Threats tagged 'ghsa-fjqr-7p2w-j9wx'

Vulnerability-Lookup versions 5.5.1 up to but not including 6.4.1 contain a flaw where signed-in users can cause excessive memory allocation via webhook notification payload templates. The issue arises because format specifiers in placeholders are passed directly to Python's string formatting, allowing creation of very large strings. This can lead to denial of service by exhausting memory resources of web workers or the notification daemon. Version 6.4.1 introduces limits on format specifier sizes, template length, and nesting depth to mitigate the issue.