A vulnerability in the OpenTelemetry Python Jaeger propagator (opentelemetry-propagator-jaeger) prior to version 1.45.0 allows unbounded memory allocation when processing inbound 'uberctx-*' baggage headers. This can lead to increased CPU and memory usage per request, potentially causing denial-of-service conditions. The issue affects deployments that enable the Jaeger propagator and accept untrusted inbound propagation headers, especially where transport-level limits are absent or set higher than baggage limits. The vulnerability does not expose or modify telemetry data nor allow code execution. It is mitigated by upgrading to version 1.45.0 or later, which enforces limits on baggage extraction.
The Model Context Protocol (MCP) Python SDK versions 1.8.0 through 1.29.1 and 2.0.0 through 2.1.1 have a vulnerability where their HTTP client transports follow cross-origin HTTP redirects and send custom headers and request bodies to the redirected host. This behavior can expose sensitive headers such as API keys if the trusted endpoint redirects to an attacker-controlled domain. The SDK's OAuth client providers are similarly affected. The lone Authorization bearer header is not exposed due to existing HTTP library protections. The issue is fixed in MCP versions 1.30.0 and 2.2.0 by restricting redirects to the same origin only and failing otherwise.
The Model Context Protocol (MCP) Python SDK versions 1.10.0 through 1.29.1 and 2.0.0 through 2.1.1 contain a vulnerability where the client fetches server-chosen $ref URLs during tool result validation. This allows a malicious server to cause the client to make network or local file requests synchronously without timeout, potentially freezing the client session. The issue is fixed in versions 1.30.0 and 2.2.0.
Hydra core versions 1.3.6 through 1.3.7 and 1.4.0.dev9 through 1.4.0rc2 have a vulnerability in the legacy target blacklist that omits unsafe PyYAML loading functions. This allows an attacker who controls the target and arguments passed to instantiate() to execute arbitrary Python code via a malicious YAML configuration. The issue affects legacy no-whitelist paths and is not a bypass of Hydra 1.4's execution whitelist. The vulnerability is fixed in versions 1.3.8 and 1.4.0rc3.
The numprint package on PyPI version 1.2.0 contains malicious code that executes during installation. It starts a background process that runs commands from an attacker via communication through a GitHub Gist. This behavior indicates the package is used as a remote access trojan (RAT) to execute attacker-provided commands on the victim's machine.
Authlib versions up to 1.7.2 accept an empty HMAC key for JWS/JWT HS256/HS384/HS512 signature verification, allowing attackers to forge tokens with arbitrary claims. The empty key produces a deterministic digest that anyone can reproduce, bypassing signature verification. This vulnerability affects OAuth 2.0 resource servers and OIDC relying parties using Authlib if the verification key can be empty at runtime. The issue is fixed in Authlib 1.9.1.
Authlib versions 1.6.0 through before 1.9.0 contain a vulnerability in the RFC 9101 JAR extension where the attacker-controlled request_uri parameter is passed to a fetch hook without validation at a pre-authentication endpoint. This allows an unauthenticated Server-Side Request Forgery (SSRF) primitive because the documented example implementation performs an unrestricted HTTP GET on the request_uri. The vulnerability arises because the existing allowlist controls for request_uris are ignored, and the extension does not implement required RFC 9101 controls such as validating the URI location, media type, or timeouts. A fix is available in version 1.9.0.
Authlib versions prior to 1.9.0 contain a vulnerability in the OpenID ID token nonce validation process. The ID token's nonce validation can be disabled if the token includes a boolean false nonce_supported claim, causing the expected nonce to be set to None and skipping nonce validation. This allows an attacker to replay a validly signed ID token from a victim into an attacker-controlled session, authenticating as the victim. The vulnerability affects implicit and hybrid flows and direct calls to parse_id_token(), but not the authorization code flow. A fix is available in version 1.9.0.
Authlib versions prior to 1.9.0 have a vulnerability in the default JWT bearer grant implementation where the audience ('aud') claim in JWT assertions is not properly validated. The default get_audiences() method returns an empty list, causing verify_claims() to only check for the presence of an 'aud' claim rather than verifying it matches the authorization server's token endpoint. This allows an attacker with a valid JWT for any audience to obtain an access token from a different authorization server sharing the same signing key.
Authlib versions prior to 1.9.0 contain a vulnerability in the OpenID Connect implicit grant implementation where the authorization request's raw scope parameter is checked instead of the filtered allowed scope. This allows a registered OAuth client, which is not permitted the 'openid' scope but allowed other scopes like 'profile', to obtain a signed ID token if the user consents. The ID token includes identity claims such as 'sub' and 'name', effectively bypassing intended scope restrictions. The issue is fixed in version 1.9.0.
