CVE-2026-119196 affects pyasn1 through version 0.6.4, where decoding constructed BIT STRING values with many fragments causes quadratic CPU consumption due to repeated shifting and copying operations. This can lead to CPU exhaustion and denial of service when processing sufficiently large, attacker-controlled ASN.1 data. The vulnerability impacts BER and CER decoders and certain schema-driven DER decoding paths. No confidentiality or integrity impact is reported. The issue arises from inefficient handling of constructed BIT STRING fragments during decoding.
pyasn1 versions 0.6.4 and earlier contain a denial-of-service vulnerability due to quadratic-time complexity in decoding constructed OCTET STRINGs, character strings, and indefinite-length ANY types. This occurs when decoding many fixed-size fragments, causing excessive CPU usage. The issue affects BER and CER decoding and certain non-conforming DER inputs. An attacker supplying crafted ASN.1 input to an affected decoder can cause CPU exhaustion. No confidentiality or integrity impact is reported.
CVE-2026-119194 is a high-severity vulnerability in pyasn1's schemaless BER, CER, and DER decoding that causes quadratic CPU usage when decoding attacker-controlled data with many distinct long tag IDs. This can lead to CPU exhaustion and reduced service availability. The issue arises because the decoder unnecessarily grows a set of tag identifiers, causing performance degradation with crafted inputs. No confidentiality or integrity impacts are reported.
OAuthlib contains a vulnerability in its token grant handlers where an authenticated low-privilege client can supply a different client_id in the token request body, causing authorization checks to be performed under that other client's identity. This affects the client_credentials and password grant flows when the application validator uses the client_id argument for authorization. The flaw allows a low-privilege client to obtain tokens with broader scopes or grant types assigned to another client. The issue is fixed in OAuthlib version 1.97.
joserfc version 3.2.4_2 up to but not including 4.1.2 has a vulnerability in its compact JWS size guard. The library calls bytes.split() on attacker-controlled input before validating size limits, causing it to allocate memory roughly equal to the payload size before rejecting oversized inputs. This can lead to increased memory usage and potential denial of service. A fix is available in version 4.1.2 that checks input length before splitting to prevent unnecessary allocations.
The joserfc library's decrypt_json() function for JWE General JSON Serialization accepts an unbounded recipients array, performing a costly RSA private-key decryption for each recipient without limit. This allows an unauthenticated attacker to cause CPU exhaustion (Denial of Service) by sending a single JWE JSON with many recipients. The library caps sizes of other JWE elements but does not limit recipient count. The documented mitigation option verify_all_recipients=False does not reduce CPU usage, as all recipients are decrypted before this flag is checked. This vulnerability is tracked as CVE-2026-119283 with a CVSS 3.1 score of 7.5 (High). A fix is available in joserfc version 4.0.0.
CVE-2026-116672 affects Fastmcp's implementation of the OAuth 2.0 Dynamic Client Registration Management Protocol (RFC 7592) in Authlib. The provided example code for the ClientConfigurationEndpoint omits a critical security check that binds the registration_access_token to the specific client being accessed. This omission allows an attacker possessing any valid registration_access_token and knowledge of a client_id to bypass authorization and access or modify other clients' registrations. The vulnerability exists in Fastmcp versions >=2.12.3 and <4.1.1 and is fixed in version 4.1.1.
pyasn1 versions up to 0.6.4 contain a denial of service vulnerability in the decoding of binary-encoded ASN.1 REAL values with large mantissas. The decoding process is quadratic in the mantissa length, causing excessive CPU consumption when processing attacker-controlled input. This affects BER, CER, and DER decoders using the RealPayloadDecoder. The vulnerability is fixed in pyasn1 version 0.6.5. Applications using vulnerable versions should upgrade or limit input containing REAL values.
A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a hang, leading to a denial of service.
Mojolicious versions 7.28 through 9.45 for Perl generate weak HMAC session cookie secrets by default when using the "mojo generate app" tool. This occurs because the tool uses the insecure rand() function to create the secret, which is used for session authentication and integrity. The weakness may allow attackers to brute force session keys. Version 9.46 fixes this by using high-quality randomness. Users must manually replace any previously generated weak secrets to ensure security.