A critical buffer overflow vulnerability exists in the Brotli decoder in Google Brotli versions 1.0.3 through 1.2.0. This flaw allows remote unauthenticated attackers to corrupt adjacent memory, potentially leading to sensitive data disclosure, denial of service, or arbitrary code execution. The issue affects all platforms using these versions. Fixed versions 1.0.10, 1.1.1, and 1.2.1 are available and should be applied promptly.
A Regular Expression Denial of Service (ReDoS) vulnerability exists in soupsieve's CSS selector parsing, specifically in the IDENTIFIER and VALUE sub-patterns. The flaw arises from overlapping quantified regex groups that cause quadratic backtracking when parsing certain malformed or maliciously crafted selectors. This can lead to significant CPU consumption and delays when processing user-controlled selectors, notably in applications using BeautifulSoup's select methods with untrusted input. The vulnerability affects soupsieve versions from 3.2.0 up to but not including 3.3.0_10. A fix is available in version 3.3.0_10.
A Regular Expression Denial of Service (ReDoS) vulnerability exists in soupsieve's whitespace/comment trimming regex RE_WS_END. The regex is used unanchored with .search(), causing quadratic time complexity (O(n²)) when processing selectors with long runs of whitespace or comments not exactly at the string end. This can stall the interpreter for seconds on valid CSS selectors with large whitespace gaps. The issue affects soupsieve versions from 3.2.0 up to but not including 3.3.0_10. A fix is available in version 3.3.0_10.
A denial of service vulnerability exists in py7zr's PackInfo._read() method due to an O(n^2) algorithmic complexity when parsing the numstreams value from a .7z archive header. A crafted archive with a large numstreams value causes excessive CPU consumption during header parsing in SevenZipFile.__init__(), even without extracting any content. This can lead to significant CPU delays with relatively small archive sizes.
py7zr versions >=3.2.0 and <3.3.0_9 contain a decompression bomb vulnerability where the decompression process does not track the total decompressed size. This allows a crafted .7z archive to expand to a very large size (e.g., 100 MB from a 15.6 KB archive), potentially exhausting disk or memory resources during extraction. The issue is fixed in version 3.3.0_9 by adding a cumulative decompressed size check with a configurable limit.
A Regular Expression Denial of Service (ReDoS) vulnerability exists in soupsieve's CSS selector parser due to a regex pattern that suffers from catastrophic backtracking when processing attribute selectors with unterminated quoted values. This flaw allows an attacker to cause CPU exhaustion by supplying a crafted CSS selector string, resulting in significant processing delays. The vulnerability affects soupsieve versions from 3.2.0 up to but not including 3.3.0_9. A fix is available in version 3.3.0_9.
A memory exhaustion vulnerability exists in soupsieve's CSS selector parser used by Beautiful Soup 4. The parser allocates unbounded memory when compiling large comma-separated selector lists, allowing an attacker to cause high memory usage and denial of service by supplying crafted CSS selectors. This affects applications that use soupsieve.compile() or Beautiful Soup's .select()/.select_one() with user-supplied selectors. The issue is fixed in version 3.3.0_9.
An arbitrary file write vulnerability exists in py7zr versions >=3.2.0 and <3.3.0_9. This flaw allows crafted symbolic link chains within 7z archives to escape the intended extraction directory, enabling files to be written to arbitrary locations on the host system during extraction. The vulnerability can lead to remote code execution, privilege escalation, data corruption, or denial of service.
Scrapy versions from 3.2.0 up to but not including 3.3.0_3 are vulnerable to a denial of service (DoS) attack due to a flaw in the brotli decompression implementation. The existing protection against decompression bombs does not mitigate the brotli variant, allowing remote servers to cause excessive memory consumption and crash clients with less than 80GB of memory. This vulnerability is addressed by security enhancements introduced in brotli version 1.2.0 and fixed in Scrapy version 3.3.0_3.