pypdf, a pure-Python PDF library, takes excessive time to retrieve page labels from a crafted PDF that contains a flat page-label number tree with many ranges. The page_labels property scans the same /Nums array repeatedly for every page, so the work grows with both the page count and the number of label ranges. An attacker can cause long runtimes (denial of service) by supplying such a file to an application that reads page labels; confidentiality and integrity are not affected. Exploitation requires user interaction, such as opening or processing the file.
py-pdf · pypdf
pypdf, a pure-Python library for processing PDF files, can enter an infinite loop when cloning or duplicating a specially crafted PDF with cyclic dictionary references. The cycle check compared generated destination references instead of the original source references, so some cycles were not detected. An attacker who can get such a file processed by an application using pypdf can exhaust the CPU of the worker process, which causes a hang or service degradation. Confidentiality and integrity are not affected, and no authentication is required if the application accepts PDFs from outside.
py-pdf · pypdf
pypdf versions before 6.21.4 can consume excessive memory when parsing a crafted PDF whose page tree contains many shared resources. Page-tree flattening copies page entries without a document-wide limit, so a single file can cause disproportionate allocations. An attacker who can get such a PDF processed by an application can cause a denial of service (crashed or slowed worker); no data is disclosed or modified, and the attack needs no privileges but requires that a user or application processes the file.
py-pdf · pypdf
pypdf, a pure-Python library for reading and processing PDF files, can enter an infinite loop when it opens a crafted, incomplete PDF whose standard cross-reference table reaches the end of the file without a trailer. The parsing thread is blocked, which denies service to the application using the library. Exploitation requires that an application opens such a file, for example one uploaded by a user, and the impact is limited to availability.
py-pdf · pypdf
The @hapi/content library, used by the hapi Node.js framework and by @hapi/pez for multipart/form-data parsing, has a flaw in Content.disposition(). A Content-Disposition header with a long parameter token that has no equals sign causes quadratic processing that can block the Node.js event loop. An unauthenticated remote attacker can stall a single-instance service with one crafted multipart request, and applications that pass untrusted headers directly to Content.disposition() are also affected.
hapi project · @hapi/content
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
The containerized OpenShift installer downloads inventory and dynamic scripts from remote URLs and runs them without verifying their integrity. An attacker with a Man-in-the-Middle position on the network, or control of the script server, can substitute a malicious executable. It then runs with the installer's user ID and full cluster-provisioning privileges, which allows arbitrary code execution. The risk only applies where INVENTORY_URL or DYNAMIC_SCRIPT_URL is used.
Red Hat · openshift-ansible
IDrive Backup for Windows up to and including version 7.0.1.1 contains a vulnerability in the id_service.exe component that allows a local attacker to execute arbitrary code. An attack requires a local user account on the affected Windows system; the network is not exposed. The issue is fixed in version 7.0.1.2. The CVSS score and CWE classification are provisional because NVD analysis is still pending.
IDrive · IDrive Backup for Windows
IDrive Backup for Windows version 7.0.1.1 and below contains a flaw in the id_service.exe component that allows a local attacker to execute arbitrary code. According to the researcher's write-up, insecure serialization and deserialization of data sent to the local service allows injected code to run with SYSTEM privileges. The attacker needs a logon with low privileges on the affected system; the service is not reachable from remote systems. Version 7.0.1.2 fixes the issue.
IDrive · Backup for Windows
pyasn1, a generic ASN.1 library for Python, decodes binary REAL values with a mantissa-building routine whose run time grows quadratically with the mantissa length. An attacker who can supply ASN.1 data to an application using pyasn1 can send a comparatively small REAL value that keeps a decoding process busy on one CPU core for seconds or longer. The attack works with BER, CER and DER decoding, with or without a schema, and leads to loss of availability.
