{ "schemaVersion": 1, "generatedUtc": "2026-10-25T07:30:51.879487+00:00", "gate": "SCOPED_LOCAL_QUALIFICATION_COMPLETE_WITH_RECORDED_PROVIDER_QUERY_GAP", "scope": "Exact supported CPU BART/text/parser flow and fixed artifacts/library graph. No global package safety, trained-model quality, GPU, production cache/deployment or release claim.", "accounting": { "originalGroups": 109, "previouslyVersionRemediated": 65, "thisMissionFollowups": 44, "currentOriginalDispositions": { "Fixed and verified": 99, "Not affected, with evidence": 10 }, "newTestOnlyGroups": 1, "totalTrackedGroups": 110, "baselineProviderRecords": 249, "f17dba2ProviderRecords": 99, "newInstalledProviderRecords": 0, "installedDistributionCount": 63, "exactQueries": 126, "coverageErrors": [ { "package": "torch", "version": "2.13.0+cpu", "provider": "pypi", "httpStatus": 404, "error": "HTTPError" } ] }, "originalGroups": [ { "package": "certifi", "groupId": "GHSA-6q48-6c7w-9gw2", "identifiers": [ "GHSA-6q48-6c7w-9gw2", "PYSEC-2026-4320" ], "originalLockedVersion": "2026.7.22", "f17dba2LockedVersion": "2026.10.19", "installedQualifiedVersion": "2026.10.19", "dependencyRole": "security-constrained transitive dependency", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/0/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "2026.10.19" ], "vulnerableFunction": "certifi bundles emSign root CAs with compromised intermediate CA keys", "untrustedCallPathAssessment": "POTENTIALLY REACHABLE: Requests/Hugging Face TLS trust uses the CA bundle on model/dependency fetches; an on-path attacker plus compromised CA is required. No interception reproduced.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "filelock", "groupId": "CVE-2026-112940", "identifiers": [ "CVE-2026-112940", "GHSA-v4x8-3wr5-3wq8" ], "originalLockedVersion": "3.32.4", "f17dba2LockedVersion": "3.32.4", "installedQualifiedVersion": "4.2.1", "dependencyRole": "explicit cache security constraint (previously transitive)", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/1/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "4.2.1" ], "vulnerableFunction": "ReadWriteLock SQLite database reopen and POSIX symlink/side-file handling", "untrustedCallPathAssessment": "SQLite-backed ReadWriteLock is a different lock type from Hub WeakFileLock; installed Hub _fixes.py constructs FileLock then SoftFileLock. Remote document text cannot choose lock type or database filename. No ReadWriteLock application import/call.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/0" } }, { "package": "filelock", "groupId": "CVE-2026-112913", "identifiers": [ "CVE-2026-112913", "GHSA-9vhv-jxww-xfm5" ], "originalLockedVersion": "3.32.4", "f17dba2LockedVersion": "3.32.4", "installedQualifiedVersion": "4.2.1", "dependencyRole": "explicit cache security constraint (previously transitive)", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/2/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "4.2.1" ], "vulnerableFunction": "ReadWriteLock Windows SQLite -wal/-journal/-shm handling", "untrustedCallPathAssessment": "Requires local attacker-created SQLite side files in shared writable directory. Current cache helper uses native FileLock or SoftFileLock, not SQLite ReadWriteLock; parser has no filelock import.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/1" } }, { "package": "filelock", "groupId": "CVE-2026-112907", "identifiers": [ "CVE-2026-112907", "GHSA-567q-5qvw-pf92" ], "originalLockedVersion": "3.32.4", "f17dba2LockedVersion": "3.32.4", "installedQualifiedVersion": "4.2.1", "dependencyRole": "explicit cache security constraint (previously transitive)", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/3/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "4.2.1" ], "vulnerableFunction": "SoftFileLock marker open/stale breaking on Windows oplock", "untrustedCallPathAssessment": "Hub WeakFileLock fallback reaches SoftFileLock; filelock native lock can also fall back. Local user able to open cache marker can stall open beyond timeout. Cannot dismiss using HTTP request limits or parser child timeout.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/2" } }, { "package": "pillow", "groupId": "GHSA-4558-3h8r-v8xp", "identifiers": [ "CVE-2026-112394", "GHSA-4558-3h8r-v8xp" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/4/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size", "untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-8g5g-8vmr-9782", "identifiers": [ "CVE-2026-112403", "GHSA-8g5g-8vmr-9782" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/5/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow: Heap buffer overflow in ImagingJpegDecode", "untrustedCallPathAssessment": "POTENTIALLY REACHABLE: accepted PNG/JPEG bytes reach Image.open; image dimensions/frame validation occurs after opening. APNG pre-check allocation reproduced safely at64 pixels and repaired by13.0.0.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-rfgq-q3w2-pmv2", "identifiers": [ "CVE-2026-112898", "GHSA-rfgq-q3w2-pmv2" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/6/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow: Image.quantize() with empty palette leaks uninitialized stack memory", "untrustedCallPathAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-xvh5-g6gv-559v", "identifiers": [ "CVE-2026-112902", "GHSA-xvh5-g6gv-559v" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/7/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": " Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags", "untrustedCallPathAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-p4wg-p73j-c528", "identifiers": [ "CVE-2026-112895", "GHSA-p4wg-p73j-c528" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/8/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)", "untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-65qm-jvmh-6pqg", "identifiers": [ "CVE-2026-112400", "GHSA-65qm-jvmh-6pqg" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/9/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS", "untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-58r4-6rv3-gfh8", "identifiers": [ "CVE-2026-112397", "GHSA-58r4-6rv3-gfh8" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/10/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow: Out-of-bounds access in _imagingmorph on a zero-width image", "untrustedCallPathAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-pchr-8j38-3x4p", "identifiers": [ "CVE-2026-112896", "GHSA-pchr-8j38-3x4p" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/11/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read", "untrustedCallPathAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-q45j-58j2-45rg", "identifiers": [ "CVE-2026-112897", "GHSA-q45j-58j2-45rg" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/12/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips", "untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-462x-pgg6-55fp", "identifiers": [ "CVE-2026-112395", "GHSA-462x-pgg6-55fp" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/13/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)", "untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-c6hw-5grf-ff96", "identifiers": [ "CVE-2026-112404", "GHSA-c6hw-5grf-ff96" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/14/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels", "untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-vx6w-vv9f-6gvg", "identifiers": [ "CVE-2026-112899", "GHSA-vx6w-vv9f-6gvg" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/15/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit", "untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-7mwm-ghpf-9vrm", "identifiers": [ "CVE-2026-112402", "GHSA-7mwm-ghpf-9vrm" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/16/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform", "untrustedCallPathAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-w889-685w-c8fh", "identifiers": [ "CVE-2026-112900", "GHSA-w889-685w-c8fh" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/17/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow: Argument Injection in Ghostscript call, potentially leading into RCE", "untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-j4m9-6w36-pw47", "identifiers": [ "CVE-2026-112893", "GHSA-j4m9-6w36-pw47" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/18/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow: Invalid free in FreeType glyph rendering when a stroker is active", "untrustedCallPathAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-27h8-gf7j-v5hc", "identifiers": [ "CVE-2026-112392", "GHSA-27h8-gf7j-v5hc" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/19/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images", "untrustedCallPathAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-fc9g-5qg7-mf45", "identifiers": [ "CVE-2026-112891", "GHSA-fc9g-5qg7-mf45" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/20/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow: Quadratic GIF comment copying during save", "untrustedCallPathAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-cp9v-662q-vvx9", "identifiers": [ "CVE-2026-112405", "GHSA-cp9v-662q-vvx9" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/21/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0", "untrustedCallPathAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-22hg-r758-rrw9", "identifiers": [ "CVE-2026-112390", "GHSA-22hg-r758-rrw9" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/22/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow: Infinite loop in MIC n_frames when the embedded TIFF", "untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-74r2-7ff9-mjj2", "identifiers": [ "CVE-2026-112401", "GHSA-74r2-7ff9-mjj2" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/23/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()", "untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-xgh8-jp6q-p5x8", "identifiers": [ "CVE-2026-112901", "GHSA-xgh8-jp6q-p5x8" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/24/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes", "untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-254f-3936-288h", "identifiers": [ "CVE-2026-112391", "GHSA-254f-3936-288h" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/25/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()", "untrustedCallPathAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-jg86-v3jv-hrpm", "identifiers": [ "CVE-2026-112894", "GHSA-jg86-v3jv-hrpm" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/26/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)", "untrustedCallPathAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-f2g6-542v-9j58", "identifiers": [ "CVE-2026-112406", "GHSA-f2g6-542v-9j58" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/27/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle", "untrustedCallPathAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-5xm2-6676-qcp9", "identifiers": [ "CVE-2026-112399", "GHSA-5xm2-6676-qcp9" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/28/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow: APNG background disposal allocates full canvas before decompression bomb check", "untrustedCallPathAssessment": "POTENTIALLY REACHABLE: accepted PNG/JPEG bytes reach Image.open; image dimensions/frame validation occurs after opening. APNG pre-check allocation reproduced safely at64 pixels and repaired by13.0.0.