JEDI-SEC | Security Research & Digital Defense

Category: Vulnerabilities & Advisories

  • Wireshark 5.0.0rc1 Release, (Sat, Oct 31st)

    Wireshark Release Candidate 5.0.0 was published: soon we can expect a new major version of Wireshark.

    Source: SANS Internet Storm Center · 2026-10-31

  • YARA-X 1.22.1 Release, (Sat, Oct 31st)

    YARA-X’s 1.22.1 is a bugfix version, it brings 2 bugfixes.

    Source: SANS Internet Storm Center · 2026-10-31

  • GHSA-8fmv-6rg5-5924: Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory

    • Severity: HIGH
    • CVE: CVE-2026-118761
    • Ecosystems: go, go
    • Packages: github.com/kubeflow/pipelines, github.com/kubeflow/pipelines

    ## Summary

    The Kubeflow Pipelines API server decompresses uploaded pipeline archives without adequately bounding expanded data in affected versions. A small ZIP or gzip-compressed tar archive can consume disproportionately large amounts of memory while the server locates or reads the pipeline file, potentially exhausting API-server resources and interrupting service.

    Multipart pipeline and pipeline-version upload processing decompresses the archive before namespace authorization, so a caller who can reach those endpoints does not need a successful pipeline-create authorization decision to trigger the issue. External authentication and network controls can restrict reachability. URL-import handlers authorize before fetching and decompressing a remote archive.

    The amount of expansion needed to exhaust memory depends on deployment resource limits and concurrent activity; no particular archive is guaranteed to crash every deployment.

    ## Remediation

    Upgrade the API server to **[Kubeflow Pipelines 2.18.0](https://github.com/kubeflow/pipelines/releases/tag/2.18.0)**. Versions through 2.17.3 are affected; the first affected release has not been established.

    [PR #14171](https://github.com/kubeflow/pipelines/pull/14171) bounds compressed input and extracted pipeline data. [PR #14186](https://github.com/kubeflow/pipelines/pull/14186) strengthens the total tar traversal budget, including metadata and skipped entries. The 2.18 release also includes configurable upload and specificat…

    Source: GitHub Security Advisories · 2026-10-30

  • GHSA-wg5q-x4j9-qm54: Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logs

    • Severity: HIGH
    • CVE: CVE-2026-118759
    • Ecosystems: go, go
    • Packages: github.com/kubeflow/pipelines, github.com/kubeflow/pipelines

    ## Summary

    The Kubeflow Pipelines API server’s `GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log` handler retrieves logs without authorizing the caller against the selected run. A caller who can reach the backend and knows a victim run ID and a suitable pod or node identifier can read live or archived logs using the API server’s permissions.

    For live logs, the vulnerable handler also accepts the supplied node ID as a pod name in the run’s namespace without verifying that the pod belongs to the run. Depending on the API server’s pod-log permissions, a known run ID can therefore permit reading the `main` container logs of an unrelated pod in that namespace. Logs may contain sensitive workload data or credentials.

    The affected handler does not authenticate the request itself. An external authentication gate or network policy can restrict reachability; public ingress exposure and unauthenticated enumeration of run IDs are not assumed.

    ## Remediation

    Upgrade the API server to **[Kubeflow Pipelines 2.18.0](https://github.com/kubeflow/pipelines/releases/tag/2.18.0)**. Versions through 2.17.3 are affected; the first affected release has not been established.

    [PR #13684](https://github.com/kubeflow/pipelines/pull/13684) authorizes the caller with the `readLog` verb before retrieving live or archived logs. For live logs, it also verifies that the pod’s `pipeline/runid` label matches the requested run. Custom Kubernetes roles must grant `readLog` on `runs` in the `pipelines.ku…

    Source: GitHub Security Advisories · 2026-10-30

  • GHSA-5849-834g-hvw5: pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search

    • Severity: HIGH
    • CVE: CVE-2026-119203
    • Ecosystems: pip
    • Packages: pypdf

    ### Impact

    An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires opening an incomplete file without a `trailer`.

    ### Patches

    This has been fixed in [pypdf==6.21.4](https://github.com/py-pdf/pypdf/releases/tag/6.21.4).

    ### Workarounds

    If you cannot upgrade yet, consider applying the changes from PR [#4289](https://github.com/py-pdf/pypdf/pull/4289).

    Source: GitHub Security Advisories · 2026-10-30

  • GHSA-cggf-277g-3q54: pypdf has possible large memory usage when parsing page tree

    • Severity: HIGH
    • CVE: CVE-2026-119204
    • Ecosystems: pip
    • Packages: pypdf

    ### Impact

    An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the page tree with many shared resources.

    ### Patches

    This has been fixed in [pypdf==6.21.4](https://github.com/py-pdf/pypdf/releases/tag/6.21.4).

    ### Workarounds

    If you cannot upgrade yet, consider applying the changes from PR [#4290](https://github.com/py-pdf/pypdf/pull/4290).

