Threats affecting pkg:generic/libhevc

CVE-2026-119196 affects pyasn1 versions from 1.4.0 up to but not including 3.67.1_19. The vulnerability causes quadratic CPU consumption when decoding constructed BIT STRING values with many fragments, potentially leading to CPU exhaustion and denial of service. This occurs because the decoder repeatedly shifts and copies the accumulated value for each fragment. The issue affects BER and CER decoders and certain schema-driven DER decoding paths. No confidentiality or integrity impact is reported. A fix is available in version 3.67.1_19.

pyasn1 versions up to 0.6.4 have a quadratic-time denial of service vulnerability in decoding constructed OCTET STRINGs, constructed character strings, and indefinite-length ANY types. This flaw causes excessive CPU consumption when processing many small ASN.1 fragments, potentially leading to CPU exhaustion. The issue affects BER and CER decoding and certain non-conforming DER inputs. No confidentiality or integrity impact is reported. A fix is available in version 3.67.1_19.

CVE-2026-119194 is a vulnerability in the pyasn1 library used by the dvc product that causes quadratic CPU usage when decoding attacker-controlled BER, CER, or DER data without an ASN.1 schema. An attacker can craft inputs with many distinct long tag IDs that cause excessive CPU consumption, potentially leading to denial of service by exhausting CPU resources. The issue affects dvc versions from 1.4.0 up to but not including 3.67.1_19. A fix is available in version 3.67.1_19. No confidentiality or integrity impacts were observed.

OAuthlib contains a vulnerability in its token grant handlers where an authenticated low-privilege client can supply a different client_id in the token request body, causing grant and scope validation to be performed under that other client identity. This affects the client_credentials and resource owner password credentials grant flows. The issue arises because OAuthlib does not require the client_id in the request body to match the authenticated client's client_id before validating grants and scopes. As a result, a low-privilege client can obtain tokens with higher privileges assigned to another client if the application validator authorizes based on the client_id argument passed by OAuthlib.

pyasn1 versions up to 0.6.4 contain a denial of service vulnerability in the decoding of binary ASN.1 REAL values with large mantissas. The decoding process is quadratic in the mantissa length, causing excessive CPU consumption. This affects BER, CER, and DER decoders using the RealPayloadDecoder. The issue is fixed in pyasn1 0.6.5. Applications passing attacker-controlled ASN.1 REAL values to these decoders without proper input limits are vulnerable to CPU exhaustion during decoding.

A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a hang, leading to a denial of service.

Mojolicious versions 7.28 through 9.45 for Perl generate weak HMAC session cookie secrets by default when using the "mojo generate app" tool. This occurs because the tool uses the insecure rand() function to create the secret, which is used for session authentication and integrity. The weakness may allow attackers to brute force session keys. Version 9.46 fixes this by using high-quality randomness. Users must manually replace any previously generated weak secrets to ensure security.

Mojolicious versions from 0.999922 for Perl use a hard coded string or the application's class name as the HMAC session cookie secret by default. This predictable secret allows attackers to forge session cookies, potentially enabling session tampering or hijacking. The vulnerability affects the znapzend product from version 0.23.6 onward. It has a high severity rating with a CVSS score of 8.1.

joserfc 1.7.4 has a vulnerability in its compact JWS size guard where it allocates attacker-controlled segments before rejecting oversized inputs. This occurs because the library calls bytes.split() on the input before validating its length, causing an additional payload-sized memory allocation. The flaw allows an attacker to cause excessive memory usage before the size limit triggers rejection. A fix is available in version 3.4.2_1.

The joserfc library's JWE General JSON decryption function accepts an attacker-controlled recipients array of unbounded length, causing the library to perform one RSA private-key decryption operation per recipient without limit. This leads to a CPU exhaustion denial-of-service (DoS) vulnerability. The documented mitigation option does not reduce CPU usage, and no upper bound check exists on the number of recipients. The vulnerability is fixed in version 3.4.2_1.

CVE-2026-116672 affects the Weaviate CLI's use of Authlib's implementation of RFC 7592 OAuth 2.0 Dynamic Client Registration Management Protocol. The provided example code for client authentication and permission checking omits a critical step: binding the registration access token to the specific client being accessed. This omission allows an attacker with any valid registration access token and knowledge of a client ID to bypass authorization controls and access or modify that client's registration. The vulnerability is present in versions >=3.0.2 and <3.4.2_1 and has been fixed in version 3.4.2_1.