Authlib versions from 1.3.1 up to but not including 1.9.0 contain a vulnerability in the handling of HMAC keys in the jose module. The check that prevents asymmetric public keys from being used as HMAC secrets only inspects the start of the key bytes, but the asymmetric key loader skips leading bytes before the PEM header. This discrepancy allows an attacker with only the issuer's public key to craft a valid HS256 token with arbitrary claims that will be accepted as authentic. The issue is an incomplete fix of a previous vulnerability (CVE-2024-37568) and affects the documented usage of the jwt.decode method. A fix is available in version 1.9.0.
Authlib versions from 0.13 up to 1.7.2 contain a vulnerability in the is_secure_transport() function, which incorrectly treats certain HTTP URLs with userinfo components as secure loopback addresses. This allows an attacker to bypass the TLS enforcement by crafting URLs like http://localhost:80@evil.example/cb, where the actual host is external but the function returns true due to a prefix string match. This flaw affects OAuth 2.0 / OIDC endpoint and redirect URI validation, potentially allowing cleartext HTTP URLs to be accepted where TLS is required. The issue is fixed in Authlib 1.8.0.
A vulnerability in dnspython's dns.name.from_wire_parser() function allows a maliciously crafted DNS message to cause excessive CPU usage during DNS name decompression. This can degrade application performance or lead to denial of service (DoS) when processing untrusted DNS wire format messages. The issue is fixed in dnspython version 2.9.0. No known workarounds exist.
A regular expression denial of service (ReDoS) vulnerability exists in Datadog's dd-trace-py library affecting the URL query string obfuscation pattern used in HTTP tracing integrations. The vulnerable regex can cause excessive CPU consumption and stall request processing when handling certain attacker-controlled inputs, leading to denial of service. This issue affects ddtrace versions from 1.5.0 up to but not including 3.19.9, and from 4.0.0 up to but not including 4.15.6. A fix is available in versions 3.19.9 and 4.15.6. Workarounds involve setting environment variables to use a fixed regex pattern. The vulnerability is enabled by default in affected HTTP integrations that include query strings in URL span tags.
A vulnerability in dd-trace-py's IAST instrumentation can cause a denial of service by terminating the Python application process when processing certain attacker-controlled inputs. This issue affects only applications with IAST enabled, which is disabled by default. The flaw arises from improper handling of internal errors in string-processing instrumentation. Exploitation requires the vulnerable dd-trace-py version with IAST enabled and exposure of the affected operation to attacker input. A fix is available in version 4.15.5.
A vulnerability in the MongoDB Python driver (PyMongo) affects the C extension's BSON decoder when processing malformed Regex elements. This flaw allows an out-of-bounds read past the end of the caller's buffer, potentially causing a process crash via an uncatchable SIGSEGV signal. The issue impacts applications decoding untrusted BSON from mmap or array buffers, which lack NUL termination. The vulnerability affects all PyMongo releases from 3.9.0 up to but not including 4.18.3 when the C extension is loaded. The issue is fixed in version 4.18.3, where malformed Regex elements raise an InvalidBSON exception on all buffer types.
vLLM versions from 0.7.3 up to but not including 0.31.0 have a vulnerability where an attacker can control the mm_processor_kwargs.code_revision parameter in multimodal requests. When the operator enables trust_remote_code and serves a model whose Hugging Face processor uses dynamic auto_map code, this allows the attacker to execute arbitrary Python code by importing a malicious processor module revision. The vulnerability is exploitable via unauthenticated /tokenize endpoints unless protected externally. A fix is available in vLLM version 0.31.0.
The strands-agents FileSessionManager stores session data in a world-writable directory (/tmp/strands/sessions/) using predictable file paths and writes that follow symbolic links. This allows a local attacker to create symlinks to arbitrary files, causing the application to overwrite those files with attacker-controlled session data. This can lead to local privilege escalation by overwriting shell configuration files, SSH keys, cron jobs, or systemd user services. Additionally, the lack of integrity verification on session files enables persistent prompt injection attacks by tampering with session data.
The strands-agents package has a local confidentiality vulnerability in its default FileSessionManager storage. By default, session data is stored under /tmp/strands/sessions with directory and file permissions that allow other local users on shared systems to read sensitive session data. This can expose prompts, model outputs, tool inputs/outputs, intermediate states, and secrets stored in session files. The issue arises because the storage directories and files are created with permissions relying on the process umask, commonly 022, resulting in directories with 0755 and files with 0644 permissions. A fix is available in version 1.48.0 that addresses these permission issues.
Flexible GraphRAG contains a Cypher injection vulnerability due to incorrect string escaping in its FalkorDB adapter's _escape() function. The flawed escaping order allows crafted input to break out of string literals in Cypher queries, enabling injection of arbitrary Cypher clauses. This can lead to destructive actions such as wiping the entire graph database. The vulnerability affects versions from 0.6.0 up to but not including 0.8.2 and has been assigned CVE-2026-114510. A fix is available in version 0.8.2.