    Source: GitHub Security Advisories · 2026-10-30

  • GHSA-mfr5-77xh-9j7h: pypdf has possible infinite loop when cloning dictionaries

    • Severity: HIGH
    • CVE: CVE-2026-119205
    • Ecosystems: pip
    • Packages: pypdf

    ### Impact

    An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires cloning/duplicating a `DictionaryObject`.

    ### Patches

    This has been fixed in [pypdf==6.21.4](https://github.com/py-pdf/pypdf/releases/tag/6.21.4).

    ### Workarounds

    If you cannot upgrade yet, consider applying the changes from PR [#4288](https://github.com/py-pdf/pypdf/pull/4288).

    Source: GitHub Security Advisories · 2026-10-30

  • GHSA-4528-x5fx-h6hg: joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service

    • Severity: HIGH
    • CVE: CVE-2026-118772
    • Ecosystems: npm, npm, npm
    • Packages: joi, @hapi/joi, joi

    ### Summary

    `Joi.string().email({ multiple: true })` takes quadratic time to split a value that contains a long run of whitespace. One request with 100 KB of spaces blocks the Node.js event loop for several seconds, which causes a denial of service.

    ### Details

    When the `multiple` option is set, the `email` rule splits the value into addresses with a regular expression that removes whitespace on each side of the separator:

    “`js
    const regex = new RegExp(`\\s*[${options.separator ? escapeRegex(options.separator) : ‘,’}]\\s*`);
    // …
    const emails = options.multiple ? value.split(regex) : [value];
    “`

    `String.prototype.split` tries a match at each position of the value. At each position inside a whitespace run, the leading `\s*` reads the rest of the run, does not find a separator, and backtracks through all of it. A run of `n` whitespace characters without a separator therefore costs `n²` steps. This applies to the default separator and to all custom `separator` values.

    The fix lets the leading whitespace match start only at the beginning of a whitespace run, so the split is linear:

    “`js
    const regex = new RegExp(`(?:(?

    Source: GitHub Security Advisories · 2026-10-30

  • GHSA-8494-f6mr-cjpv: @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service

    • Severity: HIGH
    • CVE: CVE-2026-119202
    • Ecosystems: npm, npm
    • Packages: @hapi/content, content

    ### Summary

    `Content.disposition()` takes quadratic time when a `Content-Disposition` parameter contains a long token without `=`. One unauthenticated multipart request can block the Node.js event loop for several minutes.

    ### Details

    `Content.disposition()` reads the parameters with a global regular expression in `String.prototype.replace()`:

    “`js
    /([^\=\*\s]+)(\*)?\s*\=\s*(?:([^;’”\s]+\'[\w-]*\'[^;\s]+)|(?:\”([^”]*)\”)|([^;\s]*))/g
    “`

    The parameter name part `([^\=\*\s]+)` has no anchor. When a run of name characters has no `=` after it, the match attempt reads the full run and fails. The global scan then starts again at the next character and reads the remaining run again. The total time is proportional to the square of the run length.

    `@hapi/pez` calls `Content.disposition()` on the header of every part in a `multipart/form-data` body. In hapi, this occurs on each route with `payload.multipart` enabled, before the route handler and before any validation. The only size limit is the route `payload.maxBytes`, which is 1 MB by default.

    The fix adds an alternative that matches the full run of name characters when no `=` follows it. The scan then continues after the run, and the callback ignores this match. A match attempt that starts later in the same run always fails in the same way, so the parse result does not change. The parse time is now linear.

    “`js
    /([^\=\*\s]+)(\*)?\s*\=\s*(?:([^;’”\s]+\'[\w-]*\'[^;\s]+)|(?:\”([^”]*)\”)|([^;\s]*))|[^\=\*\s]+/g
    “`

    Every rel…

    Source: GitHub Security Advisories · 2026-10-30

  • GHSA-g3hv-75wg-m249: minimatch has potential denial of service via globparts amplification

    • Severity: MEDIUM
    • CVE: CVE-2026-118764
    • Ecosystems: npm
    • Packages: minimatch

    minimatch 10.2.6 contains an attacker-controlled pattern amplification in firstPhasePreProcess() when optimizationLevel >= 2.

    researcher: Reid Downing (b1nv0id)
    files:

    – src/index.ts: 690-770
    – src/index.ts: 780-796

    issue:
    input-controlled growth of globParts during first-phase preprocessing, followed by quadratic second-phase processing.

    the **/../ transformation clones a globparts entry and appends the clone to the same globparts array:
    “`
    parts.splice(gs, 1)
    const other = parts.slice(0)
    other[gs] = ‘**’
    globParts.push(other)
    “`
    this occurs inside a do…while (didSomething) fixpoint loop, allowing generated entries to be processed again.

    the expanded globparts array is subsequently processed by secondPhasePreProcess(), which performs pairwise comparisons:
    “`
    for (let i = 0; i < globParts.length – 1; i++) {
    for (let j = i + 1; j < globParts.length; j++) {
    this.partsMatch(…)
    }
    }
    “`
    an attacker who can supply a glob pattern can therefore cause additional pattern entries to be generated during preprocessing, followed by quadratic pairwise processing, resulting in excessive cpu and memory consumption.

    Source: GitHub Security Advisories · 2026-10-30