Bekkaze

Name of the Vulnerable Software and Affected Versions AIOHTTP versions prior to 3.13.4 Description A response with an excessive number of multipart headers may be allowed to use more memory than intended, potentially leading to a denial-of-service condition. Multipart headers were not subject to the same size restrictions as normal headers, potentially allowing a larger amount of data to be loaded into memory than expected. Recommendations Update to version 3.13.4 or later.

Name of the Vulnerable Software and Affected Versions AIOHTTP versions prior to 3.13.4 Description Prior to version 3.13.4, AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python, read the entire multipart form field into memory before checking the `client max size` limit. This could allow an attacker to cause significant temporary memory allocation even if the request is ultimately rejected. Recommendations Update to version 3.13.4 or later.

**Name of the Vulnerable Software and Affected Versions** Poetry versions 1.4.0 through 2.3.2 **Description** Poetry, a Python dependency manager, contains a path traversal flaw. A crafted wheel file can include '..' paths that Poetry writes to disk without proper containment checks. This allows for arbitrary file write with the privileges of the Poetry process, potentially impacting users, CI/CD systems, and installations of malicious or compromised packages. The issue is reachable during normal installation flows from untrusted package artifacts. The vulnerability occurs because Poetry directly joins an untrusted wheel entry path without enforcing a resolve() or is relative to() style guard before writing. **Recommendations** Update to Poetry version 2.3.3 or later.

**Name of the Vulnerable Software and Affected Versions** Tornado versions prior to 6.5.5 **Description** Tornado is a Python web framework and asynchronous networking library. In versions prior to 6.5.5, the only limit on the number of parts in `multipart/form-data` requests is the `max body size` setting, which defaults to 100MB. Because parsing of these requests occurs synchronously on the main thread, this can lead to a denial-of-service condition due to the computational cost of processing very large multipart bodies with numerous parts. Tornado 6.5.5 introduces new limits on the size and complexity of multipart bodies, including a default limit of 100 parts per request, configurable through `tornado.httputil.ParseMultipartConfig`. It is also possible to disable `multipart/form-data` parsing entirely if it is not required. **Recommendations** Versions prior to 6.5.5 should be updated to version 6.5.5 or later.

**Name of the Vulnerable Software and Affected Versions** pypdf versions prior to 6.7.3 **Description** A crafted PDF file can cause excessive RAM usage, potentially leading to exhaustion. This occurs when accessing the `xfa` property of a reader or writer, specifically when the corresponding stream is compressed using `/FlateDecode`. **Recommendations** Update to version 6.7.3 or later. As a workaround, apply the patch manually.