Common Weakness Enumeration
CWE-400
DiscouragedUncontrolled Resource Consumption
Abstraction: Class · Status: Draft
The product does not properly control the allocation and maintenance of a limited resource.
2353 vulnerabilities reference this CWE, most recent first.
CVE-2026-120235 (GCVE-0-2026-120235)
Vulnerability from cvelistv5 – Published: 2026-11-01 16:00 – Updated: 2026-11-02 17:41 X_Open Source
VLAI
EPSS
VEX
Title
ag-ui-protocol ag-ui SSE Parser sse.ts parseSSEStream resource consumption
Summary
A security vulnerability has been detected in ag-ui-protocol ag-ui up to 0.0.58. Affected is the function parseSSEStream of the file sdks/typescript/packages/client/src/transform/sse.ts of the component SSE Parser. The manipulation leads to resource consumption. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is 9e7b2b00bce215bbf731f1e6094f63812527c432. The affected component should be upgraded.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 17:15 UTC
Assigner
VulDB
CNA
References
9 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/429594 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/429594/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-120235 | third-party-advisory |
| https://vuldb.com/submit/1015147 | third-party-advisory |
| https://github.com/ag-ui-protocol/ag-ui/issues/2522 | exploitissue-tracking |
| https://github.com/ag-ui-protocol/ag-ui/pull/2627 | issue-trackingpatch |
| https://github.com/ag-ui-protocol/ag-ui/commit/9e… | patch |
| https://github.com/ag-ui-protocol/ag-ui/releases/… | patch |
| https://github.com/ag-ui-protocol/ag-ui/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ag-ui-protocol | ag-ui |
Affected:
0.0.1
Affected: 0.0.2 Affected: 0.0.3 Affected: 0.0.4 Affected: 0.0.5 Affected: 0.0.6 Affected: 0.0.7 Affected: 0.0.8 Affected: 0.0.9 Affected: 0.0.10 Affected: 0.0.11 Affected: 0.0.12 Affected: 0.0.13 Affected: 0.0.14 Affected: 0.0.15 Affected: 0.0.16 Affected: 0.0.17 Affected: 0.0.18 Affected: 0.0.19 Affected: 0.0.20 Affected: 0.0.21 Affected: 0.0.22 Affected: 0.0.23 Affected: 0.0.24 Affected: 0.0.25 Affected: 0.0.26 Affected: 0.0.27 Affected: 0.0.28 Affected: 0.0.29 Affected: 0.0.30 Affected: 0.0.31 Affected: 0.0.32 Affected: 0.0.33 Affected: 0.0.34 Affected: 0.0.35 Affected: 0.0.36 Affected: 0.0.37 Affected: 0.0.38 Affected: 0.0.39 Affected: 0.0.40 Affected: 0.0.41 Affected: 0.0.42 Affected: 0.0.43 Affected: 0.0.44 Affected: 0.0.45 Affected: 0.0.46 Affected: 0.0.47 Affected: 0.0.48 Affected: 0.0.49 Affected: 0.0.50 Affected: 0.0.51 Affected: 0.0.52 Affected: 0.0.53 Affected: 0.0.54 Affected: 0.0.55 Affected: 0.0.56 Affected: 0.0.57 Affected: 0.0.58 cpe:2.3:a:ag-ui-protocol:ag-ui:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120235",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T17:15:20.466792Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T17:41:44.705Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ag-ui-protocol:ag-ui:*:*:*:*:*:*:*:*"
],
"modules": [
"SSE Parser"
],
"product": "ag-ui",
"vendor": "ag-ui-protocol",
"versions": [
{
"status": "affected",
"version": "0.0.1"
},
{
"status": "affected",
"version": "0.0.2"
},
{
"status": "affected",
"version": "0.0.3"
},
{
"status": "affected",
"version": "0.0.4"
},
{
"status": "affected",
"version": "0.0.5"
},
{
"status": "affected",
"version": "0.0.6"
},
{
"status": "affected",
"version": "0.0.7"
},
{
"status": "affected",
"version": "0.0.8"
},
{
"status": "affected",
"version": "0.0.9"
},
{
"status": "affected",
"version": "0.0.10"
},
{
"status": "affected",
"version": "0.0.11"
},
{
"status": "affected",
"version": "0.0.12"
},
{
"status": "affected",
"version": "0.0.13"
},
{
"status": "affected",
"version": "0.0.14"
},
{
"status": "affected",
"version": "0.0.15"
},
{
"status": "affected",
"version": "0.0.16"
},
{
"status": "affected",
"version": "0.0.17"
},
{
"status": "affected",
"version": "0.0.18"
},
{
"status": "affected",
"version": "0.0.19"
},
{
"status": "affected",
"version": "0.0.20"
},
{
"status": "affected",
"version": "0.0.21"
},
{
"status": "affected",
"version": "0.0.22"
},
{
"status": "affected",
"version": "0.0.23"
},
{
"status": "affected",
"version": "0.0.24"
},
{
"status": "affected",
"version": "0.0.25"
},
{
"status": "affected",
"version": "0.0.26"
},
{
"status": "affected",
"version": "0.0.27"
},
{
"status": "affected",
"version": "0.0.28"
},
{
"status": "affected",
"version": "0.0.29"
},
{
"status": "affected",
"version": "0.0.30"
},
{
"status": "affected",
"version": "0.0.31"
},
{
"status": "affected",
"version": "0.0.32"
},
{
"status": "affected",
"version": "0.0.33"
},
{
"status": "affected",
"version": "0.0.34"
},
{
"status": "affected",
"version": "0.0.35"
},
{
"status": "affected",
"version": "0.0.36"
},
{
"status": "affected",
"version": "0.0.37"
},
{
"status": "affected",
"version": "0.0.38"
},
{
"status": "affected",
"version": "0.0.39"
},
{
"status": "affected",
"version": "0.0.40"
},
{
"status": "affected",
"version": "0.0.41"
},
{
"status": "affected",
"version": "0.0.42"
},
{
"status": "affected",
"version": "0.0.43"
},
{
"status": "affected",
"version": "0.0.44"
},
{
"status": "affected",
"version": "0.0.45"
},
{
"status": "affected",
"version": "0.0.46"
},
{
