Datastore

Certifi removes GLOBALTRUST root certificate

Starlette has possible denial-of-service vector when parsing large files in multipart forms

aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)

AIOHTTP has CRLF injection through multipart part content type header construction

urllib3 streaming API improperly handles highly compressed data

Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)

AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS

PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)

urllib3 does not control redirects in browsers and Node.js

aiohttp: HTTP/1 Pipelined Requests Queue Without Limit

aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size

Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching

Vulnerable OpenSSL included in cryptography wheels

AIOHTTP vulnerable to brute-force leak of internal static file path components

virtualenv Has TOCTOU Vulnerabilities in Directory Creation

Denial of service (DoS) via deformation `multipart/form-data` boundary

AnyIO process-pool workers can block indefinitely on undrained stderr

python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service

AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass

aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines

Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix

AIOHTTP's unicode processing of header values could cause parsing discrepancies

AIOHTTP vulnerable to denial of service through large payloads

python-multipart: Semicolon treated as querystring field separator enables parameter smuggling

AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

pytest has vulnerable tmpdir handling

PyJWT accepts unknown `crit` header extensions

Vulnerable OpenSSL included in cryptography wheels

Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``

protobuf affected by a JSON recursion depth bypass

AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS

Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

urllib3: HTTPS proxy TLS configuration may be ignored or overridden

protobuf-python has a potential Denial of Service issue

PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header

virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use

AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections

AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect

PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token forgery via file://, ftp://, data: schemes

Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default

virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection

Requests vulnerable to .netrc credentials leak via malicious URLs

PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation

PyJWT: PyJWKClient follows redirects when fetching JWKS

Requests `Session` object does not verify requests after making first request with verify=False