paths. No confidentiality or integrity impact is reported. The vulnerability has a CVSS score of 7.5, indicating high severity.

pyasn1 versions 0.6.4 and earlier contain a quadratic-time denial of service vulnerability in decoding constructed OCTET STRINGs, constructed character strings, and indefinite-length ANY types. This flaw causes excessive CPU consumption when processing many fixed-size fragments, potentially leading to CPU exhaustion if attacker-controlled ASN.1 input is decoded without proper limits. The issue affects BER and CER decoding paths and certain non-conforming DER inputs. No confidentiality or integrity impacts are reported. The vulnerability has a CVSS score of 7.5, indicating high severity.

CVE-2026-119194 is a high-severity vulnerability in pyasn1 used by Ansible@13 (version 13.7.0 and later). It causes quadratic CPU usage when decoding attacker-controlled schemaless BER, CER, or DER data with many distinct long tag IDs, potentially leading to denial of service by exhausting CPU resources. The flaw arises from inefficient handling of TagSet insertions during decoding. No confidentiality or integrity impacts were observed.

The joserfc library version 1.7.4 has a vulnerability in its compact JWS size guard. It allocates attacker-controlled memory segments before validating their size, leading to excessive memory allocation prior to rejecting oversized inputs. This can cause increased memory usage and potentially trigger MemoryError exceptions under constrained environments.

The joserfc library's JWE General JSON parser accepts an attacker-controlled recipients array of unlimited length and performs a costly RSA private-key decryption operation for each recipient. This lack of a cap on recipient count enables an unauthenticated attacker to cause CPU exhaustion (Denial of Service) by sending a single JWE JSON document with many recipients. The library's documented mitigation option does not reduce CPU usage, making the issue exploitable. A fix is available in version 5.0.0.

The Kaskade OAuth 2.0 Dynamic Client Registration Management implementation in Authlib has a security flaw where example code omits the critical check binding the registration_access_token to the specific client. This omission allows an attacker possessing any valid registration_access_token and knowledge of a client_id to bypass authorization and access, modify, or delete that client's registration. The vulnerability affects versions 4.0.4 and later. The CVSS 3.1 score is 8.8 (high severity).