kiva-llm-gateway

Certifi removes GLOBALTRUST root certificate

Starlette has possible denial-of-service vector when parsing large files in multipart forms

aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

AIOHTTP has CRLF injection through multipart part content type header construction

urllib3 streaming API improperly handles highly compressed data

Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)

Black: Arbitrary file writes from unsanitized user input in cache file name

AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS

urllib3 does not control redirects in browsers and Node.js

aiohttp: HTTP/1 Pipelined Requests Queue Without Limit

aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size

LiteLLM: Authentication Bypass via Host Header Injection

Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching

Vulnerable OpenSSL included in cryptography wheels

LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint

AIOHTTP vulnerable to brute-force leak of internal static file path components

virtualenv Has TOCTOU Vulnerabilities in Directory Creation

Denial of service (DoS) via deformation `multipart/form-data` boundary

python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service

AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass

aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines

pyasn1 has a DoS vulnerability in decoder

Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix

AIOHTTP's unicode processing of header values could cause parsing discrepancies

LiteLLM: Password hash exposure and pass-the-hash authentication bypass

AIOHTTP vulnerable to denial of service through large payloads

python-multipart: Semicolon treated as querystring field separator enables parameter smuggling

AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

pytest has vulnerable tmpdir handling

PyJWT accepts unknown `crit` header extensions

Vulnerable OpenSSL included in cryptography wheels

Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``

protobuf affected by a JSON recursion depth bypass

Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS

h2 allows HTTP Request Smuggling due to illegal characters in headers

Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

protobuf-python has a potential Denial of Service issue

AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections

AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect

PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token forgery via file://, ftp://, data: schemes

Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default

Requests vulnerable to .netrc credentials leak via malicious URLs

Requests `Session` object does not verify requests after making first request with verify=False

aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect

AIOHTTP accepts duplicate Host headers

Jinja2 vulnerable to sandbox breakout through attr filter selecting format method

Starlette Denial of service (DoS) via multipart/form-data