https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 14:17:46 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2026-57585 <p><strong>Affected:</strong> Alpaquita:23: py3-msgpack, Alpaquita:25: py3-msgpack, Alpaquita:stream: py3-msgpack</p> <p><strong>Affected:</strong> Alpaquita:23: py3-msgpack, Alpaquita:25: py3-msgpack, Alpaquita:stream: py3-msgpack</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-57585 https://cve.radiocsirt.org/vuln/brew-ansible-cve-2026-57585 <p><strong>Affected:</strong> Homebrew: ansible</p> <p>### Impact</p> <p>If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV.</p> <p>If the Unpacker is used repeatedly to unpack untrusted input from external sources, it may be vulnerable to a DoS attack.</p> <p>### Patches</p> <p>v1.2.1</p> <p>### Workarounds</p> <p>Users should create a new Unpacker instead of reusing the same Unpacker after an error occurs.</p> <p>Applying the above patch can prevent SEGV, but reusing the Streaming Unpacker after it has encountered an error will not yield correct data. If an error occurs during Streaming Unpacking, the Stream and Streaming Unpacker should be discarded.</p> <p>Therefore, this is not just a workaround but the correct solution. The above patch only prevents crashes from incorrect usage.</p> <p><strong>Affected:</strong> Homebrew: ansible</p> <p>### Impact</p> <p>If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV.</p> <p>If the Unpacker is used repeatedly to unpack untrusted input from external sources, it may be vulnerable to a DoS attack.</p> <p>### Patches</p> <p>v1.2.1</p> <p>### Workarounds</p> <p>Users should create a new Unpacker instead of reusing the same Unpacker after an error occurs.</p> <p>Applying the above patch can prevent SEGV, but reusing the Streaming Unpacker after it has encountered an error will not yield correct data. If an error occurs during Streaming Unpacking, the Stream and Streaming Unpacker should be discarded.</p> <p>Therefore, this is not just a workaround but the correct solution. The above patch only prevents crashes from incorrect usage.</p> https://cve.radiocsirt.org/vuln/brew-ansible-cve-2026-57585 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0873 certfr-2026-avi-0873 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0873 https://cve.radiocsirt.org/vuln/cleanstart-2026-du27033 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: apache-superset</p> <p>Package apache-superset version 5.0.0-r8 fixes 6 vulnerabilities: ghsa-537c-gmf6-5ccf, CVE-2026-34180, ghsa-6v7p-g79w-8964, CVE-2026-57585, CVE-2026-44405...</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: apache-superset</p> <p>Package apache-superset version 5.0.0-r8 fixes 6 vulnerabilities: ghsa-537c-gmf6-5ccf, CVE-2026-34180, ghsa-6v7p-g79w-8964, CVE-2026-57585, CVE-2026-44405...</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-du27033 https://cve.radiocsirt.org/vuln/euvd-2026-331783 EUVD-2026-331783 https://cve.radiocsirt.org/vuln/euvd-2026-331783 https://cve.radiocsirt.org/vuln/fkie_cve-2026-57585 <p>MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.</p> <p>MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-57585 https://cve.radiocsirt.org/vuln/ghsa-6v7p-g79w-8964 <p><strong>Affected:</strong> PyPI: msgpack</p> <p>### Impact</p> <p>If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV.</p> <p>If the Unpacker is used repeatedly to unpack untrusted input from external sources, it may be vulnerable to a DoS attack.</p> <p>### Patches</p> <p>v1.2.1</p> <p>### Workarounds</p> <p>Users should create a new Unpacker instead of reusing the same Unpacker after an error occurs.</p> <p>Applying the above patch can prevent SEGV, but reusing the Streaming Unpacker after it has encountered an error will not yield correct data. If an error occurs during Streaming Unpacking, the Stream and Streaming Unpacker should be discarded.</p> <p>Therefore, this is not just a workaround but the correct solution. The above patch only prevents crashes from incorrect usage.</p> <p><strong>Affected:</strong> PyPI: msgpack</p> <p>### Impact</p> <p>If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV.</p> <p>If the Unpacker is used repeatedly to unpack untrusted input from external sources, it may be vulnerable to a DoS attack.</p> <p>### Patches</p> <p>v1.2.1</p> <p>### Workarounds</p> <p>Users should create a new Unpacker instead of reusing the same Unpacker after an error occurs.</p> <p>Applying the above patch can prevent SEGV, but reusing the Streaming Unpacker after it has encountered an error will not yield correct data. If an error occurs during Streaming Unpacking, the Stream and Streaming Unpacker should be discarded.