| uv has ZIP payload obfuscation through parsing differentialsCVE-2025-13327 · GHSA-V653-R55G-HCMG |
uvRed Hat AI Inference Server/rhaiis-preview/vllm-cuda-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| Denial of service in github.com/shamaton/msgpackCVE-2026-32284 · GHSA-H9Q6-HC68-35RPVersion ranges need review. |
github.com/shamaton/msgpack/v2github.com/shamaton/msgpack/v3 |
GoRed Hat |
High
|
Fix reported |
|
| urllib3 streaming API improperly handles highly compressed dataCVE-2025-66471 · GHSA-2XPW-W6GG-JR37Version ranges need review. |
urllib3Builds for Red Hat OpenShift/openshift-builds/openshift-builds-shared-resource-webhook-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| aiohttp allows unlimited trailer headers, leading to possible uncapped memory usageCVE-2026-22815 · GHSA-W2FM-2CPV-W7V5Version ranges need review. |
aiohttpLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP has a Multipart Header Size BypassCVE-2026-34516 · GHSA-M5QP-6W8W-W647Version ranges need review. |
aiohttpLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnectorCVE-2026-34513 · GHSA-HCC4-C3V8-RX92Version ranges need review. |
aiohttpLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirectCVE-2026-34518 · GHSA-966J-VMVW-G2G9Version ranges need review. |
aiohttpLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| AIOHTTP accepts duplicate Host headersCVE-2026-34525 · GHSA-C427-H43C-VF67Version ranges need review. |
aiohttpLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| cryptography has incomplete DNS name constraint enforcement on peer namesCVE-2026-34073 · GHSA-M959-CC7F-WV43Version ranges need review. |
cryptographyLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID MatchingCVE-2026-4539 · GHSA-5239-WWWM-4PMQVersion ranges need review. |
pygmentsExternal Secrets Operator for Red Hat OpenShift/external-secrets-operator/bitwarden-sdk-server-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| Python-Multipart has Arbitrary File Write via Non-Default ConfigurationCVE-2026-24486 · GHSA-WP53-J4WJ-2CFGVersion ranges need review. |
python-multipartLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| PyJWT accepts unknown `crit` header extensionsCVE-2026-32597 · GHSA-752W-5FWX-JX9FVersion ranges need review. |
pyjwtOpenShift Lightspeed/openshift-lightspeed/lightspeed-ocp-rag-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| urllib3 allows an unbounded number of links in the decompression chainCVE-2025-66418 · GHSA-GM62-XV2J-4W53Version ranges need review. |
urllib3Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizerCVE-2025-6638 · GHSA-59P9-H35M-WG4GVersion ranges need review. |
transformersOpenShift Lightspeed/openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP has HTTP response splitting via \r in reason phraseCVE-2026-34519 · GHSA-MWH4-6H8G-PG8WVersion ranges need review. |
aiohttpLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypassCVE-2026-34520 · GHSA-63HF-3VF5-4WQFVersion ranges need review. |
aiohttpLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| AIOHTTP has CRLF injection through multipart part content type header constructionCVE-2026-34514 · GHSA-2VRM-GR82-F7M5Version ranges need review. |
aiohttpLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| AIOHTTP has late size enforcement for non-file multipart fields causes memory DoSCVE-2026-34517 · GHSA-3WQ7-RQQ7-WX6JVersion ranges need review. |
aiohttpLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| multipart vulnerable to ReDoS in `parse_options_header()`CVE-2026-28356 · GHSA-P2M9-WCP5-6QW3Version ranges need review. |
multipartLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility functionCVE-2026-25645 · GHSA-GC5V-M9X4-R6X2Version ranges need review. |
requestsExternal Secrets Operator for Red Hat OpenShift/external-secrets-operator/bitwarden-sdk-server-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