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-gg2r-wvfm-q9rx", "identifiers": [ "CVE-2026-112892", "GHSA-gg2r-wvfm-q9rx" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/29/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow: MSP RLE decoder expands a tiny file into unbounded memory", "untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-332p-7hrc-92wf", "identifiers": [ "CVE-2026-112393", "GHSA-332p-7hrc-92wf" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/30/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO", "untrustedCallPathAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-4rr5-89j8-mwwm", "identifiers": [ "CVE-2026-112396", "GHSA-4rr5-89j8-mwwm" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/31/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer", "untrustedCallPathAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-24rc-8hj2-v98c", "identifiers": [ "CVE-2026-96638", "GHSA-24rc-8hj2-v98c" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/32/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode", "untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-4rm8-3hmm-39fg", "identifiers": [ "CVE-2026-96641", "GHSA-4rm8-3hmm-39fg" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/33/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise", "untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-mrfp-p49p-3hf2", "identifiers": [ "CVE-2026-96640", "GHSA-mrfp-p49p-3hf2" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/34/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion", "untrustedCallPathAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-3j72-p6qg-6xp7", "identifiers": [ "CVE-2026-96642", "GHSA-3j72-p6qg-6xp7" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/35/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow: TarIO negative size field causes infinite CPU-spin loop", "untrustedCallPathAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-v9pv-5gc8-w2m6", "identifiers": [ "CVE-2026-96639", "GHSA-v9pv-5gc8-w2m6" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/36/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow multi-frame loaders can reuse stale native image storage after mode transitions", "untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-g4qv-2jxx-769h", "identifiers": [ "CVE-2026-96643", "GHSA-g4qv-2jxx-769h" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/37/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time", "untrustedCallPathAssessment": "POTENTIALLY REACHABLE: accepted PNG/JPEG bytes reach Image.open; image dimensions/frame validation occurs after opening. APNG pre-check allocation reproduced safely at64 pixels and repaired by13.0.0.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-g842-9rc4-69pw", "identifiers": [ "CVE-2026-96637", "GHSA-g842-9rc4-69pw" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/38/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS", "untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-9v9v-9qvf-h2hj", "identifiers": [ "CVE-2026-96644", "GHSA-9v9v-9qvf-h2hj" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/39/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)", "untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-g7cr-3p24-7wf7", "identifiers": [ "CVE-2026-96778", "GHSA-g7cr-3p24-7wf7" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/40/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer", "untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-p8hx-v2p6-rp84", "identifiers": [ "CVE-2026-96636", "GHSA-p8hx-v2p6-rp84" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/41/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)", "untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-78g4-xqwv-q3g8", "identifiers": [ "GHSA-78g4-xqwv-q3g8" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/42/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()", "untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-654x-cwwv-5j9c", "identifiers": [ "CVE-2026-114501", "GHSA-654x-cwwv-5j9c" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/43/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1", "untrustedCallPathAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pillow", "groupId": "GHSA-5x8w-8jj5-q52h", "identifiers": [ "CVE-2026-112398", "GHSA-5x8w-8jj5-q52h" ], "originalLockedVersion": "12.3.0", "f17dba2LockedVersion": "13.0.0", "installedQualifiedVersion": "13.0.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/44/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "13.0.0" ], "vulnerableFunction": "Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution", "untrustedCallPathAssessment": "POTENTIALLY REACHABLE: accepted PNG/JPEG bytes reach Image.open; image dimensions/frame validation occurs after opening. APNG pre-check allocation reproduced safely at64 pixels and repaired by13.0.0.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pypdf", "groupId": "GHSA-5jq2-8x83-x246", "identifiers": [ "CVE-2026-102994", "GHSA-5jq2-8x83-x246", "PYSEC-2026-4153" ], "originalLockedVersion": "6.16.2", "f17dba2LockedVersion": "6.21.2", "installedQualifiedVersion": "6.21.2", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/45/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "6.18.0" ], "vulnerableFunction": "pypdf: Possible long runtimes/large memory usage when parsing indirect objects", "untrustedCallPathAssessment": "POTENTIALLY REACHABLE: untrusted PDF bytes reach PdfReader construction, page enumeration and extract_text before/within application page/text limits. Existing child resource limits reduce impact but do not patch parser complexity.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pypdf", "groupId": "GHSA-fp3h-c4fm-7vvf", "identifiers": [ "CVE-2026-102995", "GHSA-fp3h-c4fm-7vvf", "PYSEC-2026-4154" ], "originalLockedVersion": "6.16.2", "f17dba2LockedVersion": "6.21.2", "installedQualifiedVersion": "6.21.2", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/46/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "6.18.1" ], "vulnerableFunction": "pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)", "untrustedCallPathAssessment": "POTENTIALLY REACHABLE: untrusted PDF bytes reach PdfReader construction, page enumeration and extract_text before/within application page/text limits. Existing child resource limits reduce impact but do not patch parser complexity.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pypdf", "groupId": "GHSA-w23x-9jrw-r45c", "identifiers": [ "CVE-2026-103000", "GHSA-w23x-9jrw-r45c", "PYSEC-2026-4160" ], "originalLockedVersion": "6.16.2", "f17dba2LockedVersion": "6.21.2", "installedQualifiedVersion": "6.21.2", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/47/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "6.19.0" ], "vulnerableFunction": "pypdf: Possible large memory usage when retrieving alphabetical page labels", "untrustedCallPathAssessment": "NO MATCHING HIGH-LEVEL CALL FOUND: extraction reads PdfReader/pages and extract_text, not writer outline removal, field/appearance, labels, embedded-file extraction or images. Shared low-level parsing dependencies remain possible.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pypdf", "groupId": "GHSA-v247-6f48-mgcj", "identifiers": [ "CVE-2026-102999", "GHSA-v247-6f48-mgcj", "PYSEC-2026-4159" ], "originalLockedVersion": "6.16.2", "f17dba2LockedVersion": "6.21.2", "installedQualifiedVersion": "6.21.2", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/48/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "6.19.0" ], "vulnerableFunction": "pypdf: Possible long runtimes with large amount of embedded files", "untrustedCallPathAssessment": "NO MATCHING HIGH-LEVEL CALL FOUND: extraction reads PdfReader/pages and extract_text, not writer outline removal, field/appearance, labels, embedded-file extraction or images. Shared low-level parsing dependencies remain possible.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pypdf", "groupId": "GHSA-jw7q-gvrg-4vj3", "identifiers": [ "CVE-2026-102997", "GHSA-jw7q-gvrg-4vj3", "PYSEC-2026-4156" ], "originalLockedVersion": "6.16.2", "f17dba2LockedVersion": "6.21.2", "installedQualifiedVersion": "6.21.2", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/49/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "6.18.1" ], "vulnerableFunction": "pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)", "untrustedCallPathAssessment": "POTENTIALLY REACHABLE: untrusted PDF bytes reach PdfReader construction, page enumeration and extract_text before/within application page/text limits. Existing child resource limits reduce impact but do not patch parser complexity.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pypdf", "groupId": "GHSA-g9cg-prrw-2r8q", "identifiers": [ "CVE-2026-102996", "GHSA-g9cg-prrw-2r8q", "PYSEC-2026-4155" ], "originalLockedVersion": "6.16.2", "f17dba2LockedVersion": "6.21.2", "installedQualifiedVersion": "6.21.2", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/50/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "6.18.1" ], "vulnerableFunction": "pypdf: Possible large memory usage when parsing font data", "untrustedCallPathAssessment": "POTENTIALLY REACHABLE: untrusted PDF bytes reach PdfReader construction, page enumeration and extract_text before/within application page/text limits. Existing child resource limits reduce impact but do not patch parser complexity.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pypdf", "groupId": "GHSA-qv6h-rv94-w285", "identifiers": [ "CVE-2026-102993", "GHSA-qv6h-rv94-w285", "PYSEC-2026-4158" ], "originalLockedVersion": "6.16.2", "f17dba2LockedVersion": "6.21.2", "installedQualifiedVersion": "6.21.2", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/51/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "6.17.0" ], "vulnerableFunction": "pypdf: Possible large memory usage when retrieving Roman page labels", "untrustedCallPathAssessment": "NO MATCHING HIGH-LEVEL CALL FOUND: extraction reads PdfReader/pages and extract_text, not writer outline removal, field/appearance, labels, embedded-file extraction or images. Shared low-level parsing dependencies remain possible.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pypdf", "groupId": "GHSA-php9-fj8v-98fj", "identifiers": [ "CVE-2026-102998", "GHSA-php9-fj8v-98fj", "PYSEC-2026-4157" ], "originalLockedVersion": "6.16.2", "f17dba2LockedVersion": "6.21.2", "installedQualifiedVersion": "6.21.2", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/52/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "6.19.0" ], "vulnerableFunction": "pypdf: Possible long runtimes when generating appearance streams", "untrustedCallPathAssessment": "NO MATCHING HIGH-LEVEL CALL FOUND: extraction reads PdfReader/pages and extract_text, not writer outline removal, field/appearance, labels, embedded-file extraction or images. Shared low-level parsing dependencies remain possible.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pypdf", "groupId": "GHSA-qfv9-64jg-mh7p", "identifiers": [ "CVE-2026-113792", "GHSA-qfv9-64jg-mh7p" ], "originalLockedVersion": "6.16.2", "f17dba2LockedVersion": "6.21.2", "installedQualifiedVersion": "6.21.2", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/53/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "6.20.1" ], "vulnerableFunction": "pypdf: Possible infinite loop in PdfWriter.find_outline_item", "untrustedCallPathAssessment": "NO MATCHING HIGH-LEVEL CALL FOUND: extraction reads PdfReader/pages and extract_text, not writer outline removal, field/appearance, labels, embedded-file extraction or images. Shared low-level parsing dependencies remain possible.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pypdf", "groupId": "GHSA-7mh2-4gg2-979f", "identifiers": [ "CVE-2026-113795", "GHSA-7mh2-4gg2-979f" ], "originalLockedVersion": "6.16.2", "f17dba2LockedVersion": "6.21.2", "installedQualifiedVersion": "6.21.2", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/54/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "6.20.0" ], "vulnerableFunction": "pypdf: Possible large memory usage for streams with multiple filters", "untrustedCallPathAssessment": "POTENTIALLY REACHABLE: untrusted PDF bytes reach PdfReader construction, page enumeration and extract_text before/within application page/text limits. Existing child resource limits reduce impact but do not patch parser complexity.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pypdf", "groupId": "GHSA-9mx8-4j7g-633p", "identifiers": [ "CVE-2026-113793", "GHSA-9mx8-4j7g-633p" ], "originalLockedVersion": "6.16.2", "f17dba2LockedVersion": "6.21.2", "installedQualifiedVersion": "6.21.2", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/55/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "6.20.1" ], "vulnerableFunction": "pypdf: Possible infinite loop when removing tree items", "untrustedCallPathAssessment": "NO MATCHING HIGH-LEVEL CALL FOUND: extraction reads PdfReader/pages and extract_text, not writer outline removal, field/appearance, labels, embedded-file extraction or images. Shared low-level parsing dependencies remain possible.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pypdf", "groupId": "GHSA-39mj-jf6j-2qj3", "identifiers": [ "CVE-2026-113794", "GHSA-39mj-jf6j-2qj3" ], "originalLockedVersion": "6.16.2", "f17dba2LockedVersion": "6.21.2", "installedQualifiedVersion": "6.21.2", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/56/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "6.20.0" ], "vulnerableFunction": "pypdf: Possible infinite loop when hitting EOF in standard xref table", "untrustedCallPathAssessment": "POTENTIALLY REACHABLE: untrusted PDF bytes reach PdfReader construction, page enumeration and extract_text before/within application page/text limits. Existing child resource limits reduce impact but do not patch parser complexity.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pypdf", "groupId": "GHSA-5hx5-vpf9-5wcv", "identifiers": [ "CVE-2026-113786", "GHSA-5hx5-vpf9-5wcv" ], "originalLockedVersion": "6.16.2", "f17dba2LockedVersion": "6.21.2", "installedQualifiedVersion": "6.21.2", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/57/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "6.21.1" ], "vulnerableFunction": "pypdf: Unvalidated JPEG image data loading", "untrustedCallPathAssessment": "NO MATCHING HIGH-LEVEL CALL FOUND: extraction reads PdfReader/pages and extract_text, not writer outline removal, field/appearance, labels, embedded-file extraction or images. Shared low-level parsing dependencies remain possible.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pypdf", "groupId": "GHSA-cgf9-327m-v77c", "identifiers": [ "CVE-2026-113791", "GHSA-cgf9-327m-v77c" ], "originalLockedVersion": "6.16.2", "f17dba2LockedVersion": "6.21.2", "installedQualifiedVersion": "6.21.2", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/58/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "6.21.0" ], "vulnerableFunction": "pypdf: Possible large memory usage when parsing content streams", "untrustedCallPathAssessment": "POTENTIALLY REACHABLE: untrusted PDF bytes reach PdfReader construction, page enumeration and extract_text before/within application page/text limits. Existing child resource limits reduce impact but do not patch parser complexity.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pypdf", "groupId": "GHSA-f54x-cmq8-qg57", "identifiers": [ "CVE-2026-113790", "GHSA-f54x-cmq8-qg57" ], "originalLockedVersion": "6.16.2", "f17dba2LockedVersion": "6.21.2", "installedQualifiedVersion": "6.21.2", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/59/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "6.21.0" ], "vulnerableFunction": "pypdf: Possible large memory usage when parsing arrays and dictionaries", "untrustedCallPathAssessment": "POTENTIALLY REACHABLE: untrusted PDF bytes reach PdfReader construction, page enumeration and extract_text before/within application page/text limits. Existing child resource limits reduce impact but do not patch parser complexity.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pypdf", "groupId": "GHSA-6vvc-x485-93v7", "identifiers": [ "CVE-2026-113789", "GHSA-6vvc-x485-93v7" ], "originalLockedVersion": "6.16.2", "f17dba2LockedVersion": "6.21.2", "installedQualifiedVersion": "6.21.2", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/60/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "6.21.0" ], "vulnerableFunction": "pypdf: Possible long runtimes/large memory usage when retrieving form fields", "untrustedCallPathAssessment": "NO MATCHING HIGH-LEVEL CALL FOUND: extraction reads PdfReader/pages and extract_text, not writer outline removal, field/appearance, labels, embedded-file extraction or images. Shared low-level parsing dependencies remain possible.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pypdf", "groupId": "GHSA-6c7f-9265-g8fw", "identifiers": [ "CVE-2026-115572", "GHSA-6c7f-9265-g8fw" ], "originalLockedVersion": "6.16.2", "f17dba2LockedVersion": "6.21.2", "installedQualifiedVersion": "6.21.2", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/61/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "6.21.2" ], "vulnerableFunction": "pypdf: Possible long runtimes for repeated references to the same missing object", "untrustedCallPathAssessment": "POTENTIALLY REACHABLE: untrusted PDF bytes reach PdfReader construction, page enumeration and extract_text before/within application page/text limits. Existing child resource limits reduce impact but do not patch parser complexity.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pypdf", "groupId": "GHSA-jr96-gvgh-j3r4", "identifiers": [ "CVE-2026-115585", "GHSA-jr96-gvgh-j3r4" ], "originalLockedVersion": "6.16.2", "f17dba2LockedVersion": "6.21.2", "installedQualifiedVersion": "6.21.2", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/62/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "6.21.2" ], "vulnerableFunction": "pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)", "untrustedCallPathAssessment": "POTENTIALLY REACHABLE: untrusted PDF bytes reach PdfReader construction, page enumeration and extract_text before/within application page/text limits. Existing child resource limits reduce impact but do not patch parser complexity.