Shuoz

**Name of the Vulnerable Software and Affected Versions** njs versions through 0.3.3 **Description** The issue is related to a heap-based buffer over-read in the nxt vsprintf function in nxt/nxt sprintf.c during error handling. This can occur when an `njs regexp literal` call leads to an `njs parser lexer error` call and then an `njs parser scope error` call. The vulnerability may allow a remote attacker to cause a denial of service. **Recommendations** For njs versions through 0.3.3, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Python versions prior to 3.7.1 **Description** The issue is related to an integer overflow via a large `LONG BINPUT` value that is mishandled during a "resize to twice the size" attempt in the ` pickle.c` module. This might cause memory exhaustion, but it is only relevant if the pickle format is used for serializing tens or hundreds of gigabytes of data. The issue can be exploited by a remote attacker to cause a denial of service. **Recommendations** For versions prior to 3.7.1, update to version 3.7.1 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the pickle format for serializing large amounts of data until a patch is applied. Restrict access to the ` pickle.c` module to minimize the risk of exploitation. Avoid using the `LONG BINPUT` value in the affected module until the issue is resolved.