Threat Intelligence Database

Parsedmarc versions from 8.11.0 up to but not including 9.9.0, and from 9.11.0 up to but not including 11.0.4, are affected by multiple cases where aiohttp can consume excessive or unbounded memory or CPU resources when processing attacker-controlled requests. This vulnerability allows an attacker to cause resource exhaustion, potentially impacting service availability.

A vulnerability in PyJWT's issuer ('iss') claim validation allows partial string matches instead of exact matches due to a type-checking bug introduced in version 2.10.0. This causes tokens with incorrect issuer values that partially match the expected issuer string to be accepted. The signature validation remains intact, limiting the impact.

### Impact Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. ### Workarounds For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on your Requests Session ([docs](https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env)). ### References https://github.com/psf/requests/pull/6965 https://seclists.org/fulldisclosure/2025/Jun/2

A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.