A vulnerability in pdfalyzer (pypdf) allows an attacker to craft a PDF file that causes an infinite loop when the parser encounters an incomplete file missing a trailer during the standard cross-reference table trailer search.
joserfc 1.7.4 has a vulnerability in its compact JWS size guard where it allocates attacker-controlled segments before rejecting oversized inputs. This occurs because the library calls bytes.split() on the input before validating its size, causing an additional allocation roughly equal to the payload size. The issue leads to increased memory usage prior to rejection but does not prevent transport-layer large headers. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity).
The joserfc library's decrypt_json() function for JWE General JSON Serialization accepts an unbounded recipients array, performing an RSA private-key decryption operation for every recipient without limit. This allows an unauthenticated attacker to cause CPU exhaustion (Denial of Service) by sending a single JWE JSON with many recipients, leading to a linear increase in server CPU usage proportional to the recipient count. The library caps sizes of other JWE components but does not limit the number of recipients. The documented mitigation option verify_all_recipients=False does not reduce CPU usage, as all recipients are decrypted regardless. This vulnerability is tracked as CVE-2026-119283 with a CVSS 3.1 score of 7.5 (High). A fix is available in joserfc version 1.50.0.
CVE-2026-119197 is a denial-of-service vulnerability in pyasn1 versions 0.6.4 and earlier affecting the decoding of binary-encoded ASN.1 REAL values with large mantissas. The decoding process has quadratic time complexity due to inefficient byte-wise processing, causing excessive CPU consumption. This impacts BER, CER, and DER decoders that use the vulnerable RealPayloadDecoder. The vulnerability allows an attacker who can supply crafted ASN.1 input containing REAL values to cause CPU exhaustion during decoding. The issue is fixed in pyasn1 version 0.6.5 by replacing the inefficient loop with a more efficient integer conversion. Until patched, applications should limit or reject attacker-controlled ASN.1 input with REAL values.
CVE-2026-119196 affects pyasn1 through version 0.6.4, where decoding constructed BIT STRING values with many fragments causes quadratic CPU consumption due to repeated shifting and copying of accumulated data. This can lead to CPU exhaustion and denial of service if attacker-controlled ASN.1 data with many fragments is decoded. The vulnerability impacts BER and CER decoders, and a permissive schema-driven DER decoder path. No confidentiality or integrity impact is reported. The CVSS v3.1 base score is 7.5 (high severity).
A denial of service vulnerability exists in pyasn1 version 0.6.4 and earlier, affecting the decoding of constructed OCTET STRINGs and indefinite-length ANY types. The decoder's string reassembly process exhibits quadratic time complexity due to repeated copying of accumulated fragments, leading to excessive CPU consumption. This can be exploited by an attacker supplying crafted ASN.1 input to cause CPU exhaustion. The issue affects BER and CER decoding paths and certain non-conforming DER inputs. No confidentiality or integrity impact is reported.
CVE-2026-119194 is a high-severity vulnerability in the pyasn1 library used by kimi-cli, where schemaless decoding of BER, CER, or DER data with many distinct long tag IDs causes quadratic CPU usage. This can lead to excessive CPU consumption and reduced availability when processing attacker-controlled inputs. The vulnerability affects versions >=0.56. No confidentiality or integrity impacts have been observed.
OAuthlib contains a vulnerability in its token grant handlers where an authenticated low-privilege client can supply a different client_id in the token request body, causing the authorization checks to be performed under that other client identity. This affects the client_credentials and password grant flows. The flaw arises because OAuthlib does not require the client_id in the request body to match the authenticated client's client_id before validating grant types and scopes. As a result, a lower-privilege client can obtain tokens with broader scopes or grant types assigned to a different client. A fix is available in version 11.0.3_1.
The Kimi CLI tool's use of Authlib's RFC 7592 client configuration endpoint contains a security flaw where example code omits verifying that the registration_access_token belongs to the client being accessed. This omission allows an attacker with any valid registration_access_token and knowledge of a client_id to bypass authorization and read, update, or delete that client's registration. The vulnerability affects versions 0.40 and later. The flaw arises because the documented example implementations do not bind the token to the target client, contrary to the protocol's security model. This leads to a high-severity authorization bypass.
Ahmad Umar Agha, a Syrian hacker affiliated with the Syrian Electronic Army, was sentenced to 42 months in a US federal court for a hacking conspiracy directed by Syrian intelligence figures. Over more than a decade, he compromised around 47 targets including Western media, companies, NGOs, and government entities, causing significant disruption and financial losses. Notable incidents include the 2013 hijacking of the Associated Press Twitter account that triggered a stock market flash crash and attacks on the Marine Corps recruiting website and White House social media accounts.
A vulnerability in pdfly's pypdf library allows crafted PDF files with cross-reference streams to cause large memory usage. This issue has been fixed in pypdf version 6.21.3. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.
CVE-2026-119208 is a vulnerability in pdfly's pypdf component that allows an attacker to craft an encrypted PDF file with a manipulated page count (/Count) value. Accessing the page count in such a file can cause excessive runtimes and large memory usage. This issue affects versions 0.4.0 and later and has been fixed in pypdf version 6.21.3.
CVE-2026-119207 is a vulnerability in pdfly's pypdf component that allows an attacker to craft a malicious PDF causing large memory usage when an invalid dictionary is loaded in strict mode. This can lead to resource exhaustion. The issue affects versions 0.4.0 and later. A fix is available in pypdf version 6.21.3. If upgrading is not possible, applying the changes from pull request #4265 is recommended as a workaround.
CVE-2026-119206 is a vulnerability in pdfly's pypdf component where crafted PDF files can cause long runtimes when retrieving page labels. This can lead to denial-of-service conditions due to resource exhaustion. The issue affects versions 0.4.0 and later. A fix is available in pypdf version 6.21.3. Users unable to upgrade immediately can apply the changes from pull request #4251 as a workaround.
A vulnerability in pdfly's pypdf library allows an attacker to craft a PDF that triggers an infinite loop when cloning or duplicating a DictionaryObject. This can cause denial of service due to resource exhaustion. The issue affects versions from 0.4.0 onward and has been fixed in pypdf version 6.21.4.