pyasn1 · pyasn1
pyasn1, a generic ASN.1 library for Python, consumes CPU quadratically when decoding constructed BIT STRING values with many fragments. An attacker who can supply crafted BER, CER or definite-length DER input can stall the decoding process. The flaw causes denial of service only, with no confidentiality or integrity impact, and applies only where an application parses untrusted ASN.1 data with pyasn1.
pyasn1 · pyasn1
pyasn1, a generic ASN.1 library for Python, has a quadratic-time flaw when decoding constructed string types and indefinite-length ANY values in BER and CER data. An attacker who can supply such data to an application that decodes it can send many fragments, which exhausts CPU on the decoding workers. The issue causes denial of service only, with no confidentiality or integrity impact. Exposure depends on whether an application decodes untrusted ASN.1 input, and pyasn1 is often used as a transitive dependency.
pyasn1 · pyasn1
pyasn1 is a generic ASN.1 Python library. Versions from 0.3.3 up to 0.6.5 store the TagSet of every decoded component in a growing set during schemaless container decoding, which causes quadratic CPU work when attacker-supplied BER, CER or DER input contains many long tag IDs with colliding hashes. An unauthenticated remote attacker can send repeated crafted inputs to exhaust decoder CPU and reduce service availability.
pyasn1 · pyasn1
Research and translation in progress – available shortly.
Forge (node-forge) is a JavaScript implementation of TLS and cryptographic functions. Crafted DER or PEM input with deeply nested BIT STRINGs makes asn1.fromDer() consume excessive CPU time and memory, because the maxDepth limit was not applied to BIT STRING contents. A remote, unauthenticated attacker can exhaust resources and crash a Node.js process, so the impact is limited to availability. This is an incomplete fix of CVE-2025-66031.
Digitalbazaar · Forge (node-forge)
node-forge (Forge) versions before 1.4.1 accept a certificate as a CA when it contains a forged extension under the deprecated OIDs 2.5.29.10 or 2.5.29.13, placed before the genuine basicConstraints extension. An attacker who holds a certificate from a CA trusted by the application, where that CA copies extensions from certificate signing requests, can issue certificates for arbitrary names and impersonate servers or clients. Exploitation is complex and depends on such a trusted CA, and a public proof of concept exists.
Digital Bazaar · node-forge
Research and translation in progress – available shortly.
Forge (node-forge) is a JavaScript implementation of TLS. A remote, unauthenticated peer can send a TLS record of another content type in the middle of a fragmented handshake message, which causes an uncaught TypeError in process(). This terminates the affected connection or the Node.js process hosting it, so the impact is limited to availability (CVSS 7.5, A:H). Exposure is highest for Node.js services that use forge's TLS code and accept connections from untrusted peers.
Digital Bazaar · Forge (node-forge)
Forge (node-forge) is a JavaScript implementation of TLS. Before version 1.4.1, the TLS record processing in forge.tls.createConnection() handled each received record recursively, so a single input chunk with thousands of small records (for example heartbeat records) exhausts the JavaScript call stack. The attack needs no authentication and can be started by any peer that connects to a forge TLS server or to a server a forge TLS client connects to. In Node.js applications that call process() from a socket data handler, the uncaught exception terminates the process and drops the connections it serves.
Digital Bazaar · Forge (node-forge)
Research and translation in progress – available shortly.
A heap-based buffer overflow in the vtkWindBladeReader component of VTK 9.6.1 can be triggered by a specially crafted WindBlade .wind data set. A signed byteCount value in the binary data file can produce a zero-sized buffer, and out-of-bounds reads then follow. An attacker who can supply such a file to a vulnerable application can cause a deterministic denial of service and may expose heap-resident data.
Kitware · VTK
A out-of-bounds read vulnerability in the vtkChacoReader InputGraph2 function of VTK 9.6.1 allows an attacker to read memory outside the intended buffer. The flaw is caused by missing validation of neighbor vertex IDs in Chaco graph files, which are later used as point indices. An attacker can trigger it by supplying a specially crafted Chaco file to an application that parses such input, which may lead to a crash or limited information disclosure.
Kitware · VTK
