2026-10-29
Uncontrolled memory allocation in the meshio VTK Reader (meshio/_vtk_42.py) lets an attacker who supplies a crafted legacy VTK 4.2 file with a manipulated DIMENSIONS field drive excessive memory consumption, causing memory exhaustion or process termination in the parsing application. The flaw affects the nschloe meshio Python library through version 5.3.5 and is rated medium severity (CVSS 4.0 base 6.9; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N with availability-only impact), with no confidentiality or integrity effect and no code execution. Exploitation requires remote, unauthenticated delivery of an untrusted VTK file into a workflow that calls the VTK Reader; no public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and the project has not published a fix after being notified via a GitHub issue report.
Server-side request forgery in the dfm feedfinder2 Python library through version 0.0.4 lets remote attackers steer the find_feeds() helper into issuing HTTP requests to arbitrary URLs from the host application's network position, with low confidentiality impact and no write or availability effect. Reachability depends entirely on integration: only applications that pass attacker-influenceable URLs into find_feeds() are exposed, and where URLs are trusted the flaw is not reachable. No public exploit code or active exploitation is confirmed, the maintainer has not responded to the upstream issue report, and no vendor-released fixed version is available; priority is this_month rather than emergency.