Threats affecting pkg:github/PyPy

CVE-2026-76875 is a use-after-free vulnerability in PyPy's pyexpat module affecting versions before 3.11.16 and 3.12.14. It occurs when an application creates external-entity sub-parsers without retaining a reference to the parent parser, allowing memory corruption via crafted XML documents.