"status": "affected",
"version": "0.0.47"
},
{
"status": "affected",
"version": "0.0.48"
},
{
"status": "affected",
"version": "0.0.49"
},
{
"status": "affected",
"version": "0.0.50"
},
{
"status": "affected",
"version": "0.0.51"
},
{
"status": "affected",
"version": "0.0.52"
},
{
"status": "affected",
"version": "0.0.53"
},
{
"status": "affected",
"version": "0.0.54"
},
{
"status": "affected",
"version": "0.0.55"
},
{
"status": "affected",
"version": "0.0.56"
},
{
"status": "affected",
"version": "0.0.57"
},
{
"status": "affected",
"version": "0.0.58"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ez-lbz (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in ag-ui-protocol ag-ui up to 0.0.58. Affected is the function parseSSEStream of the file sdks/typescript/packages/client/src/transform/sse.ts of the component SSE Parser. The manipulation leads to resource consumption. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is 9e7b2b00bce215bbf731f1e6094f63812527c432. The affected component should be upgraded."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-01T16:00:21.124Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-429594 | ag-ui-protocol ag-ui SSE Parser sse.ts parseSSEStream resource consumption",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/429594"
},
{
"name": "VDB-429594 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/429594/cti"
},
{
"name": "CVE-2026-120235 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-120235"
},
{
"name": "Submit #1015147 | ag-ui-protocol ag-ui \u003c=0.0.58 CWE-400",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1015147"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/ag-ui-protocol/ag-ui/issues/2522"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/ag-ui-protocol/ag-ui/pull/2627"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ag-ui-protocol/ag-ui/commit/9e7b2b00bce215bbf731f1e6094f63812527c432"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ag-ui-protocol/ag-ui/releases/tag/release/2026-10-30"
},
{
"tags": [
"product"
],
"url": "https://github.com/ag-ui-protocol/ag-ui/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-31T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-31T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-31T21:16:07.000Z",
"value": "VulDB entry last update"
}
],
"title": "ag-ui-protocol ag-ui SSE Parser sse.ts parseSSEStream resource consumption",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-120235",
"datePublished": "2026-11-01T16:00:21.124Z",
"dateReserved": "2026-10-31T20:10:43.320Z",
"dateUpdated": "2026-11-02T17:41:44.705Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120234 (GCVE-0-2026-120234)
Vulnerability from cvelistv5 – Published: 2026-11-01 15:30 – Updated: 2026-11-06 19:07
VLAI
EPSS
VEX
Title
ag-ui-protocol ag-ui HTTP Transport e.text resource consumption
Summary
A weakness has been identified in ag-ui-protocol ag-ui up to 0.0.58. This impacts the function e.text of the component HTTP Transport. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 19:07 UTC
Assigner
VulDB
CNA
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/429593 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/429593/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-120234 | third-party-advisory |
| https://vuldb.com/submit/1015146 | third-party-advisory |
| https://github.com/ag-ui-protocol/ag-ui/issues/2521 | exploitissue-tracking |
| https://github.com/ag-ui-protocol/ag-ui/pull/2698 | issue-trackingpatch |
| https://github.com/ag-ui-protocol/ag-ui/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ag-ui-protocol | ag-ui |
Affected:
0.0.1
Affected: 0.0.2 Affected: 0.0.3 Affected: 0.0.4 Affected: 0.0.5 Affected: 0.0.6 Affected: 0.0.7 Affected: 0.0.8 Affected: 0.0.9 Affected: 0.0.10 Affected: 0.0.11 Affected: 0.0.12 Affected: 0.0.13 Affected: 0.0.14 Affected: 0.0.15 Affected: 0.0.16 Affected: 0.0.17 Affected: 0.0.18 Affected: 0.0.19 Affected: 0.0.20 Affected: 0.0.21 Affected: 0.0.22 Affected: 0.0.23 Affected: 0.0.24 Affected: 0.0.25 Affected: 0.0.26 Affected: 0.0.27 Affected: 0.0.28 Affected: 0.0.29 Affected: 0.0.30 Affected: 0.0.31 Affected: 0.0.32 Affected: 0.0.33 Affected: 0.0.34 Affected: 0.0.35 Affected: 0.0.36 Affected: 0.0.37 Affected: 0.0.38 Affected: 0.0.39 Affected: 0.0.40 Affected: 0.0.41 Affected: 0.0.42 Affected: 0.0.43 Affected: 0.0.44 Affected: 0.0.45 Affected: 0.0.46 Affected: 0.0.47 Affected: 0.0.48 Affected: 0.0.49 Affected: 0.0.50 Affected: 0.0.51 Affected: 0.0.52 Affected: 0.0.53 Affected: 0.0.54 Affected: 0.0.55 Affected: 0.0.56 Affected: 0.0.57 Affected: 0.0.58 cpe:2.3:a:ag-ui-protocol:ag-ui:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120234",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T19:07:04.622613Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T19:07:18.398Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ag-ui-protocol:ag-ui:*:*:*:*:*:*:*:*"
],
"modules": [
"HTTP Transport"
],
"product": "ag-ui",
"vendor": "ag-ui-protocol",
"versions": [
{
"status": "affected",
"version": "0.0.1"
},
{
"status": "affected",
"version": "0.0.2"
},
{
"status": "affected",
"version": "0.0.3"
},
{
"status": "affected",
"version": "0.0.4"
},
{
"status": "affected",