</p> <p>Therefore, this is not just a workaround but the correct solution. The above patch only prevents crashes from incorrect usage.</p> https://cve.radiocsirt.org/vuln/ghsa-6v7p-g79w-8964 https://cve.radiocsirt.org/vuln/msrc_cve-2026-57585 msrc_CVE-2026-57585 https://cve.radiocsirt.org/vuln/msrc_cve-2026-57585 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11586-1 <p>python313-msgpack-1.2.1-1.1 on GA media</p> <p>python313-msgpack-1.2.1-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11586-1 https://cve.radiocsirt.org/vuln/pysec-2026-3625 <p><strong>Affected:</strong> PyPI: msgpack</p> <p>MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.</p> <p><strong>Affected:</strong> PyPI: msgpack</p> <p>MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.</p> https://cve.radiocsirt.org/vuln/pysec-2026-3625 https://cve.radiocsirt.org/vuln/rhsa-2026:70965 <p>python-transformers: python-transformers: Arbitrary code execution due to overridden trust_remote_code setting vllm: vLLM: Denial of Service via unbounded video frame processing aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load() vllm: vLLM: Arbitrary code execution via malicious HuggingFace model vllm: vLLM: Denial of Service via malformed tensor shape in speculative decoding Diffusers: Diffusers: Arbitrary remote code execution via `trust_remote_code` bypass diffusers: Diffusers: Arbitrary Code Execution via malicious model loading diffusers: Diffusers: Arbitrary code execution due to trust_remote_code guard bypass python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens starlette: Starlette: Security restriction bypass via malformed HTTP Host header vllm: starlette: vLLM: Critical authentication bypass allows unauthorized API access Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files vllm: vLLM: Denial of Service via malformed speculative decoding workload starlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS python-pillow: Pillow: Denial of Service via crafted BDF font file python-pillow: Pillow: Denial of Service via crafted GD 2.x image file vllm: vLLM: Denial of Service via adversarial regular expression in structured outputs API msgpac…</p> <p>python-transformers: python-transformers: Arbitrary code execution due to overridden trust_remote_code setting vllm: vLLM: Denial of Service via unbounded video frame processing aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load() vllm: vLLM: Arbitrary code execution via malicious HuggingFace model vllm: vLLM: Denial of Service via malformed tensor shape in speculative decoding Diffusers: Diffusers: Arbitrary remote code execution via `trust_remote_code` bypass diffusers: Diffusers: Arbitrary Code Execution via malicious model loading diffusers: Diffusers: Arbitrary code execution due to trust_remote_code guard bypass python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens starlette: Starlette: Security restriction bypass via malformed HTTP Host header vllm: starlette: vLLM: Critical authentication bypass allows unauthorized API access Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files vllm: vLLM: Denial of Service via malformed speculative decoding workload starlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS python-pillow: Pillow: Denial of Service via crafted BDF font file python-pillow: Pillow: Denial of Service via crafted GD 2.x image file vllm: vLLM: Denial of Service via adversarial regular expression in structured outputs API msgpac…</p> https://cve.radiocsirt.org/vuln/rhsa-2026:70965 https://cve.radiocsirt.org/vuln/suse-su-2026:22704-1 <p>Security update for python-msgpack</p> <p>Security update for python-msgpack</p> https://cve.radiocsirt.org/vuln/suse-su-2026:22704-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-57585 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: python-pip, Ubuntu:Pro:16.04:LTS: python-pip, Ubuntu:18.04:LTS: python-msgpack, Ubuntu:Pro:18.04:LTS: python-pip, Ubuntu:20.04:LTS: python-msgpack, Ubuntu:Pro:20.04:LTS: python-pip, Ubuntu:22.04:LTS: python-msgpack, Ubuntu:Pro:22.04:LTS: python-pip, Ubuntu:24.04:LTS: python-msgpack, Ubuntu:24.04:LTS: python-srsly and 7 more</p> <p>MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: python-pip, Ubuntu:Pro:16.04:LTS: python-pip, Ubuntu:18.04:LTS: python-msgpack, Ubuntu:Pro:18.04:LTS: python-pip, Ubuntu:20.04:LTS: python-msgpack, Ubuntu:Pro:20.04:LTS: python-pip, Ubuntu:22.04:LTS: python-msgpack, Ubuntu:Pro:22.04:LTS: python-pip, Ubuntu:24.04:LTS: python-msgpack, Ubuntu:24.04:LTS: python-srsly and 7 more</p> <p>MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-57585