Threats affecting pkg:generic/libucl

Mojolicious versions 7.28 through 9.45 for Perl generate weak HMAC session cookie secrets by default when using the "mojo generate app" tool. This occurs because the tool uses the insecure rand() function to create the secret, which is used for session authentication and integrity. The weakness may allow attackers to brute force session keys. Version 9.46 fixes this by using high-quality randomness. Users must manually replace any previously generated weak secrets to ensure security.

Mojolicious versions from 0.999922 for Perl use a hard coded string or the application's class name as the HMAC session cookie secret by default. This predictable secret allows attackers to forge session cookies, potentially enabling session tampering or hijacking. The vulnerability affects the znapzend product from version 0.23.6 onward. It has a high severity rating with a CVSS score of 8.1.

CVE-2026-119197 is a denial of service vulnerability in pyasn1 versions 0.6.4 and earlier, affecting the decoding of binary ASN.1 REAL values with large mantissas. The decoding process has quadratic time complexity due to inefficient byte processing, causing excessive CPU consumption. This impacts BER, CER, and DER decoders using the vulnerable RealPayloadDecoder. The vulnerability can be triggered when an application decodes attacker-controlled ASN.1 data containing REAL values. The issue was fixed in pyasn1 version 0.6.5 by optimizing the decoding loop.

CVE-2026-119196 is a vulnerability in the pyasn1 library (up to version 0.6.4) used by awscli@1 (versions >=1.20.20). It causes quadratic CPU consumption when decoding constructed BIT STRING values with many fragments, leading to potential CPU exhaustion and denial of service during ASN.1 decoding. This affects BER and CER decoders and certain schema-driven DER decoding paths. The vulnerability arises from inefficient bit-shifting operations on accumulated fragments. No confidentiality or integrity impacts are reported.

CVE-2026-119195 is a denial-of-service vulnerability in pyasn1 versions 0.6.4 and earlier, affecting awscli@1 versions >=1.20.20. The flaw causes quadratic-time CPU consumption when decoding constructed OCTET STRINGs or indefinite-length ANY types composed of many fragments, leading to CPU exhaustion. This occurs because the decoder repeatedly concatenates fragments inefficiently, causing excessive CPU use proportional to the square of the number of fragments. The vulnerability impacts BER and CER decoding paths and certain non-conforming DER inputs. No confidentiality or integrity impact is reported.

CVE-2026-119194 is a high-severity vulnerability in pyasn1 used by awscli@1 (versions >=1.20.20) where schemaless decoding of BER, CER, or DER data with many distinct long tag IDs causes quadratic CPU usage. This can lead to excessive CPU consumption and reduced service availability when processing attacker-controlled inputs. No confidentiality or integrity impacts are reported.

joserfc 1.7.4 has a vulnerability in its compact JWS size guard where it allocates attacker-controlled segments before rejecting oversized inputs. This occurs because the library calls bytes.split() on the input before validating its length, causing an additional payload-sized memory allocation. The flaw allows an attacker to cause excessive memory usage before the size limit triggers rejection. A fix is available in version 3.4.2_1.

The joserfc library's JWE General JSON decryption function accepts an attacker-controlled recipients array of unbounded length, causing the library to perform one RSA private-key decryption operation per recipient without limit. This leads to a CPU exhaustion denial-of-service (DoS) vulnerability. The documented mitigation option does not reduce CPU usage, and no upper bound check exists on the number of recipients. The vulnerability is fixed in version 3.4.2_1.

CVE-2026-116672 affects the Weaviate CLI's use of Authlib's implementation of RFC 7592 OAuth 2.0 Dynamic Client Registration Management Protocol. The provided example code for client authentication and permission checking omits a critical step: binding the registration access token to the specific client being accessed. This omission allows an attacker with any valid registration access token and knowledge of a client ID to bypass authorization controls and access or modify that client's registration. The vulnerability is present in versions >=3.0.2 and <3.4.2_1 and has been fixed in version 3.4.2_1.

OAuthlib contains a vulnerability in its token grant handlers where an authenticated low-privilege client can supply a different client_id in the token request body, causing grant and scope validation to be performed under that other client identity. This affects the client_credentials and password grant flows. The issue arises because OAuthlib does not require the authenticated client's client_id to match the client_id parameter in the request body before validation. This can lead to token authorization bypass, allowing issuance of tokens with unauthorized scopes or grant types.

A vulnerability in pypdf allows crafted PDF files with cross-reference streams to cause large memory usage when parsed. This can lead to resource exhaustion on systems processing such files. The issue is fixed in pypdf version 6.21.3. If upgrading is not possible, applying the changes from pull request #4269 is recommended as a workaround.

A vulnerability in pypdf (CVE-2026-119208) allows an attacker to craft an encrypted PDF file with a manipulated page count (/Count) value, causing excessive runtimes and large memory usage when the page count is accessed. This can lead to denial of service conditions. The issue affects versions of pypdf starting from 0.16.4. A fix is available in pypdf version 6.21.3.

CVE-2026-119207 is a high-severity vulnerability in pypdf that allows an attacker to craft a malicious PDF causing large memory usage when an invalid dictionary is loaded in strict mode. This can lead to resource exhaustion. The issue has been fixed in pypdf version 6.21.3. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.

CVE-2026-119206 is a vulnerability in pypdf that allows an attacker to craft a PDF file causing long runtimes when retrieving page labels. This can lead to performance degradation during PDF processing. The issue affects pypdf versions starting from 0.16.4. A fix is available in pypdf version 6.21.3. Users unable to upgrade immediately can apply the changes from pull request #4251 as a workaround.

A vulnerability in pypdf allows an attacker to craft a PDF that triggers an infinite loop when cloning or duplicating a DictionaryObject. This can cause denial of service by exhausting resources. The issue is fixed in pypdf version 6.21.4. Users unable to upgrade immediately can apply the changes from a specific pull request as a workaround.

A vulnerability in pypdf allows crafted PDF files with complex page trees and many shared resources to cause large memory usage during parsing. This can lead to resource exhaustion on affected systems. The issue is fixed in pypdf version 6.21.4. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.

A vulnerability in pypdf allows an attacker to craft a PDF file that causes an infinite loop when the file is incomplete and lacks a trailer during the standard xref table trailer search. This issue is fixed in pypdf version 6.21.4.