"version": "0.0.5"
},
{
"status": "affected",
"version": "0.0.6"
},
{
"status": "affected",
"version": "0.0.7"
},
{
"status": "affected",
"version": "0.0.8"
},
{
"status": "affected",
"version": "0.0.9"
},
{
"status": "affected",
"version": "0.0.10"
},
{
"status": "affected",
"version": "0.0.11"
},
{
"status": "affected",
"version": "0.0.12"
},
{
"status": "affected",
"version": "0.0.13"
},
{
"status": "affected",
"version": "0.0.14"
},
{
"status": "affected",
"version": "0.0.15"
},
{
"status": "affected",
"version": "0.0.16"
},
{
"status": "affected",
"version": "0.0.17"
},
{
"status": "affected",
"version": "0.0.18"
},
{
"status": "affected",
"version": "0.0.19"
},
{
"status": "affected",
"version": "0.0.20"
},
{
"status": "affected",
"version": "0.0.21"
},
{
"status": "affected",
"version": "0.0.22"
},
{
"status": "affected",
"version": "0.0.23"
},
{
"status": "affected",
"version": "0.0.24"
},
{
"status": "affected",
"version": "0.0.25"
},
{
"status": "affected",
"version": "0.0.26"
},
{
"status": "affected",
"version": "0.0.27"
},
{
"status": "affected",
"version": "0.0.28"
},
{
"status": "affected",
"version": "0.0.29"
},
{
"status": "affected",
"version": "0.0.30"
},
{
"status": "affected",
"version": "0.0.31"
},
{
"status": "affected",
"version": "0.0.32"
},
{
"status": "affected",
"version": "0.0.33"
},
{
"status": "affected",
"version": "0.0.34"
},
{
"status": "affected",
"version": "0.0.35"
},
{
"status": "affected",
"version": "0.0.36"
},
{
"status": "affected",
"version": "0.0.37"
},
{
"status": "affected",
"version": "0.0.38"
},
{
"status": "affected",
"version": "0.0.39"
},
{
"status": "affected",
"version": "0.0.40"
},
{
"status": "affected",
"version": "0.0.41"
},
{
"status": "affected",
"version": "0.0.42"
},
{
"status": "affected",
"version": "0.0.43"
},
{
"status": "affected",
"version": "0.0.44"
},
{
"status": "affected",
"version": "0.0.45"
},
{
"status": "affected",
"version": "0.0.46"
},
{
"status": "affected",
"version": "0.0.47"
},
{
"status": "affected",
"version": "0.0.48"
},
{
"status": "affected",
"version": "0.0.49"
},
{
"status": "affected",
"version": "0.0.50"
},
{
"status": "affected",
"version": "0.0.51"
},
{
"status": "affected",
"version": "0.0.52"
},
{
"status": "affected",
"version": "0.0.53"
},
{
"status": "affected",
"version": "0.0.54"
},
{
"status": "affected",
"version": "0.0.55"
},
{
"status": "affected",
"version": "0.0.56"
},
{
"status": "affected",
"version": "0.0.57"
},
{
"status": "affected",
"version": "0.0.58"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ez-lbz (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in ag-ui-protocol ag-ui up to 0.0.58. This impacts the function e.text of the component HTTP Transport. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-01T15:30:16.548Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-429593 | ag-ui-protocol ag-ui HTTP Transport e.text resource consumption",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/429593"
},
{
"name": "VDB-429593 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/429593/cti"
},
{
"name": "CVE-2026-120234 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-120234"
},
{
"name": "Submit #1015146 | ag-ui-protocol ag-ui \u003c=0.0.58 CWE-400",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1015146"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/ag-ui-protocol/ag-ui/issues/2521"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/ag-ui-protocol/ag-ui/pull/2698"
},
{
"tags": [
"product"
],
"url": "https://github.com/ag-ui-protocol/ag-ui/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-31T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-31T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-31T21:16:04.000Z",
"value": "VulDB entry last update"
}
],
"title": "ag-ui-protocol ag-ui HTTP Transport e.text resource consumption",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-120234",
"datePublished": "2026-11-01T15:30:16.548Z",
"dateReserved": "2026-10-31T20:10:39.648Z",
"dateUpdated": "2026-11-06T19:07:18.398Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120217 (GCVE-0-2026-120217)
Vulnerability from cvelistv5 – Published: 2026-11-01 06:15 – Updated: 2026-11-05 15:41
VLAI
EPSS
VEX
Title
Delgan loguru ANSI Color-Markup _colorizer.py AnsiParser.feed redos
Summary
A vulnerability was detected in Delgan loguru 0.7.3. The affected element is the function AnsiParser.feed of the file loguru/_colorizer.py of the component ANSI Color-Markup Parser. Performing a manipulation results in inefficient regular expression complexity. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 15:41 UTC
Assigner
VulDB
CNA
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/429568 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/429568/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-120217 | third-party-advisory |
| https://vuldb.com/submit/992264 | third-party-advisory |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120217",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T15:41:29.936781Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T15:41:42.599Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:delgan:loguru:*:*:*:*:*:*:*:*"
],
"modules": [
