chainguard/az

Vulnerabilities (28)

• CVE-2026-44432HigMay 13, 2026
  affected < 2.86.0-r0fixed 2.86.0-r0

  urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) w

• CVE-2026-44431MedMay 13, 2026
  affected < 2.86.0-r0fixed 2.86.0-r0

  urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.

• CVE-2026-25645Mar 25, 2026
  affected < 2.84.0-r4fixed 2.84.0-r4

  Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without valid

• CVE-2026-4539LowMar 22, 2026
  affected < 2.84.0-r4fixed 2.84.0-r4

  A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit

• CVE-2026-27459Mar 17, 2026
  affected < 2.84.0-r3fixed 2.84.0-r3

  pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Sta

• CVE-2026-27448Mar 17, 2026
  affected < 2.84.0-r3fixed 2.84.0-r3

  pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to `set_tlsext_servername_callback` raised an unhandled exception, this would result in a connection being accepted. If a user was relying

• CVE-2026-32597HigMar 13, 2026
  affected < 2.84.0-r3fixed 2.84.0-r3

  PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token i

• CVE-2026-21226Jan 13, 2026
  affected < 2.82.0-r1fixed 2.82.0-r1

  Deserialization of untrusted data in Azure Core shared client library for Python allows an authorized attacker to execute code over a network.

• CVE-2026-21441Jan 7, 2026
  affected < 2.82.0-r0fixed 2.82.0-r0

  urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression b

• CVE-2025-69277MedDec 31, 2025
  affected < 2.82.0-r0fixed 2.82.0-r0

  libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic g

• CVE-2025-66471Dec 5, 2025
  affected < 2.81.0-r1fixed 2.81.0-r1

  urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chu

• CVE-2025-66418Dec 5, 2025
  affected < 2.81.0-r1fixed 2.81.0-r1

  urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage a

• CVE-2025-54364MedAug 20, 2025
  affected < 2.79.0-r0fixed 2.79.0-r0

  Microsoft Knack 0.12.0 allows Regular expression Denial of Service (ReDoS) in the knack.introspection module. option_descriptions employs an inefficient regular expression pattern: "\s(:param)\s+(.+?)\s:(.*)" that is susceptible to catastrophic backtracking when processing crafte

• CVE-2025-54363MedAug 20, 2025
  affected < 2.79.0-r0fixed 2.79.0-r0

  Microsoft Knack 0.12.0 allows Regular expression Denial of Service (ReDoS) in the knack.introspection module. extract_full_summary_from_signature employs an inefficient regular expression pattern: "\s(:param)\s+(.+?)\s:(.*)" that is susceptible to catastrophic backtracking when p

• CVE-2025-50182Jun 19, 2025
  affected < 2.74.0-r3fixed 2.74.0-r3

  urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpReque

• CVE-2025-50181Jun 19, 2025
  affected < 2.74.0-r3fixed 2.74.0-r3

  urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An appl

• CVE-2024-47081MedJun 9, 2025
  affected < 2.74.0-r1fixed 2.74.0-r1

  Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc

• CVE-2024-12797MedFeb 11, 2025
  affected < 2.69.0-r1fixed 2.69.0-r1

  Issue summary: Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a server may fail to notice that the server was not authenticated, because handshakes don't abort as expected when the SSL_VERIFY_PEER verification mode is set. Impact summary: TLS and DTLS connections u

• CVE-2024-53861Nov 29, 2024
  affected < 2.67.0-r1fixed 2.67.0-r1

  pyjwt is a JSON Web Token implementation in Python. An incorrect string comparison is run for `iss` checking, resulting in `"acb"` being accepted for `"_abc_"`. This is a bug introduced in version 2.10.0: checking the "iss" claim changed from `isinstance(issuer, list)` to `isinst

• CVE-2024-6345HigJul 15, 2024
  affected < 2.62.0-r1fixed 2.62.0-r1

  A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are suscepti