aiohttp 3.14.1→3.14.3. CVE-2026-69244 (C-parser OOB heap read building error messages for malformed chunked responses — CLIENT side): this was the one reachable advisory — aiohttp is our async…
aiohttp 3.14.1→3.14.3 (fix landed in 3.14.2). CVE-2026-59881 (WS client decompresses RSV1 frames without negotiated permessage-deflate): we run no aiohttp WebSocket clients against untrusted…
aiohttp 3.14.1→3.14.3 (fix landed in 3.14.2). CVE-2026-69243 (server-side WS upgrade request smuggling): we run no aiohttp server component at all (FastAPI/uvicorn serve HTTP); server-side…
cryptography 49.0.0→50.0.0. CVE-2026-69247 (pkcs7_decrypt_* padding/timing oracle): no code path decrypts attacker-supplied PKCS7/EnvelopedData — cryptography is used via pyjwt[crypto] (static…
pyasn1 0.6.3→0.6.4. CVE-2026-59884 (unbounded long-form tag accumulation DoS): same exposure analysis as #581 — not attacker-reachable via our usage; fixed upstream in 0.6.4.
Verification:…
pyasn1 0.6.3→0.6.4. CVE-2026-59885 (quadratic OID-arc decode DoS): this repo never decodes untrusted ASN.1 — pyasn1 is transitive via google-auth/rsa TLS-auth flows against trusted Google/Azure…
pyasn1 0.6.3→0.6.4. CVE-2026-59886 (univ.Real big-exponent float conversion DoS): same exposure analysis as #581 — no untrusted ASN.1 decoding anywhere in the stack; transitive dep only. 0.6.4…
Fixed in 2c39737. Root cause: tests/pfs/test_pipe_gaps.py::TestLoadZipCarrierEdges::test_no_year_quarter_column patched pfs.pipe.pl.DataFrame — but pfs.pipe.pl IS the global polars module,…