"ANSI Color-Markup Parser"
],
"product": "loguru",
"vendor": "Delgan",
"versions": [
{
"status": "affected",
"version": "0.7.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "xianggudahundun (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in Delgan loguru 0.7.3. The affected element is the function AnsiParser.feed of the file loguru/_colorizer.py of the component ANSI Color-Markup Parser. Performing a manipulation results in inefficient regular expression complexity. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "Inefficient Regular Expression Complexity",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-01T06:15:17.369Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-429568 | Delgan loguru ANSI Color-Markup _colorizer.py AnsiParser.feed redos",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/429568"
},
{
"name": "VDB-429568 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/429568/cti"
},
{
"name": "CVE-2026-120217 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-120217"
},
{
"name": "Submit #992264 | Delgan loguru 0.7.3 Denial of Service",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/992264"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-31T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-31T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-31T17:35:05.000Z",
"value": "VulDB entry last update"
}
],
"title": "Delgan loguru ANSI Color-Markup _colorizer.py AnsiParser.feed redos",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-120217",
"datePublished": "2026-11-01T06:15:17.369Z",
"dateReserved": "2026-10-31T16:29:58.549Z",
"dateUpdated": "2026-11-05T15:41:42.599Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119286 (GCVE-0-2026-119286)
Vulnerability from cvelistv5 – Published: 2026-10-29 21:38 – Updated: 2026-10-30 15:58
VLAI
EPSS
VEX
Title
GraphQL-core: Denial of service via memory leak in aborted validations
Summary
GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate() reuses a module-level ValidationAbortedError when a document exceeds max_errors. Python appends frames to the reused exception's traceback on every raise, retaining each document, validation context, and error set for the process lifetime. An unauthenticated client can repeatedly submit a small document with more than 100 validation errors to cause unbounded memory growth before query execution, eventually exhausting worker memory without disclosing or modifying data. This issue is fixed in version 3.3.1.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:47 UTC
CWE
Assigner
GitHub_M
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/graphql-python/graphql-core/se… | x_refsource_CONFIRM |
| https://github.com/graphql-python/graphql-core/is… | x_refsource_MISC |
| https://github.com/graphql-python/graphql-core/pull/288 | x_refsource_MISC |
| https://github.com/graphql-python/graphql-core/co… | x_refsource_MISC |
| https://github.com/graphql-python/graphql-core/re… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| graphql-python | graphql-core |
Affected:
>= 3.3.0a3, < 3.3.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119286",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:47:35.331193Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:58:44.342Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "graphql-core",
"vendor": "graphql-python",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.3.0a3, \u003c 3.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate() reuses a module-level ValidationAbortedError when a document exceeds max_errors. Python appends frames to the reused exception\u0027s traceback on every raise, retaining each document, validation context, and error set for the process lifetime. An unauthenticated client can repeatedly submit a small document with more than 100 validation errors to cause unbounded memory growth before query execution, eventually exhausting worker memory without disclosing or modifying data. This issue is fixed in version 3.3.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-401",
"description": "CWE-401: Missing Release of Memory after Effective Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T21:38:43.633Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/graphql-python/graphql-core/security/advisories/GHSA-mpqx-q82w-9x46",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/graphql-python/graphql-core/security/advisories/GHSA-mpqx-q82w-9x46"
},
{
"name": "https://github.com/graphql-python/graphql-core/issues/287",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/graphql-python/graphql-core/issues/287"
},
{
"name": "https://github.com/graphql-python/graphql-core/pull/288",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/graphql-python/graphql-core/pull/288"
},
{
"name": "https://github.com/graphql-python/graphql-core/commit/3c319fd9f4b8f6c9db4189520561bf8dd0e70be9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/graphql-python/graphql-core/commit/3c319fd9f4b8f6c9db4189520561bf8dd0e70be9"
},
{
"name": "https://github.com/graphql-python/graphql-core/releases/tag/v3.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/graphql-python/graphql-core/releases/tag/v3.3.1"
}
],
"source": {
