Threats affecting pkg:generic/libucl

CVE-2026-119206 is a vulnerability in pdfly's pypdf component where crafted PDF files can cause long runtimes when retrieving page labels. This can lead to denial-of-service conditions due to resource exhaustion. The issue affects versions 0.4.0 and later. A fix is available in pypdf version 6.21.3. Users unable to upgrade immediately can apply the changes from pull request #4251 as a workaround.

A vulnerability in pdfly's pypdf library allows an attacker to craft a PDF that triggers an infinite loop when cloning or duplicating a DictionaryObject. This can cause denial of service due to resource exhaustion. The issue affects versions from 0.4.0 onward and has been fixed in pypdf version 6.21.4.

A vulnerability in pdfly's pypdf component allows an attacker to craft a PDF that causes large memory usage when parsing the page tree with many shared resources. This can lead to resource exhaustion. The issue is fixed in pypdf version 6.21.4.

A vulnerability in pdfly's pypdf library allows an attacker to craft a PDF that causes an infinite loop when the file is incomplete and missing a trailer. This issue has been addressed in version 6.21.4 of pypdf.

Wireshark Release Candidate 5.0.0 was published on October 31, 2026, signaling the upcoming release of a new major version of the Wireshark network protocol analyzer. No specific security vulnerabilities or threats are described in this announcement.

YARA-X version 1.22.1 is a bugfix release that addresses two bugs. This release does not include the new built-in functions for reading 64-bit integers that are present in YARA 4.6.0. YARA-X has effectively replaced YARA as the tool for pattern matching and malware research.

YARA-X version 1.22.0 was released on October 25, 2026, introducing 11 improvements and 9 bug fixes. Among the enhancements is the addition of built-in functions to read 64-bit integers in various formats. There is no indication of security vulnerabilities or threats associated with this release.

CVE-2026-119209 is a vulnerability in pypdf used by psutils that allows an attacker to craft a PDF file with cross-reference streams causing large memory usage when parsed. This can lead to resource exhaustion on the system processing the malicious PDF. The issue has been fixed in pypdf version 6.21.3.

A vulnerability in psutils' pypdf component allows an attacker to craft encrypted PDF files with incorrect page count values, causing excessive runtimes and large memory usage when accessing the page count. This issue has been fixed in pypdf version 6.21.3.

CVE-2026-119207 is a high-severity vulnerability in the psutils product affecting versions 3.0 and later. It allows an attacker to craft a malicious PDF that triggers large memory usage by loading an invalid dictionary in strict mode. This can lead to resource exhaustion. The issue has been fixed in pypdf version 6.21.3. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.

OAuthlib contains a vulnerability in its token grant handlers where an authenticated low-privilege client can supply a different client_id in the token request body, causing grant and scope validation to be performed under that other client identity. This affects the client_credentials and password grant flows. The flaw allows a low-privilege client to obtain tokens with scopes or grant types assigned to a higher-privilege client if the application validator authorizes based on the attacker-supplied client_id argument. The issue is fixed in OAuthlib version 5.5.0.

pyasn1 versions up to 0.6.4 have a denial-of-service vulnerability in decoding binary-encoded ASN.1 REAL values with large mantissas. The decoding process is quadratic in the mantissa length, causing excessive CPU consumption. This affects BER, CER, and DER decoders using the shared RealPayloadDecoder. An attacker supplying crafted ASN.1 REAL values to an application using these decoders can cause CPU exhaustion during decoding. The issue is fixed in pyasn1 version 0.6.5.

CVE-2026-119196 is a vulnerability in pyasn1 versions through 0.6.4 where decoding constructed BIT STRING values with many fragments causes quadratic CPU consumption. This can lead to CPU exhaustion and denial of service when processing attacker-controlled ASN.1 data. The issue affects BER and CER decoders and certain schema-driven DER decoding paths. No confidentiality or integrity impact is reported. The vulnerability has a CVSS score of 7.5, indicating high severity.

pyasn1 versions 0.6.4 and earlier contain a quadratic-time denial of service vulnerability in decoding constructed OCTET STRINGs, constructed character strings, and indefinite-length ANY types. This flaw causes excessive CPU consumption when processing many fixed-size fragments, potentially leading to CPU exhaustion if attacker-controlled ASN.1 input is decoded without proper limits. The issue affects BER and CER decoding paths and certain non-conforming DER inputs. No confidentiality or integrity impacts are reported. The vulnerability has a CVSS score of 7.5, indicating high severity.

CVE-2026-119194 is a high-severity vulnerability in pyasn1 used by Ansible@13 (version 13.7.0 and later). It causes quadratic CPU usage when decoding attacker-controlled schemaless BER, CER, or DER data with many distinct long tag IDs, potentially leading to denial of service by exhausting CPU resources. The flaw arises from inefficient handling of TagSet insertions during decoding. No confidentiality or integrity impacts were observed.