redhat/python-pyyaml vulnerabilities

Latest redhat/python-pyyaml CVEs

Newest publication first · page 2 of 2

1. CVE-2026-112393 Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO

   Published 2026-10-19

   Critical·CVSS 9.2 EPSS 1.0%

   Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow has a heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving compressed TIFF data through libtiff to a target without a usable fileno(), such as BytesIO. The callback sizes its allocation fr...

2. CVE-2026-112391 Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()

   Published 2026-10-19

   Medium·CVSS 6.3 EPSS 0.58%

   Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow's PdfParser.get_value() can recurse without a limit while reading nested PDF objects. The parser follows attacker-controlled arrays and dictionaries when an existing PDF is opened for append. An attacker can prov...

3. CVE-2026-112390 Pillow: Infinite loop in MIC n_frames when the embedded TIFF

   Published 2026-10-19

   High·CVSS 8.2 EPSS 0.59%

   Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while determining the frame count of a MIC image. MicImageFile inherits TIFF frame traversal, but MicImageFile.tell reports the OLE stream index and its seek() resets TIFF frame state,...

4. CVE-2026-110859 GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch Name

   Published 2026-10-14

   High·CVSS 8.7 EPSS 0.39%

   GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option. Attackers can host a repository whose default branch is named --pathspec-from-file=<path>...

5. CVE-2026-110858 GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec

   Published 2026-10-14

   Critical·CVSS 9.2 EPSS 0.46%

   GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, not the positional refspec. Attackers controlling the refspec can supply --upload-pack=<command> to execute OS commands as...

6. CVE-2026-110857 GitPython before 3.2.0 Command Execution via ls_remote ext:: URLs

   Published 2026-10-14

   High·CVSS 7.7 EPSS 0.42%

   GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_remote forwards URLs without check_unsafe_protocols validation. Attackers can supply ext:: remote-helper URLs to execute commands when git permits the ext tr...

7. CVE-2026-110856 GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date

   Published 2026-10-14

   High·CVSS 8.7 EPSS 0.28%

   GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines...

8. CVE-2026-97229 Integer Overflow or Wraparound in GitLab

   Published 2026-10-13

   Critical·CVSS 10.0 EPSS 69.3% CISA KEV added 2026-10-29 Exploited in the wild Framework module PoC

   GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially craf...

9. CVE-2026-97689 urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory

   Published 2026-09-29

   High·CVSS 8.9 EPSS 0.34%

   urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trig...

10. CVE-2026-97687 urllib3: HTTPS proxy TLS configuration may be ignored or overridden

    Published 2026-09-29

    High·CVSS 7.6 EPSS 0.21%

    urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because ta...

11. CVE-2026-89078 Double Free in GitLab

    Published 2026-09-23

    Critical·CVSS 9.9 EPSS 0.52%

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to a double free iss...

12. CVE-2026-93577 Integer Overflow or Wraparound in GitLab

    Published 2026-09-23

    Critical·CVSS 9.9 EPSS 0.63%

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to an integer overfl...

13. CVE-2026-73619 GitPython before 3.1.57 Arbitrary File Read via Repo.archive()

    Published 2026-08-13

    High·CVSS 7.1 EPSS 0.41%

    GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive() to read arbitrary files from the filesystem and include them in the returned...

14. CVE-2026-15307 Server-side file-write and request forgery via spatial lookups

    Published 2026-08-04

    High·CVSS 8.7 EPSS 1.1%

    An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a Geometr...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.