"advisory": "GHSA-mpqx-q82w-9x46",
"discovery": "UNKNOWN"
},
"title": "GraphQL-core: Denial of service via memory leak in aborted validations"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-119286",
"datePublished": "2026-10-29T21:38:43.633Z",
"dateReserved": "2026-10-29T18:50:28.065Z",
"dateUpdated": "2026-10-30T15:58:44.342Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119284 (GCVE-0-2026-119284)
Vulnerability from cvelistv5 – Published: 2026-10-29 21:33 – Updated: 2026-10-30 17:05
VLAI
EPSS
VEX
Title
joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection
Summary
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.6, joserfc compact JWS deserialization calls bytes.split() before enforcing the existing aggregate segment-size limits. When attacker-controlled compact serialization bytes reach deserialize_compact(), the split creates copies of the header, payload, and signature segments before ExceededSizeError rejects them, causing an additional allocation approximately proportional to the supplied token. Requests that exhaust available process memory can therefore cause an availability failure even though signature verification fails. This issue is fixed in version 1.7.6.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 17:05 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
GitHub_M
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/authlib/joserfc/security/advis… | x_refsource_CONFIRM |
| https://github.com/authlib/joserfc/commit/397e04f… | x_refsource_MISC |
| https://github.com/authlib/joserfc/releases/tag/1.7.6 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119284",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T17:05:14.978930Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T17:05:38.184Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/authlib/joserfc/security/advisories/GHSA-9pg5-8c7x-5hfx"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "joserfc",
"vendor": "authlib",
"versions": [
{
"status": "affected",
"version": "\u003c 1.7.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.6, joserfc compact JWS deserialization calls bytes.split() before enforcing the existing aggregate segment-size limits. When attacker-controlled compact serialization bytes reach deserialize_compact(), the split creates copies of the header, payload, and signature segments before ExceededSizeError rejects them, causing an additional allocation approximately proportional to the supplied token. Requests that exhaust available process memory can therefore cause an availability failure even though signature verification fails. This issue is fixed in version 1.7.6."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T21:33:16.529Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/authlib/joserfc/security/advisories/GHSA-9pg5-8c7x-5hfx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/authlib/joserfc/security/advisories/GHSA-9pg5-8c7x-5hfx"
},
{
"name": "https://github.com/authlib/joserfc/commit/397e04f4bbce0b94d86e31c1c003f4640af8fb39",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/authlib/joserfc/commit/397e04f4bbce0b94d86e31c1c003f4640af8fb39"
},
{
"name": "https://github.com/authlib/joserfc/releases/tag/1.7.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/authlib/joserfc/releases/tag/1.7.6"
}
],
"source": {
"advisory": "GHSA-9pg5-8c7x-5hfx",
"discovery": "UNKNOWN"
},
"title": "joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-119284",
"datePublished": "2026-10-29T21:33:16.529Z",
"dateReserved": "2026-10-29T18:50:28.065Z",
"dateUpdated": "2026-10-30T17:05:38.184Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119283 (GCVE-0-2026-119283)
Vulnerability from cvelistv5 – Published: 2026-10-29 21:10 – Updated: 2026-10-30 17:08
VLAI
EPSS
VEX
Title
joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption
Summary
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.5, joserfc.jwe.decrypt_json() accepts a JWE General JSON Serialization recipients array without a count limit and calls decrypt_cek() for every entry. An unauthenticated attacker who can submit a JWE to an endpoint using an RSA key-management algorithm can choose the number of private-key decryption operations performed by one request. The verify_all_recipients option does not reduce this work because the affected loop processes every recipient before consulting that setting, allowing repeated requests to exhaust service CPU without affecting confidentiality or integrity. This issue is fixed in version 1.7.5.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 17:08 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
GitHub_M
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/authlib/joserfc/security/advis… | x_refsource_CONFIRM |
| https://github.com/authlib/joserfc/commit/d6dc8df… | x_refsource_MISC |
| https://github.com/authlib/joserfc/releases/tag/1.7.5 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119283",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T17:08:00.789446Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T17:08:26.483Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/authlib/joserfc/security/advisories/GHSA-jpxq-7h8p-2q76"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "joserfc",
