Monthly
Super-linear regular-expression complexity in CPython's csv.Sniffer.sniff() allows CPU exhaustion when applications pass attacker-controlled, unbounded CSV input to dialect detection. Any Python application that auto-detects CSV formats from user-supplied data without input length limits is potentially affected across all CPython versions predating the 3.16 fix. No public exploit is identified at time of analysis, and the CVSS 4.0 score of 2.4 reflects a low-severity, local-context vulnerability with limited availability impact.
PyTorch before 3.7.0 has a bernoulli_p decompose function in decompositions.py even though it lacks full consistency with the eager CPU implementation, negatively affecting nn.Dropout1d,. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Super-linear regular-expression complexity in CPython's csv.Sniffer.sniff() allows CPU exhaustion when applications pass attacker-controlled, unbounded CSV input to dialect detection. Any Python application that auto-detects CSV formats from user-supplied data without input length limits is potentially affected across all CPython versions predating the 3.16 fix. No public exploit is identified at time of analysis, and the CVSS 4.0 score of 2.4 reflects a low-severity, local-context vulnerability with limited availability impact.
PyTorch before 3.7.0 has a bernoulli_p decompose function in decompositions.py even though it lacks full consistency with the eager CPU implementation, negatively affecting nn.Dropout1d,. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.