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "pypdf", "groupId": "GHSA-gmh7-3g9r-mjh5", "identifiers": [ "CVE-2026-115580", "GHSA-gmh7-3g9r-mjh5" ], "originalLockedVersion": "6.16.2", "f17dba2LockedVersion": "6.21.2", "installedQualifiedVersion": "6.21.2", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/63/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "6.21.2" ], "vulnerableFunction": "pypdf: Possible long runtimes for large xref table header limits", "untrustedCallPathAssessment": "POTENTIALLY REACHABLE: untrusted PDF bytes reach PdfReader construction, page enumeration and extract_text before/within application page/text limits. Existing child resource limits reduce impact but do not patch parser complexity.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "setuptools", "groupId": "GHSA-xmj3-9gf7-h52w", "identifiers": [ "GHSA-xmj3-9gf7-h52w" ], "originalLockedVersion": "84.0.0", "f17dba2LockedVersion": "84.1.0", "installedQualifiedVersion": "84.1.0", "dependencyRole": "security-constrained transitive dependency", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/64/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "84.1.0" ], "vulnerableFunction": "setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description", "untrustedCallPathAssessment": "BUILD/INSTALL PATH: no runtime install or legacy namespace-wheel processing call is exposed by Jobjakt. Installation supply chain remains relevant, especially on Windows.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "torch", "groupId": "CVE-2025-3001", "identifiers": [ "BIT-pytorch-2025-3001", "CVE-2025-3001", "GHSA-qfhq-4f3w-5fph", "PYSEC-2025-195" ], "originalLockedVersion": "2.6.0+cpu", "f17dba2LockedVersion": "2.6.0+cpu", "installedQualifiedVersion": "2.13.0+cpu", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/65/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "2.10.0" ], "vulnerableFunction": "torch.lstm_cell / native LSTM cell tensor validation", "untrustedCallPathAssessment": "Installed LSTMCell forwards to _VF.lstm_cell. BART decoder uses attention, linear and layer norms, not recurrent LSTMCell. Request text becomes bounded token IDs, not arbitrary tensor dimensions or Python graphs.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/3" } }, { "package": "torch", "groupId": "CVE-2025-3000", "identifiers": [ "BIT-pytorch-2025-3000", "CVE-2025-3000", "GHSA-rrmf-rvhw-rf47", "PYSEC-2025-194" ], "originalLockedVersion": "2.6.0+cpu", "f17dba2LockedVersion": "2.6.0+cpu", "installedQualifiedVersion": "2.13.0+cpu", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/66/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "2.13.0" ], "vulnerableFunction": "torch.jit.script compilation", "untrustedCallPathAssessment": "Application does not call script or torch.compile; model loader creates Python BART class and generate uses eager no_grad. Text cannot submit Python source or choose a compiled graph. Third-party optional branches/native internals are not runtime qualified.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/4" } }, { "package": "torch", "groupId": "CVE-2025-2999", "identifiers": [ "BIT-pytorch-2025-2999", "CVE-2025-2999", "GHSA-vgrw-7cvw-pwgx", "PYSEC-2025-193" ], "originalLockedVersion": "2.6.0+cpu", "f17dba2LockedVersion": "2.6.0+cpu", "installedQualifiedVersion": "2.13.0+cpu", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/67/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "2.9.1" ], "vulnerableFunction": "torch.nn.utils.rnn.unpack_sequence", "untrustedCallPathAssessment": "BART accepts padded input_ids plus attention_mask and does not construct PackedSequence or unpack_sequence; malicious tensor metadata is not an HTTP input.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/5" } }, { "package": "torch", "groupId": "CVE-2025-2953", "identifiers": [ "BIT-pytorch-2025-2953", "CVE-2025-2953", "GHSA-3749-ghw9-m3mg", "PYSEC-2025-191" ], "originalLockedVersion": "2.6.0+cpu", "f17dba2LockedVersion": "2.6.0+cpu", "installedQualifiedVersion": "2.13.0+cpu", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/68/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "2.7.1-rc1" ], "vulnerableFunction": "torch.mkldnn_max_pool2d", "untrustedCallPathAssessment": "Vendor names mkldnn_max_pool2d. BART attention/linear architecture contains no image/max-pooling layer. Raw image bytes go to separate OCR parser; they are not passed as model tensor graphs.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/6" } }, { "package": "torch", "groupId": "CVE-2025-46148", "identifiers": [ "BIT-pytorch-2025-46148", "CVE-2025-46148", "PYSEC-2025-198" ], "originalLockedVersion": "2.6.0+cpu", "f17dba2LockedVersion": "2.6.0+cpu", "installedQualifiedVersion": "2.13.0+cpu", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/69/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "2.7.0" ], "vulnerableFunction": "nn.PairwiseDistance(p=2), eager/Inductor inconsistent result", "untrustedCallPathAssessment": "Installed PairwiseDistance wrapper exists; BART/generate path does not compute pairwise distances. Vendor issue describes numeric correctness, not a demonstrated remotely supplied model graph.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/7" } }, { "package": "torch", "groupId": "CVE-2025-46149", "identifiers": [ "BIT-pytorch-2025-46149", "CVE-2025-46149", "PYSEC-2025-199" ], "originalLockedVersion": "2.6.0+cpu", "f17dba2LockedVersion": "2.6.0+cpu", "installedQualifiedVersion": "2.13.0+cpu", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/70/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "2.7.0" ], "vulnerableFunction": "nn.Fold Inductor code generation assertion", "untrustedCallPathAssessment": "Fold constructs image blocks; BART text inference has no Fold and does not call torch.compile or Inductor.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/8" } }, { "package": "torch", "groupId": "CVE-2025-46150", "identifiers": [ "BIT-pytorch-2025-46150", "CVE-2025-46150", "PYSEC-2025-200" ], "originalLockedVersion": "2.6.0+cpu", "f17dba2LockedVersion": "2.6.0+cpu", "installedQualifiedVersion": "2.13.0+cpu", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/71/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "2.7.0" ], "vulnerableFunction": "FractionalMaxPool2d torch.compile correctness", "untrustedCallPathAssessment": "No FractionalMaxPool2d in selected BART layers; application performs eager eval generation without compilation.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/9" } }, { "package": "torch", "groupId": "CVE-2025-46152", "identifiers": [ "BIT-pytorch-2025-46152", "CVE-2025-46152", "PYSEC-2025-201" ], "originalLockedVersion": "2.6.0+cpu", "f17dba2LockedVersion": "2.6.0+cpu", "installedQualifiedVersion": "2.13.0+cpu", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/72/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "2.7.0" ], "vulnerableFunction": "bitwise_right_shift boundary shift in Inductor", "untrustedCallPathAssessment": "Vendor issue concerns compiled out-of-range shift count. Application accepts text, no arbitrary shift operand/compiler graph; selected BART layer source has no bitwise_right_shift.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/10" } }, { "package": "torch", "groupId": "CVE-2025-46153", "identifiers": [ "BIT-pytorch-2025-46153", "CVE-2025-46153", "PYSEC-2025-202" ], "originalLockedVersion": "2.6.0+cpu", "f17dba2LockedVersion": "2.6.0+cpu", "installedQualifiedVersion": "2.13.0+cpu", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/73/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "2.7.0" ], "vulnerableFunction": "bernoulli_p decomposition, fallback_random, Dropout1d/2d/3d", "untrustedCallPathAssessment": "BART contains functional.dropout, so merely saying no dropout would be false. model.eval() disables training dropout; app does not enable Inductor fallback_random nor spatial Dropout1d/2d/3d.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/11" } }, { "package": "torch", "groupId": "CVE-2025-55551", "identifiers": [ "BIT-pytorch-2025-55551", "CVE-2025-55551", "PYSEC-2025-203" ], "originalLockedVersion": "2.6.0+cpu", "f17dba2LockedVersion": "2.6.0+cpu", "installedQualifiedVersion": "2.13.0+cpu", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/74/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "2.9.0" ], "vulnerableFunction": "torch.linalg.lu with slicing in Inductor/AOT", "untrustedCallPathAssessment": "Vendor issue contrasts compiled/AOT and eager LU slicing. BART attention does not perform LU decomposition and application has no compile/AOT route.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/12" } }, { "package": "torch", "groupId": "CVE-2025-55552", "identifiers": [ "BIT-pytorch-2025-55552", "CVE-2025-55552", "PYSEC-2025-204" ], "originalLockedVersion": "2.6.0+cpu", "f17dba2LockedVersion": "2.6.0+cpu", "installedQualifiedVersion": "2.13.0+cpu", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/75/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "2.9.0" ], "vulnerableFunction": "torch.rot90 and randn_like compiled graph", "untrustedCallPathAssessment": "BART does not rotate image tensors or compile rot90/randn_like graphs. Text token IDs cannot select these APIs.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/13" } }, { "package": "torch", "groupId": "CVE-2025-55553", "identifiers": [ "BIT-pytorch-2025-55553", "CVE-2025-55553", "PYSEC-2025-205" ], "originalLockedVersion": "2.6.0+cpu", "f17dba2LockedVersion": "2.6.0+cpu", "installedQualifiedVersion": "2.13.0+cpu", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/76/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "2.7.1" ], "vulnerableFunction": "proxy_tensor.py tracing .random_ syntax error", "untrustedCallPathAssessment": "Proxy tensor tracing/compiler route, not ordinary BART no_grad eager generation. Application exposes no graph tracing or caller-defined modules.