"vendor": "authlib",
"versions": [
{
"status": "affected",
"version": "\u003c 1.7.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.5, joserfc.jwe.decrypt_json() accepts a JWE General JSON Serialization recipients array without a count limit and calls decrypt_cek() for every entry. An unauthenticated attacker who can submit a JWE to an endpoint using an RSA key-management algorithm can choose the number of private-key decryption operations performed by one request. The verify_all_recipients option does not reduce this work because the affected loop processes every recipient before consulting that setting, allowing repeated requests to exhaust service CPU without affecting confidentiality or integrity. This issue is fixed in version 1.7.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T21:10:05.490Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/authlib/joserfc/security/advisories/GHSA-jpxq-7h8p-2q76",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/authlib/joserfc/security/advisories/GHSA-jpxq-7h8p-2q76"
},
{
"name": "https://github.com/authlib/joserfc/commit/d6dc8df6c7609277e741069d3733e43996c1cd17",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/authlib/joserfc/commit/d6dc8df6c7609277e741069d3733e43996c1cd17"
},
{
"name": "https://github.com/authlib/joserfc/releases/tag/1.7.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/authlib/joserfc/releases/tag/1.7.5"
}
],
"source": {
"advisory": "GHSA-jpxq-7h8p-2q76",
"discovery": "UNKNOWN"
},
"title": "joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-119283",
"datePublished": "2026-10-29T21:10:05.490Z",
"dateReserved": "2026-10-29T18:50:28.064Z",
"dateUpdated": "2026-10-30T17:08:26.483Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119209 (GCVE-0-2026-119209)
Vulnerability from cvelistv5 – Published: 2026-10-29 20:43 – Updated: 2026-10-30 16:00
VLAI
EPSS
VEX
Title
pypdf: Possible large memory usage when parsing cross-reference streams
Summary
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory while opening a crafted PDF containing cross-reference streams that declare very large entry counts. Highly compressible streams and /Prev chains can multiply the number of parsed entries across a document, while negative /Index counts can bypass the existing per-stream clamp. This issue is fixed in version 6.21.3.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:47 UTC
CWE
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/py-pdf/pypdf/security/advisori… | x_refsource_CONFIRM |
| https://github.com/py-pdf/pypdf/pull/4269 | x_refsource_MISC |
| https://github.com/py-pdf/pypdf/commit/a93fe3a901… | x_refsource_MISC |
| https://github.com/py-pdf/pypdf/releases/tag/6.21.3 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119209",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:47:28.155084Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T16:00:30.516Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pypdf",
"vendor": "py-pdf",
"versions": [
{
"status": "affected",
"version": "\u003c 6.21.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory while opening a crafted PDF containing cross-reference streams that declare very large entry counts. Highly compressible streams and /Prev chains can multiply the number of parsed entries across a document, while negative /Index counts can bypass the existing per-stream clamp. This issue is fixed in version 6.21.3."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T20:43:03.072Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/py-pdf/pypdf/security/advisories/GHSA-x3rh-gjgm-fmqc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/py-pdf/pypdf/security/advisories/GHSA-x3rh-gjgm-fmqc"
},
{
"name": "https://github.com/py-pdf/pypdf/pull/4269",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/py-pdf/pypdf/pull/4269"
},
{
"name": "https://github.com/py-pdf/pypdf/commit/a93fe3a901fd00af38f0a105c3ba7175fa72dcb4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/py-pdf/pypdf/commit/a93fe3a901fd00af38f0a105c3ba7175fa72dcb4"
},
{
"name": "https://github.com/py-pdf/pypdf/releases/tag/6.21.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/py-pdf/pypdf/releases/tag/6.21.3"
}
],
"source": {
"advisory": "GHSA-x3rh-gjgm-fmqc",
"discovery": "UNKNOWN"
},
"title": "pypdf: Possible large memory usage when parsing cross-reference streams"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-119209",
"datePublished": "2026-10-29T20:43:03.072Z",
"dateReserved": "2026-10-29T16:04:48.729Z",
"dateUpdated": "2026-10-30T16:00:30.516Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119208 (GCVE-0-2026-119208)
Vulnerability from cvelistv5 – Published: 2026-10-29 20:41 – Updated: 2026-11-04 01:45
VLAI
EPSS
VEX
Title
pypdf: Possible long runtimes/large memory usage for encrypted PDF files
Summary
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive time and memory when an application accesses the page count of a crafted encrypted PDF whose page tree declares a forged /Count value. Even after successful decryption, page-count retrieval trusts the unvalidated declared count instead of walking the page tree, allowing the attacker-controlled value to drive excessive work and memory use. This issue is fixed in version 6.21.3.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 01:44 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/py-pdf/pypdf/security/advisori… | x_refsource_CONFIRM |
