Vulnerabilities - dcrb - PyPI | ReversingLabs Spectra Assure Community

List of known vulnerabilities affecting the software package and the components it embeds. Last refreshed on: 2026/09/26

All detected vulnerabilities are fixable

Run the update/upgrade command in your package manager to resolve the detected vulnerabilities

Hide triaged

CVSS Score

CVE Identifier

Summary

Tags

critical

9.8

CVE-2025-15467

OpenSSL is vulnerable to a stack buffer overflow when parsing CMS AuthEnvelopedData messages with maliciously crafted AEAD parameters.

Exploits Exist

Fix Available

critical

9.4

CVE-2025-4517

Python's tarfile module allows arbitrary filesystem writes outside the extraction directory during extraction with filter='data'.

Exploits Exist

Fix Available

critical

9.1

CVE-2026-34182

OpenSSL's CMS processing fails to validate cipher and tag length fields, allowing potential compromises.

Fix Available

critical

9.1

CVE-2026-75803

OpenSSL EVP_Cipher function may not verify AEAD tag for empty ciphertext in ChaCha20-Poly1305 and AES-OCB decryption.

Fix Available

high

8.8

CVE-2026-45447

OpenSSL may trigger a use-after-free during PKCS#7 signature verification when processing specially crafted signed messages.

Fix Available

high

8.1

CVE-2026-28387

DANE TLSA-based server authentication in uncommon client configurations may result in a use-after-free and/or double-free.

Fix Available

high

8.1

CVE-2026-7383

OpenSSL's ASN1_mbstring_ncopy() function is vulnerable to a heap buffer overflow due to a signed integer overflow when sizing the destination buffer for Unicode output.

Fix Available

high

7.8

CVE-2026-25210

libexpat's doContent function does not properly determine buffer size, leading to potential integer overflow.

Fix Available

high

7.5

CVE-2025-4138

Python's tarfile module allows symlink targets to point outside the destination directory, enabling modification of file metadata when extracting untrusted tar archives using TarFile.extractall() or TarFile.extract().

Exploits Exist

Fix Available

high

7.5

CVE-2025-4330

Fix Available

dcrb

SAFE Assessment

Compliance

Security

Threats

INCIDENTS FOR THIS VERSION:

Did you know...

dcrb

SAFE Assessment

Compliance

Security

Threats

IMPORTANT: All versions of this package have been maliciousLatest version with malware incident detected: over 1 year agoVersion: 4.0.0

INCIDENTS FOR THIS VERSION:

Did you know...