The aiohttp server component in Lexicon versions >=3.25.2_3 and <3.25.2_5 lacks an initial request/header timeout, allowing an attacker to keep an idle connection open indefinitely before sending any data. This issue has been fixed in version 3.25.2_5. The vulnerability has a high severity with a CVSS score of 8.2. A recommended workaround is to use a reverse proxy with sensible keepalive limits.
A vulnerability in AIOHTTP allows the Secure attribute of a shared cookie to not be enforced, potentially causing the cookie to be sent over unencrypted requests. This flaw affects versions from 3.25.2_3 up to but not including 3.25.2_5 and has a medium severity rating. A fix is available in version 3.25.2_5.
CVE-2026-104874 is a reference leak vulnerability in the items-view union and subtraction operators of the aio-libs/multidict Python library versions 6.7.0 through 6.9.0. The flaw causes unbounded memory growth by leaking key-identity and value objects during certain set operations on dictionary views. This leak occurs because new references are created but never released in specific code paths. The vulnerability can be triggered remotely by supplying large HTTP headers or query strings to servers using this library, causing memory exhaustion until the process is terminated.
A Regular Expression Denial of Service (ReDoS) vulnerability exists in soupsieve's CSS selector parsing, specifically in the IDENTIFIER and VALUE sub-patterns. The flaw causes quadratic backtracking when parsing certain crafted selectors that fail to match, resulting in excessive CPU consumption. This can be triggered by user-controlled CSS selectors passed to soupsieve or BeautifulSoup's select methods. The vulnerability affects soupsieve versions from 3.11.2 up to but not including 3.25.2_3. A fix is available in version 3.25.2_3.
A Regular Expression Denial of Service (ReDoS) vulnerability exists in soupsieve's whitespace/comment trimming regex RE_WS_END. The regex is used to trim trailing whitespace/comments from CSS selectors but is unanchored at the start and invoked with .search(), causing quadratic time complexity on valid selectors with long whitespace or comment runs. This can stall the interpreter for seconds on large inputs. The issue affects soupsieve versions from 3.11.2 up to but not including 3.25.2_3. A fix is available in version 3.25.2_3.
A Regular Expression Denial of Service (ReDoS) vulnerability exists in soupsieve's CSS selector parser due to a regex pattern that suffers catastrophic backtracking when processing attribute selectors with unterminated quoted values. This flaw allows an attacker to cause CPU exhaustion by passing crafted CSS selectors to soupsieve.compile() or Beautiful Soup's select methods. The attack requires only about 300 bytes of input to cause a multi-second hang, with exponential backtracking time as input length increases. The vulnerability affects soupsieve versions from 3.11.2 up to but not including 3.25.2_2. A fix is available in version 3.25.2_2.
A memory exhaustion vulnerability exists in soupsieve, the CSS selector engine used by Beautiful Soup 4, due to unbounded memory allocation when compiling large comma-separated selector lists. An attacker can supply a crafted CSS selector string with many comma-separated items, causing the parser to allocate excessive heap memory, leading to denial of service. This affects applications that use soupsieve.compile() or Beautiful Soup's .select()/.select_one() with user-supplied selectors. The issue is fixed in version 3.25.2_2.
CVE-2026-22701 is a Time-of-Check-Time-of-Use (TOCTOU) race condition vulnerability in the SoftFileLock class of the filelock package. It allows a local attacker with permission to create symlinks to exploit a race window between permission checking and file creation, potentially causing lock operations to fail or operate on unintended files. This can lead to silent lock acquisition failures, denial of service, and resource serialization issues. The vulnerability affects applications using SoftFileLock or fallback FileLock on systems without fcntl support. A patch adding the O_NOFOLLOW flag to prevent symlink following during lock file creation is available in version 3.23.2_3. Users are advised to upgrade or apply mitigations such as avoiding SoftFileLock in sensitive contexts and restricting filesystem permissions.
CVE-2025-68146 is a TOCTOU race condition vulnerability in the filelock library affecting Unix, Linux, macOS, and Windows. It allows local attackers with filesystem access to exploit a timing window between checking for a lock file's existence and opening it with truncation flags. By creating a symlink during this window, attackers can cause arbitrary user files to be truncated. This impacts dependent software such as virtualenv, PyTorch, poetry, and tox. The issue is fixed in filelock version 3.20.1 by preventing symlink following during lock file creation.
A URL parsing vulnerability in the Requests library prior to version 2.32.4 can cause leakage of .netrc credentials to third parties when processing certain malicious URLs. This issue affects Lexicon versions >=3.11.2 and <3.21.1_1. The vulnerability has a medium severity with a CVSS score of 5.3. A fix is available in version 3.21.1_1. As a workaround for older versions, disabling .netrc usage by setting trust_env=False in Requests sessions can mitigate the risk.