Skip to content

Update hall_of_fame.md #111

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bhanugoudm041 wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Update hall_of_fame.md #111

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions hall_of_fame.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,10 @@ Python offers libraries that can safely parse Python code without executing it.

Certain malicious inputs can cause infinite recursion in Pygments `get_tokens_unprocessed()` function.

### Dos
[CVE-2026-49851](https://github.com/lepture/mistune/security/advisories/GHSA-qcq2-496w-v96p)
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Mistune is vulnerable to a CPU exhaustion DoS due to superlinear (approximately O(n²)) behavior in parse_link_text. When parsing Markdown containing many consecutive [ characters, parse_link_text repeatedly scans the input using a regex search inside a loop. Each iteration re-scans a large portion of the remaining string, resulting in quadratic-time behavior. An attacker-controlled Markdown input can therefore trigger excessive CPU usage with a very small payload. This vulnerability is fixed in 3.3.0.

## OSS-Fuzz Bugs

[These bugs](https://bugs.chromium.org/p/oss-fuzz/issues/list?groupby=Proj&colspec=ID%20Type%20Component%20Status%20Reported%20Owner%20Summary&q=%28adal%20OR%20aiohttp%20OR%20airflow%20OR%20ansible%20OR%20asn1crypto%20OR%20bleach%20OR%20bottleneck%20OR%20bs4%20OR%20charset_normalizer%20OR%20coveragepy%20OR%20croniter%20OR%20cryptography%20OR%20dask%20OR%20decorator%20OR%20digest%20OR%20ecdsa-python%20OR%20et-xmlfile%20OR%20filelock%20OR%20flask%20OR%20flask-restx%20OR%20ftfy%20OR%20g-api-auth-httplib2%20OR%20g-api-auth-library-python%20OR%20g-api-pubsub%20OR%20g-api-py-api-common-protos%20OR%20g-api-py-oauthlib%20OR%20g-api-python-client%20OR%20g-api-python-cloud-core%20OR%20g-api-python-firestore%20OR%20g-api-python-tasks%20OR%20g-api-resource-manager%20OR%20g-api-resumable-media-python%20OR%20g-api-secret-manager%20OR%20g-apis-py-api-core%20OR%20gc-iam%20OR%20gcloud-error-py%20OR%20g-cloud-logging-py%20OR%20gcp-python-cloud-storage%20OR%20glom%20OR%20g-py-bigquery%20OR%20g-py-crc32c%20OR%20grpc-py%20OR%20gunicorn%20OR%20idna%20OR%20iniconfig%20OR%20ipython%20OR%20jsmin%20OR%20jupyter_server%20OR%20kafka%20OR%20kiwisolver%20OR%20looker-sdk%20OR%20lxml%20OR%20mako%20OR%20matplotlib%20OR%20msal%20OR%20netaddr-py%20OR%20nfstream%20OR%20ntlm2%20OR%20numpy%20OR%20oauth2%20OR%20oauthlib%20OR%20olefile%20OR%20openpyxl%20OR%20oracle-py-cx%20OR%20orjson%20OR%20pandas%20OR%20paramiko%20OR%20pip%20OR%20protobuf-python%20OR%20psqlparse%20OR%20psycopg2%20OR%20pyasn1%20OR%20pycrypto%20OR%20pydateutil%20OR%20pygments%20OR%20pyjwt%20OR%20pyodbc%20OR%20pyparsing%20OR%20pyrsistent%20OR%20py-serde%20OR%20python-email-validator%20OR%20python-lz4%20OR%20python-rsa%20OR%20python-tabulate%20OR%20pytz%20OR%20pyxdg%20OR%20pyyaml%20OR%20redis-py%20OR%20requests%20OR%20retry%20OR%20scapy%20OR%20scikit-learn%20OR%20smart_open%20OR%20sqlalchemy%20OR%20sqlalchemy_jsonfield%20OR%20sqlalchemy-utils%20OR%20toml%20OR%20tqdm%20OR%20ujson%20OR%20underscore%20OR%20urllib3%20OR%20websocket-client%20OR%20xlrd%20OR%20xmltodict%20OR%20zipp%29&can=1) were found by OSS-Fuzz in Python projects via Atheris. (Access to some bugs may be restricted.)