Skip to content

fix: patch security vulnerabilities in dependencies (CTO-4384, CTO-45…#293

Merged
vedharish merged 1 commit intomainfrom
security/fix-dependency-vulnerabilities
Apr 13, 2026
Merged

fix: patch security vulnerabilities in dependencies (CTO-4384, CTO-45…#293
vedharish merged 1 commit intomainfrom
security/fix-dependency-vulnerabilities

Conversation

@sarve-shreyas
Copy link
Copy Markdown
Contributor

@sarve-shreyas sarve-shreyas commented Apr 13, 2026

  • cryptography 43.0.1 → 46.0.5 (CVE-2026-26007: subgroup attack on SECT curves)
  • cffi 1.15.1 → 2.0.0 (required by cryptography>=46.0.0 on Python 3.9+)
  • pyOpenSSL 24.2.1 → 26.0.0 (CVE-2026-27459: DTLS cookie callback buffer overflow)
  • PyJWT 2.9.0 → 2.12.0 (CVE-2026-32597: unknown crit header extensions accepted, CVSS 7.5)
  • pyasn1 0.4.8 → 0.6.3 (GHSA-jr27-m4p2-rc6r: DoS via unbounded recursion, CVSS 7.5)
  • pyasn1-modules 0.2.8 → 0.4.2 (required by pyasn1>=0.6.1 compatibility)

…51, CTO-4554, CTO-4557)

- cryptography 43.0.1 → 46.0.5 (CVE-2026-26007: subgroup attack on SECT curves)
- cffi 1.15.1 → 2.0.0 (required by cryptography>=46.0.0 on Python 3.9+)
- pyOpenSSL 24.2.1 → 26.0.0 (CVE-2026-27459: DTLS cookie callback buffer overflow)
- PyJWT 2.9.0 → 2.12.0 (CVE-2026-32597: unknown crit header extensions accepted, CVSS 7.5)
- pyasn1 0.4.8 → 0.6.3 (GHSA-jr27-m4p2-rc6r: DoS via unbounded recursion, CVSS 7.5)
- pyasn1-modules 0.2.8 → 0.4.2 (required by pyasn1>=0.6.1 compatibility)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@vedharish vedharish merged commit e9dd9b9 into main Apr 13, 2026
7 checks passed
@vedharish vedharish deleted the security/fix-dependency-vulnerabilities branch April 13, 2026 13:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants