lightspeed_services_for_ocp vulnerabilities
CVEs whose affected-version data names the lightspeed_services_for_ocp package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
19 CVEsRSS
CVE-2026-112915Medium· 5.5PoCfilelock: filelock: Denial of Service via crafted SQLite lock database (CVE-2026-112915)
A flaw was found in filelock. When utilizing the ReadWriteLock mechanism, the library attempts to open an SQLite database without properly restricting schema and query operations. A local attacker able to replace the lock database can prov…
CVE-2026-112940Medium· 6.3filelock: filelock: Arbitrary file overwrite via insecure database file reopening (CVE-2026-112940)
A flaw was found in filelock. When utilizing the ReadWriteLock mechanism, the component reopens SQLite database and auxiliary files by file path rather than retaining secure file descriptors. A local attacker with file renaming permissions…
CVE-2026-112893High· 7.5pillow: Pillow: Denial of Service via invalid pointer free during font rendering (CVE-2026-112893)
A flaw was found in Pillow. When rendering text using FreeType with an active stroke width, a failure during glyph loading can cause the library to free an uninitialized or stale memory pointer. A remote attacker could exploit this vulnera…
CVE-2026-112895High· 7.5pillow: pillow: Denial of service via crafted PDF during append operations (CVE-2026-112895)
A flaw was found in Pillow. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by supplying a specially crafted PDF document to an application performing PDF append operations. Because the PDF parser fails to pr…
CVE-2026-112894High· 7.5PoCpillow: pillow: Denial of Service via crafted multi-frame image conversion (CVE-2026-112894)
A flaw was found in Pillow. When converting multi-frame images into a multi-page PDF document, the library repeatedly scans previously assigned object identifiers, resulting in quadratic processing time. A remote attacker could exploit thi…
CVE-2026-112897High· 7.5pillow: pillow: Information disclosure via uninitialized buffer in TIFF decoding (CVE-2026-112897)
A flaw was found in Pillow. This flaw can lead to information disclosure when handling compressed Tagged Image File Format (TIFF) images. During incomplete decoding of image data, uninitialized buffer memory is not cleared before being con…
CVE-2026-112896High· 8.2PoCpillow: Pillow: Denial of Service via out-of-bounds read in TIFF encoder (CVE-2026-112896)
A flaw was found in Pillow. When saving or re-encoding a Tagged Image File Format (TIFF) image containing inconsistent color map metadata, the encoder reads beyond an allocated memory buffer. A remote attacker could exploit this vulnerabil…
CVE-2026-112390High· 7.5PoCpillow: Pillow: Denial of Service via infinite loop during crafted MIC image parsing (CVE-2026-112390)
A flaw was found in Pillow. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by supplying a specially crafted Microsoft Image Composer (MIC) file. When an application attempts to count or extract frames from t…
CVE-2026-112391High· 7.5pillow: Pillow: Denial of Service via unbounded recursion in PDF parser (CVE-2026-112391)
A flaw was found in Pillow. The PDF parser fails to limit recursion depth when reading nested PDF data structures such as arrays and dictionaries. A remote attacker could exploit this vulnerability by supplying a specially crafted, deeply …
CVE-2026-112400High· 7.5PoCpillow: pillow: Denial of Service via memory exhaustion from crafted GIF image (CVE-2026-112400)
A flaw was found in Pillow. When parsing a crafted GIF image, the library fails to discard rejected frame dimensions after encountering an excessively large image exception. If an application catches this exception and continues processing…
CVE-2026-112399High· 7.5pillow: pillow: Denial of service via crafted APNG image (CVE-2026-112399)
A flaw was found in Pillow. A remote attacker can trigger a Denial of Service (DoS) by providing a specially crafted Animated Portable Network Graphics (APNG) image. Pillow allocates memory for the full canvas dimensions before validating …
CVE-2026-112392High· 7.5PoCpillow: pillow: Denial of Service via zero-size images in rank filters (CVE-2026-112392)
A flaw was found in Pillow. An attacker can cause a Denial of Service (DoS) by submitting a zero-size image to an application that applies rank-based filters, such as median, minimum, or maximum filters. When attempting to expand the image…
CVE-2026-112404High· 8.2pillow: Pillow: Denial of Service via out-of-bounds read in TIFF decoding (CVE-2026-112404)
A flaw was found in Pillow. When processing Tagged Image File Format (TIFF) images, the library fails to properly validate buffer boundaries during tile and color decoding routines. A remote attacker could exploit this vulnerability by sup…
CVE-2026-112405High· 7.5PoCpillow: Pillow: Denial of Service via null pointer dereference in Image.merge() (CVE-2026-112405)
A flaw was found in Pillow. A remote attacker can cause a Denial of Service (DoS) by supplying a specially crafted image file to an application that processes images with the library. This issue occurs because the Image.merge() function fa…
CVE-2026-112406High· 7.5pillow: pillow: Denial of Service via infinite loop during PDF page rewriting (CVE-2026-112406)
A flaw was found in Pillow. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) through an infinite loop during PDF page processing. When rewriting pages, the parser fails to detect circular references in the pag…
CVE-2026-112402High· 7.5PoCpillow: pillow: Denial of service via double free during image transformation (CVE-2026-112402)
A flaw was found in Pillow. A remote attacker who can submit large image transformation operations under memory pressure can trigger improper error handling, leading to a double-free vulnerability (releasing the same memory block twice). T…
CVE-2026-112397High· 7.5PoCpillow: pillow: Denial of Service via out-of-bounds memory access on zero-width images (CVE-2026-112397)
A flaw was found in Pillow. A remote attacker can cause a Denial of Service (DoS) by supplying a specially crafted image with a width of zero to an application performing morphology operations. Because Pillow fails to validate zero-width i…
CVE-2026-111066High· 7.5aiohttp: aiohttp: Denial of Service via file descriptor exhaustion in multipart request processing (CVE-2026-111066)
A flaw was found in aiohttp. When processing multipart requests, the framework fails to properly limit the number of open file descriptors retained during request handling. An unauthenticated remote attacker can exploit this issue by sendi…
CVE-2026-111064High· 7.5aiohttp: aiohttp: Denial of Service via missing initial request timeout (CVE-2026-111064)
A flaw was found in aiohttp. The server does not enforce a timeout during the initial phase of a request before any data is received. A remote attacker can exploit this vulnerability by keeping idle connections open indefinitely, exhaustin…