| dnspython dns.name.from_wire_parser() excessive CPU useCVE-2026-114605 · GHSA-45C3-73F7-PV4M |
dnspythonAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different clientCVE-2026-118669 · GHSA-7984-QGVG-3J9C |
oauthlibConfidential Compute Attestation/openshift-sandboxed-containers/osc-podvm-builder-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decodingCVE-2026-119195 · GHSA-9M75-VC3G-4X39 |
pyasn1Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| pyasn1 has quadratic-complexity denial of service in binary REAL decodingCVE-2026-119197 · GHSA-MM57-4V3P-RCHX |
pyasn1Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decodingCVE-2026-119194 · GHSA-FM9C-5RCF-2Q5P |
pyasn1Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| pyasn1 has quadratic CPU consumption in constructed BIT STRING decodingCVE-2026-119196 · GHSA-2QM8-X737-GMW5 |
pyasn1Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| zip: AES Entry HMAC Authentication Bypass on Premature EOFCVE-2026-115906 · GHSA-8HXF-QR8P-62X4 |
zipAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP: Secure attribute not enforced for shared cookieCVE-2026-111063 · GHSA-494J-54XM-RWP3 |
aiohttpExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-apiCVE-2026-114603 · GHSA-XCQ7-P3PF-P88H |
opentelemetry-apiAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP: Connector pool exhaustion via Max-Age overflowCVE-2026-111065 · GHSA-6CJC-53GC-5RQM |
aiohttpExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP: Absolute-form request targets can spoof Request.schemeCVE-2026-111748 · GHSA-F9XW-JH8M-3MWQ |
aiohttpExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookiesCVE-2026-111749 · GHSA-GX76-C99X-2C96 |
aiohttpExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| AIOHTTP: File descriptor exhaustion in multipart requestsCVE-2026-111066 · GHSA-9XW5-W5JJ-PVCG |
aiohttpExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| AIOHTTP: Pure-Python parser request smugglingCVE-2026-111750 · GHSA-PQXQ-W44R-73XW |
aiohttpExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database filesCVE-2026-61801 · GHSA-MJCV-P78Q-W5FWVersion ranges need review. |
github.com/moby/sys/userAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| aiohttp server lacks an initial request/header timeoutCVE-2026-111064 · GHSA-5WR8-GCQF-GQF3 |
aiohttpExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtractionCVE-2026-104874 · GHSA-54P9-H82J-F925Version ranges need review. |
multidictExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generationCVE-2026-49264 · GHSA-HJ66-6F7G-4R5VVersion ranges need review. |
oauthlibConfidential Compute Attestation/openshift-sandboxed-containers/osc-podvm-builder-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)CVE-2026-49265 · GHSA-XPV3-W29H-X7CVVersion ranges need review. |
oauthlibConfidential Compute Attestation/openshift-sandboxed-containers/osc-podvm-builder-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusionCVE-2026-102275 · GHSA-X33G-CR3X-6449Version ranges need review. |
pyjwtAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