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/14" } }, { "package": "torch", "groupId": "CVE-2025-55554", "identifiers": [ "BIT-pytorch-2025-55554", "CVE-2025-55554", "PYSEC-2025-206" ], "originalLockedVersion": "2.6.0+cpu", "f17dba2LockedVersion": "2.6.0+cpu", "installedQualifiedVersion": "2.13.0+cpu", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/77/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "2.9.0" ], "vulnerableFunction": "torch.nan_to_num then long edge-case numeric conversion", "untrustedCallPathAssessment": "Selected BART source has no nan_to_num().long() chain. Vendor issue remains open despite provider2.9.0 fix event; report does not infer closed/resolved from version metadata.", "disposition": "Not affected, with evidence", "justification": "Current-source and real-CPU BART boundary assessment excludes the named vulnerable operation from the supported fixed-model text/parser flow. This is not a global upstream fix claim.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "Published severity retained for other/library uses; not an exposed path in the qualified service scope. Reassess on any scope falsifier.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/15" }, "currentSourceReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-current-scope.json", "jsonPointer": "/advisories/0" }, "upstreamState": "No verified general fix for nine named alternate-loader/conversion groups; numeric55554 has conflicting/open vendor evidence. Original source records retained. Scoped non-applicability does not close upstream issues.", "scopeFalsifiers": [ "Any nan_to_num result cast to int64/long introduced into BART forward, generation/logits helpers or caller/custom processor.", "CPU graph compilation explicitly enabled, different native kernel path/quantization/backend/device used, or user tensor/model/processor graph input added.", "Evidence that the named upstream issue is reached by the exact preserved BART/logits/token-ID operations despite the absent chain." ] }, { "package": "torch", "groupId": "CVE-2025-55557", "identifiers": [ "BIT-pytorch-2025-55557", "CVE-2025-55557", "PYSEC-2025-207" ], "originalLockedVersion": "2.6.0+cpu", "f17dba2LockedVersion": "2.6.0+cpu", "installedQualifiedVersion": "2.13.0+cpu", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/78/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "2.7.1" ], "vulnerableFunction": "Inductor compiled cummin Triton NameError", "untrustedCallPathAssessment": "Selected BART attention and beam generation do not call compiled cummin; eager app supplies token text and uses CPU baseline rather than authored Triton kernels.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/16" } }, { "package": "torch", "groupId": "CVE-2025-55558", "identifiers": [ "BIT-pytorch-2025-55558", "CVE-2025-55558", "PYSEC-2025-208" ], "originalLockedVersion": "2.6.0+cpu", "f17dba2LockedVersion": "2.6.0+cpu", "installedQualifiedVersion": "2.13.0+cpu", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/79/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "2.7.1" ], "vulnerableFunction": "Inductor Conv2d/hardshrink/view/mv compiler failure", "untrustedCallPathAssessment": "Vendor issue reports CppCompileError while scanner summary calls buffer overflow. BART is text attention/linear model, lacks this Conv2d/hardshrink chain, and app does not compile.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/17" } }, { "package": "torch", "groupId": "CVE-2025-55560", "identifiers": [ "BIT-pytorch-2025-55560", "CVE-2025-55560", "PYSEC-2025-209" ], "originalLockedVersion": "2.6.0+cpu", "f17dba2LockedVersion": "2.6.0+cpu", "installedQualifiedVersion": "2.13.0+cpu", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/80/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "2.7.1" ], "vulnerableFunction": "Inductor to_sparse/to_dense lowering", "untrustedCallPathAssessment": "BART does not create sparse model inputs and app does not enable Inductor. Sparse tensor graph cannot be submitted through summarize text.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/18" } }, { "package": "torch", "groupId": "CVE-2026-4538", "identifiers": [ "BIT-pytorch-2026-4538", "CVE-2026-4538", "PYSEC-2026-139" ], "originalLockedVersion": "2.6.0+cpu", "f17dba2LockedVersion": "2.6.0+cpu", "installedQualifiedVersion": "2.13.0+cpu", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/81/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [], "vulnerableFunction": "torch.export.load .pt2 deserialization", "untrustedCallPathAssessment": "Installed export.load API exists but Transformers load_state_dict uses safetensors or torch.load, not export.load. Neither app nor parser accepts .pt2 or model uploads. Fixed repository alone does not establish checkpoint integrity.", "disposition": "Not affected, with evidence", "justification": "Current-source and real-CPU BART boundary assessment excludes the named vulnerable operation from the supported fixed-model text/parser flow. This is not a global upstream fix claim.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "Published severity retained for other/library uses; not an exposed path in the qualified service scope. Reassess on any scope falsifier.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/19" }, "currentSourceReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-current-scope.json", "jsonPointer": "/advisories/1" }, "upstreamState": "No verified general fix for nine named alternate-loader/conversion groups; numeric55554 has conflicting/open vendor evidence. Original source records retained. Scoped non-applicability does not close upstream issues.", "scopeFalsifiers": [ "Identify exact runtime image/wheel and fixed application call path, not just version-range exclusion.", "Show vulnerable script is absent, or exact API/model family is excluded by actual loader mapping and pinned verified config. No arbitrary caller model path/architecture/loader kwargs.", "Trace indirect ordinary model loading separately: Transformers load_state_dict reaches torch.load(weights_only=True), not torch.export.load. Shared unsafe boundaries require independent remediation.", "Retain upstream no-fix status, source severity and aliases. Scoped non-applicability does not mean dependency globally fixed or production accepted.", "Limit conclusion to observed artifact identity and trusted deployment inputs; re-review on changed dispatch/config/packages or accepted formats." ] }, { "package": "torch", "groupId": "CVE-2025-3730", "identifiers": [ "BIT-pytorch-2025-3730", "CVE-2025-3730", "GHSA-887c-mr87-cxwp", "PYSEC-2026-1970" ], "originalLockedVersion": "2.6.0+cpu", "f17dba2LockedVersion": "2.6.0+cpu", "installedQualifiedVersion": "2.13.0+cpu", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/82/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "2.8.0" ], "vulnerableFunction": "torch.nn.functional.ctc_loss / native LossCTC", "untrustedCallPathAssessment": "Vendor identifies CTC loss; service invokes BARTForConditionalGeneration.generate without labels, training or CTC. OCR uses Tesseract in parser child, not torch CTC.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/20" } }, { "package": "torch", "groupId": "CVE-2026-24747", "identifiers": [ "BIT-pytorch-2026-24747", "CVE-2026-24747", "GHSA-63cw-57p8-fm3p", "PYSEC-2026-1856", "PYSEC-2026-2286" ], "originalLockedVersion": "2.6.0+cpu", "f17dba2LockedVersion": "2.6.0+cpu", "installedQualifiedVersion": "2.13.0+cpu", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/83/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "2.10.0" ], "vulnerableFunction": "torch.load(weights_only=True) unpickler memory corruption", "untrustedCallPathAssessment": "Actual installed load_state_dict493 forwards non-safetensors checkpoints to torch.load535 with weights_only=True. app.from_pretrained does not require safetensors or pin revision; therefore malicious or compromised model/cache checkpoint can reach vulnerable loader even though no direct app torch.load exists.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/21" } }, { "package": "transformers", "groupId": "CVE-2025-14929", "identifiers": [ "CVE-2025-14929", "PYSEC-2025-217" ], "originalLockedVersion": "4.48.3", "f17dba2LockedVersion": "4.48.3", "installedQualifiedVersion": "5.10.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/84/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [], "vulnerableFunction": "X-CLIP checkpoint conversion unsafe deserialization", "untrustedCallPathAssessment": "Installed wheel contains no *convert* files under transformers/models. BART auto model selection does not run X-CLIP conversion CLI; service accepts no checkpoint conversion arguments.", "disposition": "Not affected, with evidence", "justification": "Current-source and real-CPU BART boundary assessment excludes the named vulnerable operation from the supported fixed-model text/parser flow. This is not a global upstream fix claim.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "Published severity retained for other/library uses; not an exposed path in the qualified service scope. Reassess on any scope falsifier.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/22" }, "currentSourceReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-current-scope.json", "jsonPointer": "/advisories/2" }, "upstreamState": "No verified general fix for nine named alternate-loader/conversion groups; numeric55554 has conflicting/open vendor evidence. Original source records retained. Scoped non-applicability does not close upstream issues.", "scopeFalsifiers": [ "Identify exact runtime image/wheel and fixed application call path, not just version-range exclusion.", "Show vulnerable script is absent, or exact API/model family is excluded by actual loader mapping and pinned verified config. No arbitrary caller model path/architecture/loader kwargs.", "Trace indirect ordinary model loading separately: Transformers load_state_dict reaches torch.load(weights_only=True), not torch.export.load. Shared unsafe boundaries require independent remediation.", "Retain upstream no-fix status, source severity and aliases. Scoped non-applicability does not mean dependency globally fixed or production accepted.", "Limit conclusion to observed artifact identity and trusted deployment inputs; re-review on changed dispatch/config/packages or accepted formats." ] }, { "package": "transformers", "groupId": "CVE-2025-2099", "identifiers": [ "CVE-2025-2099", "GHSA-qq3j-4f4f-9583", "PYSEC-2025-40" ], "originalLockedVersion": "4.48.3", "f17dba2LockedVersion": "4.48.3", "installedQualifiedVersion": "5.10.