| https://github.com/py-pdf/pypdf/pull/4270 | x_refsource_MISC |
| https://github.com/py-pdf/pypdf/commit/82b91951dc… | x_refsource_MISC |
| https://github.com/py-pdf/pypdf/releases/tag/6.21.3 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119208",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T01:44:58.307267Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T01:45:19.570Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pypdf",
"vendor": "py-pdf",
"versions": [
{
"status": "affected",
"version": "\u003c 6.21.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive time and memory when an application accesses the page count of a crafted encrypted PDF whose page tree declares a forged /Count value. Even after successful decryption, page-count retrieval trusts the unvalidated declared count instead of walking the page tree, allowing the attacker-controlled value to drive excessive work and memory use. This issue is fixed in version 6.21.3."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T20:41:02.879Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/py-pdf/pypdf/security/advisories/GHSA-62m5-6wh8-28x7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/py-pdf/pypdf/security/advisories/GHSA-62m5-6wh8-28x7"
},
{
"name": "https://github.com/py-pdf/pypdf/pull/4270",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/py-pdf/pypdf/pull/4270"
},
{
"name": "https://github.com/py-pdf/pypdf/commit/82b91951dc74496bb3efe6465434f041bb6a5e6b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/py-pdf/pypdf/commit/82b91951dc74496bb3efe6465434f041bb6a5e6b"
},
{
"name": "https://github.com/py-pdf/pypdf/releases/tag/6.21.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/py-pdf/pypdf/releases/tag/6.21.3"
}
],
"source": {
"advisory": "GHSA-62m5-6wh8-28x7",
"discovery": "UNKNOWN"
},
"title": "pypdf: Possible long runtimes/large memory usage for encrypted PDF files"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-119208",
"datePublished": "2026-10-29T20:41:02.879Z",
"dateReserved": "2026-10-29T16:04:48.729Z",
"dateUpdated": "2026-11-04T01:45:19.570Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119207 (GCVE-0-2026-119207)
Vulnerability from cvelistv5 – Published: 2026-10-29 20:38 – Updated: 2026-10-30 17:12
VLAI
EPSS
VEX
Title
pypdf: Possible large memory usage for exceptions in strict mode
Summary
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory when strict mode loads a crafted invalid PDF dictionary. Nested parsing failures add repeated exception text to newly raised errors, allowing a small malformed dictionary to amplify into very large error messages. This issue is fixed in version 6.21.3.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 17:12 UTC
CWE
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/py-pdf/pypdf/security/advisori… | x_refsource_CONFIRM |
| https://github.com/py-pdf/pypdf/pull/4265 | x_refsource_MISC |
| https://github.com/py-pdf/pypdf/commit/64270258c0… | x_refsource_MISC |
| https://github.com/py-pdf/pypdf/releases/tag/6.21.3 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119207",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T17:12:29.821934Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T17:12:40.743Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pypdf",
"vendor": "py-pdf",
"versions": [
{
"status": "affected",
"version": "\u003c 6.21.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory when strict mode loads a crafted invalid PDF dictionary. Nested parsing failures add repeated exception text to newly raised errors, allowing a small malformed dictionary to amplify into very large error messages. This issue is fixed in version 6.21.3."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-405",
"description": "CWE-405: Asymmetric Resource Consumption (Amplification)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T20:38:54.611Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vqv-7265-gm2w",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vqv-7265-gm2w"
},
{
"name": "https://github.com/py-pdf/pypdf/pull/4265",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/py-pdf/pypdf/pull/4265"
},
{
"name": "https://github.com/py-pdf/pypdf/commit/64270258c0eced720f7960aecf8cef31afd39f8d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/py-pdf/pypdf/commit/64270258c0eced720f7960aecf8cef31afd39f8d"
},
{
"name": "https://github.com/py-pdf/pypdf/releases/tag/6.21.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/py-pdf/pypdf/releases/tag/6.21.3"
}
],
"source": {
"advisory": "GHSA-4vqv-7265-gm2w",
"discovery": "UNKNOWN"
},
"title": "pypdf: Possible large memory usage for exceptions in strict mode"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-119207",
"datePublished": "2026-10-29T20:38:54.611Z",
"dateReserved": "2026-10-29T16:04:48.729Z",
"dateUpdated": "2026-10-30T17:12:40.743Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119206 (GCVE-0-2026-119206)
Vulnerability from cvelistv5 – Published: 2026-10-29 20:37 – Updated: 2026-11-03 16:41
