Threats affecting pkg:generic/libucl

pyasn1 versions up to 0.6.4 have a quadratic-time denial of service vulnerability in decoding constructed OCTET STRINGs, constructed character strings, and indefinite-length ANY types in BER and CER encoding. This causes excessive CPU usage when processing many small fragments, potentially leading to CPU exhaustion. The issue affects applications that decode attacker-controlled ASN.1 input without proper limits. No confidentiality or integrity impact is reported. The vulnerability is fixed in pyasn1 version 0.22.6.

CVE-2026-119194 is a high-severity vulnerability in dstack's use of pyasn1 version 0.6.4 and earlier, where schemaless decoding of BER, CER, or DER data with many distinct long tag IDs causes quadratic CPU usage. This can lead to CPU exhaustion and reduced service availability when processing attacker-controlled inputs. The issue arises from inefficient handling of TagSet insertions during decoding. A fix is available in version 0.22.6.

OAuthlib contains a vulnerability in its token grant handlers where an authenticated low-privilege client can supply a different client_id in the token request body. This causes grant and scope validation to be performed under the attacker-supplied client_id rather than the authenticated client's identity. The issue affects the client_credentials and resource owner password credentials grant flows. An attacker with valid credentials for a low-privilege client can obtain tokens with scopes or grant types assigned to a higher-privilege client if the application validator authorizes based on the client_id argument. This is a token authorization bypass requiring authentication.

CVE-2026-119197 is a denial of service vulnerability in pyasn1 versions up to 0.6.4 affecting the decoding of binary-encoded ASN.1 REAL values with large mantissas. The decoding process has quadratic time complexity in the mantissa length, causing excessive CPU consumption during decoding. This affects BER, CER, and DER decoders that use the vulnerable RealPayloadDecoder. The issue is fixed in pyasn1 version 0.6.5 and later.

CVE-2026-119196 is a high-severity vulnerability in pyasn1 through version 0.6.4 used by Duplicity, where decoding constructed BIT STRING values with many fragments causes quadratic CPU consumption. This can lead to CPU exhaustion and denial of service when processing attacker-controlled ASN.1 data. The issue affects BER and CER decoders and certain schema-driven DER decoding paths. The vulnerability is fixed in pyasn1 version 0.8.03.