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/85/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "4.50.0" ], "vulnerableFunction": "testing_utils.preprocess_string doctest ReDoS", "untrustedCallPathAssessment": "Installed2593 preprocess_string processes Python/Markdown doctest contents. App tokenizer does not use testing_utils; CV text/Markdown uploads go through parser normalization, not doctest preparation.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/23" } }, { "package": "transformers", "groupId": "CVE-2025-14926", "identifiers": [ "CVE-2025-14926", "PYSEC-2025-214" ], "originalLockedVersion": "4.48.3", "f17dba2LockedVersion": "4.48.3", "installedQualifiedVersion": "5.10.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/86/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [], "vulnerableFunction": "SEW conversion convert_config string eval", "untrustedCallPathAssessment": "Conversion script is absent from installed models tree; BART inference has no SEW conversion or checkpoint argument input.", "disposition": "Not affected, with evidence", "justification": "Current-source and real-CPU BART boundary assessment excludes the named vulnerable operation from the supported fixed-model text/parser flow. This is not a global upstream fix claim.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "Published severity retained for other/library uses; not an exposed path in the qualified service scope. Reassess on any scope falsifier.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/24" }, "currentSourceReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-current-scope.json", "jsonPointer": "/advisories/3" }, "upstreamState": "No verified general fix for nine named alternate-loader/conversion groups; numeric55554 has conflicting/open vendor evidence. Original source records retained. Scoped non-applicability does not close upstream issues.", "scopeFalsifiers": [ "Identify exact runtime image/wheel and fixed application call path, not just version-range exclusion.", "Show vulnerable script is absent, or exact API/model family is excluded by actual loader mapping and pinned verified config. No arbitrary caller model path/architecture/loader kwargs.", "Trace indirect ordinary model loading separately: Transformers load_state_dict reaches torch.load(weights_only=True), not torch.export.load. Shared unsafe boundaries require independent remediation.", "Retain upstream no-fix status, source severity and aliases. Scoped non-applicability does not mean dependency globally fixed or production accepted.", "Limit conclusion to observed artifact identity and trusted deployment inputs; re-review on changed dispatch/config/packages or accepted formats." ] }, { "package": "transformers", "groupId": "CVE-2025-14930", "identifiers": [ "CVE-2025-14930", "PYSEC-2025-218" ], "originalLockedVersion": "4.48.3", "f17dba2LockedVersion": "4.48.3", "installedQualifiedVersion": "5.10.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/87/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [], "vulnerableFunction": "GLM4 weights parsing unsafe deserialization", "untrustedCallPathAssessment": "No glm4 directory in installed4.48.3; selected mapping is BART, not GLM4. Advisory version range broader than named architecture availability; no assumption newest release fixes this.", "disposition": "Not affected, with evidence", "justification": "Current-source and real-CPU BART boundary assessment excludes the named vulnerable operation from the supported fixed-model text/parser flow. This is not a global upstream fix claim.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "Published severity retained for other/library uses; not an exposed path in the qualified service scope. Reassess on any scope falsifier.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/25" }, "currentSourceReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-current-scope.json", "jsonPointer": "/advisories/4" }, "upstreamState": "No verified general fix for nine named alternate-loader/conversion groups; numeric55554 has conflicting/open vendor evidence. Original source records retained. Scoped non-applicability does not close upstream issues.", "scopeFalsifiers": [ "Identify exact runtime image/wheel and fixed application call path, not just version-range exclusion.", "Show vulnerable script is absent, or exact API/model family is excluded by actual loader mapping and pinned verified config. No arbitrary caller model path/architecture/loader kwargs.", "Trace indirect ordinary model loading separately: Transformers load_state_dict reaches torch.load(weights_only=True), not torch.export.load. Shared unsafe boundaries require independent remediation.", "Retain upstream no-fix status, source severity and aliases. Scoped non-applicability does not mean dependency globally fixed or production accepted.", "Limit conclusion to observed artifact identity and trusted deployment inputs; re-review on changed dispatch/config/packages or accepted formats." ] }, { "package": "transformers", "groupId": "CVE-2025-14920", "identifiers": [ "CVE-2025-14920", "PYSEC-2025-211" ], "originalLockedVersion": "4.48.3", "f17dba2LockedVersion": "4.48.3", "installedQualifiedVersion": "5.10.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/88/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [], "vulnerableFunction": "Perceiver model conversion/deserialization", "untrustedCallPathAssessment": "Perceiver model package exists but no conversion scripts are installed. AutoModelForSeq2SeqLM maps bart to BartForConditionalGeneration; Perceiver has distinct model/configuration and tokenizer modules. No model upload endpoint.", "disposition": "Not affected, with evidence", "justification": "Current-source and real-CPU BART boundary assessment excludes the named vulnerable operation from the supported fixed-model text/parser flow. This is not a global upstream fix claim.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "Published severity retained for other/library uses; not an exposed path in the qualified service scope. Reassess on any scope falsifier.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/26" }, "currentSourceReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-current-scope.json", "jsonPointer": "/advisories/5" }, "upstreamState": "No verified general fix for nine named alternate-loader/conversion groups; numeric55554 has conflicting/open vendor evidence. Original source records retained. Scoped non-applicability does not close upstream issues.", "scopeFalsifiers": [ "Identify exact runtime image/wheel and fixed application call path, not just version-range exclusion.", "Show vulnerable script is absent, or exact API/model family is excluded by actual loader mapping and pinned verified config. No arbitrary caller model path/architecture/loader kwargs.", "Trace indirect ordinary model loading separately: Transformers load_state_dict reaches torch.load(weights_only=True), not torch.export.load. Shared unsafe boundaries require independent remediation.", "Retain upstream no-fix status, source severity and aliases. Scoped non-applicability does not mean dependency globally fixed or production accepted.", "Limit conclusion to observed artifact identity and trusted deployment inputs; re-review on changed dispatch/config/packages or accepted formats." ] }, { "package": "transformers", "groupId": "CVE-2025-14921", "identifiers": [ "CVE-2025-14921", "PYSEC-2025-212" ], "originalLockedVersion": "4.48.3", "f17dba2LockedVersion": "4.48.3", "installedQualifiedVersion": "5.10.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/89/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [], "vulnerableFunction": "Transformer-XL tokenizer/model pickle deserialization", "untrustedCallPathAssessment": "Installed TransfoXL tokenizer explicitly contains pickle.load and warns/deprecates unsafe loading. BartTokenizer/BartTokenizerFast map uses JSON vocab/merges and byte BPE; no Transformer-XL vocab accepted by service.", "disposition": "Not affected, with evidence", "justification": "Current-source and real-CPU BART boundary assessment excludes the named vulnerable operation from the supported fixed-model text/parser flow. This is not a global upstream fix claim.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "Published severity retained for other/library uses; not an exposed path in the qualified service scope. Reassess on any scope falsifier.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/27" }, "currentSourceReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-current-scope.json", "jsonPointer": "/advisories/6" }, "upstreamState": "No verified general fix for nine named alternate-loader/conversion groups; numeric55554 has conflicting/open vendor evidence. Original source records retained. Scoped non-applicability does not close upstream issues.", "scopeFalsifiers": [ "Identify exact runtime image/wheel and fixed application call path, not just version-range exclusion.", "Show vulnerable script is absent, or exact API/model family is excluded by actual loader mapping and pinned verified config. No arbitrary caller model path/architecture/loader kwargs.", "Trace indirect ordinary model loading separately: Transformers load_state_dict reaches torch.load(weights_only=True), not torch.export.load. Shared unsafe boundaries require independent remediation.", "Retain upstream no-fix status, source severity and aliases. Scoped non-applicability does not mean dependency globally fixed or production accepted.", "Limit conclusion to observed artifact identity and trusted deployment inputs; re-review on changed dispatch/config/packages or accepted formats." ] }, { "package": "transformers", "groupId": "CVE-2025-14924", "identifiers": [ "CVE-2025-14924", "PYSEC-2025-213" ], "originalLockedVersion": "4.48.3", "f17dba2LockedVersion": "4.48.3", "installedQualifiedVersion": "5.10.