Threats affecting pkg:brew/locust

The msgpack-python C extension has a memory leak vulnerability triggered when deserialization rejects a map key under strict_map_key validation. This leak causes unbounded memory growth and potential denial of service when processing attacker-controlled MessagePack data. Additionally, the streaming Unpacker API may suffer from use-after-free or double free errors due to stale parser-stack references. The issue affects version 1.2.2 and development commits, with a fix available in version 2.46.7. The pure-Python fallback does not exhibit this leak. Exploitation does not impact confidentiality or integrity but can cause denial of service via resource exhaustion.

A buffer overflow vulnerability exists in the Brotli decoder component of Google Brotli versions 1.0.3 through 1.2.0. This flaw allows remote unauthenticated attackers to corrupt adjacent memory, potentially leading to sensitive data disclosure, denial of service, or arbitrary code execution. Users should update affected Brotli libraries or binaries to fixed versions 1.0.10, 1.1.1, or 1.2.1. Additionally, the vulnerability affects the locust product in versions >=2.2.1 <2.18.4 and >=2.23.1 <2.47.0_1, with fixes available in 2.18.4 and 2.47.0_1.

Red Hat AI Inference Model Optimization Tools

CVE-2024-49766 is a vulnerability affecting Mapproxy on Windows systems running Python versions earlier than 3.11. It stems from Werkzeug's safe_join() function incorrectly handling UNC paths as absolute due to reliance on os.path.isabs() in these Python versions. This flaw can lead to unsafe path joins and potentially unintended data access. Systems using Python 3.11 or later, or non-Windows platforms, are not affected. A patch is available to remediate this issue.

CVE-2025-50181 is a vulnerability in the osc-cli product related to urllib3's handling of redirects when retries are disabled on PoolManager instantiation. The retries parameter intended to disable redirects at the PoolManager level is ignored, causing redirects to remain enabled. This can leave applications vulnerable to SSRF or open redirect attacks if they rely on disabling redirects at this level. The vulnerability affects specific versions of osc-cli and related packages. A patch is available to fix this issue.

Scrapy versions up to 2.13.3 are vulnerable to a denial of service (DoS) attack due to a flaw in the brotli decompression implementation. The existing protection against decompression bombs does not mitigate the brotli variant, allowing remote servers to cause excessive memory consumption and crash clients with less than 80GB of available memory. This vulnerability is addressed by security enhancements introduced in brotli version 1.2.0.

CVE-2024-6221 is a high-severity vulnerability in the Locust product related to the flask-cors library version 4.0.1. It causes the Access-Control-Allow-Private-Network CORS header to be set to true by default without configuration options. This misconfiguration can expose private network resources to unauthorized external access, increasing the risk of data breaches and network intrusions. The vulnerability affects Locust versions from 2.2.1 up to but not including 2.31.4_1. A patch is available to address this issue.

This update includes the following RPMs: python-rpds-py: * python3-rpds-py-2026.6.3-1.hum1 (aarch64, x86_64) * python-rpds-py-2026.6.3-1.hum1.src (src)

This update for python-Pygments fixes the following issue: - CVE-2026-4539: Denial of Service via inefficient regular expression processing in AdlLexer (bsc#1260796).

This update for python-Flask fixes the following issue: - CVE-2026-27205: information disclosure due to Flask session not adding the `Vary: Cookie` header (bsc#1258700).

pytest through 9.0.2 on UNIX relies on directories with the `/tmp/pytest-of-{user}` name pattern, which allows local users to cause a denial of service or possibly gain privileges.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * requests: Requests vulnerable to .netrc credentials leak via malicious URLs (CVE-2024-47081) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

When using a `requests.Session`, if the first request to a given origin is made with `verify=False`, TLS certificate verification may remain disabled for all subsequent requests to that origin, even if `verify=True` is explicitly specified later. This occurs because the underlying connection is reused from the session's connection pool, causing the initial TLS verification setting to persist for the lifetime of the pooled connection. As a result, applications may unintentionally send requests without certificate verification, leading to potential man-in-the-middle attacks and compromised confidentiality or integrity. This behavior affects versions of `requests` prior to 2.32.0.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.12.76. See the following advisory for the container images for this release: https://access.redhat.com/errata/RHSA-2025:4409 Security Fix(es): * jinja2: Jinja sandbox breakout through attr filter selecting format method (CVE-2025-27516) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.

An oversight in how the Jinja sandboxed environment detects calls to `str.format` allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to `str.format` and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's `format` method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox.

Python HTTP module with connection pooling and file POST abilities. Security Fix(es): * proxy-authorization request header is not stripped during cross-origin redirects (CVE-2024-37891) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section.