pyasn1 versions up to 0.6.4 have a denial-of-service vulnerability in decoding binary-encoded ASN.1 REAL values with large mantissas. The decoding process uses a quadratic-time algorithm that can exhaust CPU resources when processing attacker-controlled input. This affects BER, CER, and DER decoders using the RealPayloadDecoder. The issue is fixed in pyasn1 0.6.5 by replacing the inefficient loop with a more efficient integer conversion.
CVE-2026-119196 affects pyasn1 through version 0.6.4, where decoding constructed BIT STRING values with many fragments causes quadratic CPU consumption due to repeated shifting and copying operations. This can lead to CPU exhaustion and denial of service when processing sufficiently large, attacker-controlled ASN.1 data. The vulnerability impacts BER and CER decoders and certain schema-driven DER decoding paths. No confidentiality or integrity impact is reported. The issue arises from inefficient handling of constructed BIT STRING fragments during decoding.
pyasn1 versions 0.6.4 and earlier contain a denial-of-service vulnerability due to quadratic-time complexity in decoding constructed OCTET STRINGs, character strings, and indefinite-length ANY types. This occurs when decoding many fixed-size fragments, causing excessive CPU usage. The issue affects BER and CER decoding and certain non-conforming DER inputs. An attacker supplying crafted ASN.1 input to an affected decoder can cause CPU exhaustion. No confidentiality or integrity impact is reported.
CVE-2026-119194 is a high-severity vulnerability in pyasn1's schemaless BER, CER, and DER decoding that causes quadratic CPU usage when decoding attacker-controlled data with many distinct long tag IDs. This can lead to CPU exhaustion and reduced service availability. The issue arises because the decoder unnecessarily grows a set of tag identifiers, causing performance degradation with crafted inputs. No confidentiality or integrity impacts are reported.
OAuthlib contains a vulnerability in its token grant handlers where an authenticated low-privilege client can supply a different client_id in the token request body, causing authorization checks to be performed under that other client's identity. This affects the client_credentials and password grant flows when the application validator uses the client_id argument for authorization. The flaw allows a low-privilege client to obtain tokens with broader scopes or grant types assigned to another client. The issue is fixed in OAuthlib version 1.97.
joserfc version 3.2.4_2 up to but not including 4.1.2 has a vulnerability in its compact JWS size guard. The library calls bytes.split() on attacker-controlled input before validating size limits, causing it to allocate memory roughly equal to the payload size before rejecting oversized inputs. This can lead to increased memory usage and potential denial of service. A fix is available in version 4.1.2 that checks input length before splitting to prevent unnecessary allocations.
The joserfc library's decrypt_json() function for JWE General JSON Serialization accepts an unbounded recipients array, performing a costly RSA private-key decryption for each recipient without limit. This allows an unauthenticated attacker to cause CPU exhaustion (Denial of Service) by sending a single JWE JSON with many recipients. The library caps sizes of other JWE elements but does not limit recipient count. The documented mitigation option verify_all_recipients=False does not reduce CPU usage, as all recipients are decrypted before this flag is checked. This vulnerability is tracked as CVE-2026-119283 with a CVSS 3.1 score of 7.5 (High). A fix is available in joserfc version 4.0.0.
CVE-2026-116672 affects Fastmcp's implementation of the OAuth 2.0 Dynamic Client Registration Management Protocol (RFC 7592) in Authlib. The provided example code for the ClientConfigurationEndpoint omits a critical security check that binds the registration_access_token to the specific client being accessed. This omission allows an attacker possessing any valid registration_access_token and knowledge of a client_id to bypass authorization and access or modify other clients' registrations. The vulnerability exists in Fastmcp versions >=2.12.3 and <4.1.1 and is fixed in version 4.1.1.
CVE-2026-120194 is a vulnerability in json-glib's JSONPath slice evaluator used by json_path_query() that can cause an infinite loop when processing a slice expression with a negative step. This flaw allows an attacker who can supply crafted JSONPath expressions to cause the application to hang, resulting in a denial of service. There is no impact on confidentiality or integrity. No fixed release is currently available, and all shipped Red Hat and Fedora json-glib builds with this evaluator are affected. Mitigation involves avoiding evaluation of untrusted JSONPath expressions and rejecting slice expressions with negative steps until a fix is released.