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/90/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [], "vulnerableFunction": "megatron_gpt2 checkpoint conversion deserialization", "untrustedCallPathAssessment": "Conversion scripts absent in installed models tree; selected BART loader uses standard load_state_dict, not Megatron conversion. General torch.load checkpoint risk tracked separately under24747.", "disposition": "Not affected, with evidence", "justification": "Current-source and real-CPU BART boundary assessment excludes the named vulnerable operation from the supported fixed-model text/parser flow. This is not a global upstream fix claim.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "Published severity retained for other/library uses; not an exposed path in the qualified service scope. Reassess on any scope falsifier.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/28" }, "currentSourceReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-current-scope.json", "jsonPointer": "/advisories/7" }, "upstreamState": "No verified general fix for nine named alternate-loader/conversion groups; numeric55554 has conflicting/open vendor evidence. Original source records retained. Scoped non-applicability does not close upstream issues.", "scopeFalsifiers": [ "Identify exact runtime image/wheel and fixed application call path, not just version-range exclusion.", "Show vulnerable script is absent, or exact API/model family is excluded by actual loader mapping and pinned verified config. No arbitrary caller model path/architecture/loader kwargs.", "Trace indirect ordinary model loading separately: Transformers load_state_dict reaches torch.load(weights_only=True), not torch.export.load. Shared unsafe boundaries require independent remediation.", "Retain upstream no-fix status, source severity and aliases. Scoped non-applicability does not mean dependency globally fixed or production accepted.", "Limit conclusion to observed artifact identity and trusted deployment inputs; re-review on changed dispatch/config/packages or accepted formats." ] }, { "package": "transformers", "groupId": "CVE-2025-14927", "identifiers": [ "CVE-2025-14927", "PYSEC-2025-215" ], "originalLockedVersion": "4.48.3", "f17dba2LockedVersion": "4.48.3", "installedQualifiedVersion": "5.10.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/91/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [], "vulnerableFunction": "SEW-D convert_config eval", "untrustedCallPathAssessment": "SEW-D conversion source absent from installed wheel. HTTP summarize does not expose conversion/config strings or select audio model families.", "disposition": "Not affected, with evidence", "justification": "Current-source and real-CPU BART boundary assessment excludes the named vulnerable operation from the supported fixed-model text/parser flow. This is not a global upstream fix claim.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "Published severity retained for other/library uses; not an exposed path in the qualified service scope. Reassess on any scope falsifier.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/29" }, "currentSourceReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-current-scope.json", "jsonPointer": "/advisories/8" }, "upstreamState": "No verified general fix for nine named alternate-loader/conversion groups; numeric55554 has conflicting/open vendor evidence. Original source records retained. Scoped non-applicability does not close upstream issues.", "scopeFalsifiers": [ "Identify exact runtime image/wheel and fixed application call path, not just version-range exclusion.", "Show vulnerable script is absent, or exact API/model family is excluded by actual loader mapping and pinned verified config. No arbitrary caller model path/architecture/loader kwargs.", "Trace indirect ordinary model loading separately: Transformers load_state_dict reaches torch.load(weights_only=True), not torch.export.load. Shared unsafe boundaries require independent remediation.", "Retain upstream no-fix status, source severity and aliases. Scoped non-applicability does not mean dependency globally fixed or production accepted.", "Limit conclusion to observed artifact identity and trusted deployment inputs; re-review on changed dispatch/config/packages or accepted formats." ] }, { "package": "transformers", "groupId": "CVE-2025-14928", "identifiers": [ "CVE-2025-14928", "PYSEC-2025-216" ], "originalLockedVersion": "4.48.3", "f17dba2LockedVersion": "4.48.3", "installedQualifiedVersion": "5.10.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/92/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [], "vulnerableFunction": "HuBERT convert_config eval", "untrustedCallPathAssessment": "HuBERT conversion source absent from installed wheel; BART tokenizer/model path does not invoke audio conversion.", "disposition": "Not affected, with evidence", "justification": "Current-source and real-CPU BART boundary assessment excludes the named vulnerable operation from the supported fixed-model text/parser flow. This is not a global upstream fix claim.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "Published severity retained for other/library uses; not an exposed path in the qualified service scope. Reassess on any scope falsifier.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/30" }, "currentSourceReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-current-scope.json", "jsonPointer": "/advisories/9" }, "upstreamState": "No verified general fix for nine named alternate-loader/conversion groups; numeric55554 has conflicting/open vendor evidence. Original source records retained. Scoped non-applicability does not close upstream issues.", "scopeFalsifiers": [ "Identify exact runtime image/wheel and fixed application call path, not just version-range exclusion.", "Show vulnerable script is absent, or exact API/model family is excluded by actual loader mapping and pinned verified config. No arbitrary caller model path/architecture/loader kwargs.", "Trace indirect ordinary model loading separately: Transformers load_state_dict reaches torch.load(weights_only=True), not torch.export.load. Shared unsafe boundaries require independent remediation.", "Retain upstream no-fix status, source severity and aliases. Scoped non-applicability does not mean dependency globally fixed or production accepted.", "Limit conclusion to observed artifact identity and trusted deployment inputs; re-review on changed dispatch/config/packages or accepted formats." ] }, { "package": "transformers", "groupId": "CVE-2025-3933", "identifiers": [ "CVE-2025-3933", "GHSA-37mw-44qp-f5jm", "PYSEC-2026-1977" ], "originalLockedVersion": "4.48.3", "f17dba2LockedVersion": "4.48.3", "installedQualifiedVersion": "5.10.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/93/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "4.52.1" ], "vulnerableFunction": "DonutProcessor.token2json ReDoS", "untrustedCallPathAssessment": "Actual Donut token2json regex exists in separate processor. Service document OCR invokes Tesseract/Pillow, never DonutProcessor; BART decode returns text without token2json.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/31" } }, { "package": "transformers", "groupId": "CVE-2025-6638", "identifiers": [ "CVE-2025-6638", "GHSA-59p9-h35m-wg4g", "PYSEC-2026-1981" ], "originalLockedVersion": "4.48.3", "f17dba2LockedVersion": "4.48.3", "installedQualifiedVersion": "5.10.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/94/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "4.53.0" ], "vulnerableFunction": "MarianTokenizer.remove_language_code ReDoS", "untrustedCallPathAssessment": "Marian tokenizer removes language codes; BART maps to BartTokenizer/Fast with separate vocab/merges byte BPE. Request text cannot select Marian tokenizer.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/32" } }, { "package": "transformers", "groupId": "CVE-2025-3264", "identifiers": [ "CVE-2025-3264", "GHSA-jjph-296x-mrcr", "PYSEC-2026-1985" ], "originalLockedVersion": "4.48.3", "f17dba2LockedVersion": "4.48.3", "installedQualifiedVersion": "5.10.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/95/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "4.51.0" ], "vulnerableFunction": "dynamic_module_utils.get_imports Python-source regex", "untrustedCallPathAssessment": "Installed141 get_imports reads Python code. Auto factory540 executes dynamic module path only for has_remote_code and resolved trust_remote_code. Current app does not opt in, BART has local implementation; missing immutable artifact/config identity prevents universal dispatch proof.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/33" } }, { "package": "transformers", "groupId": "CVE-2025-1194", "identifiers": [ "CVE-2025-1194", "GHSA-fpwr-67px-3qhx", "PYSEC-2026-1984" ], "originalLockedVersion": "4.48.3", "f17dba2LockedVersion": "4.48.3", "installedQualifiedVersion": "5.10.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/96/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "4.50.0" ], "vulnerableFunction": "SubWordJapaneseTokenizer GPT-NeoX-Japanese ReDoS", "untrustedCallPathAssessment": "Named GPT-NeoX-Japanese tokenizer exists as separate implementation; selected BART tokenizer uses byte BPE, not SubWordJapaneseTokenizer. Text cannot select tokenizer class directly.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/34" } }, { "package": "transformers", "groupId": "CVE-2025-3777", "identifiers": [ "CVE-2025-3777", "GHSA-phhr-52qp-3mj4", "PYSEC-2026-1986" ], "originalLockedVersion": "4.48.3", "f17dba2LockedVersion": "4.48.3", "installedQualifiedVersion": "5.10.