VLAI
EPSS
VEX
Title
pypdf: Possible long runtimes when retrieving page labels
Summary
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can take excessive time to retrieve page labels from a crafted PDF containing a flat page-label number tree with many ranges. The page_labels property resolves each page independently and repeatedly scans the same /Nums array from the beginning, causing work to grow with both the page count and the number of label ranges. This issue is fixed in version 6.21.3.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 16:41 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/py-pdf/pypdf/security/advisori… | x_refsource_CONFIRM |
| https://github.com/py-pdf/pypdf/pull/4251 | x_refsource_MISC |
| https://github.com/py-pdf/pypdf/commit/b891fef370… | x_refsource_MISC |
| https://github.com/py-pdf/pypdf/releases/tag/6.21.3 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119206",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T16:41:04.264522Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T16:41:47.790Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pypdf",
"vendor": "py-pdf",
"versions": [
{
"status": "affected",
"version": "\u003c 6.21.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can take excessive time to retrieve page labels from a crafted PDF containing a flat page-label number tree with many ranges. The page_labels property resolves each page independently and repeatedly scans the same /Nums array from the beginning, causing work to grow with both the page count and the number of label ranges. This issue is fixed in version 6.21.3."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T20:37:15.057Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/py-pdf/pypdf/security/advisories/GHSA-42gh-23hr-vphw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/py-pdf/pypdf/security/advisories/GHSA-42gh-23hr-vphw"
},
{
"name": "https://github.com/py-pdf/pypdf/pull/4251",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/py-pdf/pypdf/pull/4251"
},
{
"name": "https://github.com/py-pdf/pypdf/commit/b891fef37000cd86baa6e9848a3387d080b3b03e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/py-pdf/pypdf/commit/b891fef37000cd86baa6e9848a3387d080b3b03e"
},
{
"name": "https://github.com/py-pdf/pypdf/releases/tag/6.21.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/py-pdf/pypdf/releases/tag/6.21.3"
}
],
"source": {
"advisory": "GHSA-42gh-23hr-vphw",
"discovery": "UNKNOWN"
},
"title": "pypdf: Possible long runtimes when retrieving page labels"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-119206",
"datePublished": "2026-10-29T20:37:15.057Z",
"dateReserved": "2026-10-29T16:04:48.729Z",
"dateUpdated": "2026-11-03T16:41:47.790Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
Mitigation
Architecture and Design
- Mitigation of resource exhaustion attacks requires that the target system either:
- The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.
- The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.
- recognizes the attack and denies that user further access for a given amount of time, or
- uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
Mitigation
Architecture and Design
Ensure that protocols have specific limits of scale placed on them.
Mitigation
Implementation
Ensure that all failures in resource allocation place the system into a safe posture.
CAPEC-147: XML Ping of the Death
An attacker initiates a resource depletion attack where a large number of small XML messages are delivered at a sufficiently rapid rate to cause a denial of service or crash of the target. Transactions such as repetitive SOAP transactions can deplete resources faster than a simple flooding attack because of the additional resources used by the SOAP protocol and the resources necessary to process SOAP messages. The transactions used are immaterial as long as they cause resource utilization on the target. In other words, this is a normal flooding attack augmented by using messages that will require extra processing on the target.
CAPEC-227: Sustained Client Engagement
An adversary attempts to deny legitimate users access to a resource by continually engaging a specific resource in an attempt to keep the resource tied up as long as possible. The adversary's primary goal is not to crash or flood the target, which would alert defenders; rather it is to repeatedly perform actions or abuse algorithmic flaws such that a given resource is tied up and not available to a legitimate user. By carefully crafting a requests that keep the resource engaged through what is seemingly benign requests, legitimate users are limited or completely denied access to the resource.
CAPEC-492: Regular Expression Exponential Blowup
An adversary may execute an attack on a program that uses a poor Regular Expression(Regex) implementation by choosing input that results in an extreme situation for the Regex. A typical extreme situation operates at exponential time compared to the input size. This is due to most implementations using a Nondeterministic Finite Automaton(NFA) state machine to be built by the Regex algorithm since NFA allows backtracking and thus more complex regular expressions.