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/97/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "4.52.1" ], "vulnerableFunction": "image_utils video URL username validation", "untrustedCallPathAssessment": "Installed4.48.3 image_utils has load_image (HTTP image URL) but no load_video/YouTube helper; video_utils.py is absent. BART receives text only; uploaded image bytes handled by PIL/Tesseract in parser, never a Transformers media URL helper.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/35" } }, { "package": "transformers", "groupId": "CVE-2025-6051", "identifiers": [ "CVE-2025-6051", "GHSA-rcv9-qm8p-9p6j", "PYSEC-2026-1988" ], "originalLockedVersion": "4.48.3", "f17dba2LockedVersion": "4.48.3", "installedQualifiedVersion": "5.10.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/98/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "4.53.0" ], "vulnerableFunction": "CLVP EnglishNormalizer.normalize_numbers ReDoS", "untrustedCallPathAssessment": "Actual normalize_numbers197 is CLVP text/audio normalizer; selected BART tokenizer has no EnglishNormalizer call. This is not generic normalize_text in parser_child.py.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/36" } }, { "package": "transformers", "groupId": "CVE-2025-6921", "identifiers": [ "CVE-2025-6921", "GHSA-4w7r-h757-3r74", "PYSEC-2026-1980" ], "originalLockedVersion": "4.48.3", "f17dba2LockedVersion": "4.48.3", "installedQualifiedVersion": "5.10.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/99/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "4.53.0" ], "vulnerableFunction": "AdamWeightDecay._do_use_weight_decay user regex", "untrustedCallPathAssessment": "TensorFlow training optimizer branch. Service performs torch.no_grad model.eval generation; no optimizer, training patterns or TensorFlow model conversion requested.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/37" } }, { "package": "transformers", "groupId": "CVE-2025-3263", "identifiers": [ "CVE-2025-3263", "GHSA-q2wp-rjmx-x6x9", "PYSEC-2026-1987" ], "originalLockedVersion": "4.48.3", "f17dba2LockedVersion": "4.48.3", "installedQualifiedVersion": "5.10.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/100/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "4.51.0" ], "vulnerableFunction": "configuration_utils.get_configuration_file ReDoS", "untrustedCallPathAssessment": "Installed1134 function consumes configuration_files list from model config in shared from_pretrained path. Fixed repository name reduces caller control but unpinned upstream/cache config remains an input; token length does not bound config filename regex.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/38" } }, { "package": "transformers", "groupId": "CVE-2025-5197", "identifiers": [ "CVE-2025-5197", "GHSA-9356-575x-2w9m", "PYSEC-2026-1983" ], "originalLockedVersion": "4.48.3", "f17dba2LockedVersion": "4.48.3", "installedQualifiedVersion": "5.10.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/101/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "4.53.0" ], "vulnerableFunction": "convert_tf_weight_name_to_pt_weight_name ReDoS", "untrustedCallPathAssessment": "Installed55 TF\u2192PyTorch converter consumes tensor weight names; app default PyTorch from_pretrained does not request from_tf or TensorFlow conversion. Checkpoint download route does not automatically imply this conversion.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/39" } }, { "package": "transformers", "groupId": "CVE-2026-1839", "identifiers": [ "CVE-2026-1839", "GHSA-69w3-r845-3855", "PYSEC-2026-2288" ], "originalLockedVersion": "4.48.3", "f17dba2LockedVersion": "4.48.3", "installedQualifiedVersion": "5.10.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/102/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "5.0.0rc3" ], "vulnerableFunction": "Trainer._load_rng_state unsafe torch.load", "untrustedCallPathAssessment": "Installed3081 helper loads training rng_state checkpoint; app uses no Trainer, training resume or optimizer. GHSA text additionally limits exploit to torch below2.6; observed metadata2.6.0 does not satisfy that textual condition, although database Transformers range still matches.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/40" } }, { "package": "transformers", "groupId": "CVE-2026-4372", "identifiers": [ "CVE-2026-4372", "GHSA-29pf-2h5f-8g72", "PYSEC-2026-2289" ], "originalLockedVersion": "4.48.3", "f17dba2LockedVersion": "4.48.3", "installedQualifiedVersion": "5.10.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/103/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "5.3.0" ], "vulnerableFunction": "model initialization config attention-kernel code loading", "untrustedCallPathAssessment": "Shared config attention field exists in4.48.3, but _autoset_attn_implementation1486 rejects non-eager/non-known attention values with ValueError1498. No Hub kernel download dispatch in that method. Vendor describes later kernel-repository execution via serialized field; broad <5.3 range needs version-specific confirmation.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/41" } }, { "package": "transformers", "groupId": "CVE-2026-5241", "identifiers": [ "CVE-2026-5241", "GHSA-fgcw-684q-jj6r", "PYSEC-2026-2290" ], "originalLockedVersion": "4.48.3", "f17dba2LockedVersion": "4.48.3", "installedQualifiedVersion": "5.10.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/104/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "5.5.0" ], "vulnerableFunction": "LightGlue nested AutoConfig remote-code override", "untrustedCallPathAssessment": "No LightGlue files/package in installed4.48.3; installed AutoModelForSeq2SeqLM maps BART and not LightGlue. Vendor report describes5.2.0 despite broad<5.5 range.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/42" } }, { "package": "transformers", "groupId": "CVE-2026-9856", "identifiers": [ "CVE-2026-9856", "GHSA-xrqw-3rrv-vx5w", "PYSEC-2026-3929" ], "originalLockedVersion": "4.48.3", "f17dba2LockedVersion": "4.48.3", "installedQualifiedVersion": "5.10.0", "dependencyRole": "direct application requirement", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/105/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "5.10.0" ], "vulnerableFunction": "tokenizer/Processor save_pretrained chat_template traversal", "untrustedCallPathAssessment": "save_pretrained exists, but application only from_pretrained, tokenizer call/decode, model.generate; no tokenizer/processor export or user save path. Cache download writes are Hub file_download, not save_pretrained.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.", "researchReference": { "path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json", "jsonPointer": "/advisories/43" } }, { "package": "urllib3", "groupId": "GHSA-vxq7-64xx-v4gw", "identifiers": [ "CVE-2026-97689", "GHSA-vxq7-64xx-v4gw", "PYSEC-2026-4177" ], "originalLockedVersion": "2.7.0", "f17dba2LockedVersion": "2.8.0", "installedQualifiedVersion": "2.8.0", "dependencyRole": "security-constrained transitive dependency", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/106/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "2.8.0" ], "vulnerableFunction": "urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory", "untrustedCallPathAssessment": "POTENTIALLY REACHABLE through Requests/Hugging Face downloads; specific proxy/response/chunked-decoder conditions depend on upstream responses and runtime proxy configuration. No malicious server/proxy tested.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "urllib3", "groupId": "GHSA-gh4c-6fx4-qh6g", "identifiers": [ "CVE-2026-97688", "GHSA-gh4c-6fx4-qh6g", "PYSEC-2026-4176" ], "originalLockedVersion": "2.7.0", "f17dba2LockedVersion": "2.8.0", "installedQualifiedVersion": "2.8.0", "dependencyRole": "security-constrained transitive dependency", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/107/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "2.8.0" ], "vulnerableFunction": "urllib3: Chunked Deflate streaming can enter an infinite loop", "untrustedCallPathAssessment": "POTENTIALLY REACHABLE through Requests/Hugging Face downloads; specific proxy/response/chunked-decoder conditions depend on upstream responses and runtime proxy configuration. No malicious server/proxy tested.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." }, { "package": "urllib3", "groupId": "GHSA-8988-9cw3-xx77", "identifiers": [ "CVE-2026-97687", "GHSA-8988-9cw3-xx77", "PYSEC-2026-4175" ], "originalLockedVersion": "2.7.0", "f17dba2LockedVersion": "2.8.0", "installedQualifiedVersion": "2.8.0", "dependencyRole": "security-constrained transitive dependency", "originalAffectedRangesReference": { "path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json", "sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "jsonPointer": "/advisories/108/publishedAffectedRangesAndVersions" }, "publishedPatchedVersions": [ "2.8.0" ], "vulnerableFunction": "urllib3: HTTPS proxy TLS configuration may be ignored or overridden", "untrustedCallPathAssessment": "POTENTIALLY REACHABLE through Requests/Hugging Face downloads; specific proxy/response/chunked-decoder conditions depend on upstream responses and runtime proxy configuration. No malicious server/proxy tested.", "disposition": "Fixed and verified", "justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.", "confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.", "remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.", "qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json", "testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.", "mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.", "compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.", "ownerRiskAccepted": false, "phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria." } ], "additionalGroups": [ { "package": "pytest", "groupId": "GHSA-6w46-j5rx-g56g", "identifiers": [ "GHSA-6w46-j5rx-g56g", "CVE-2025-71176", "PYSEC-2026-1845" ], "originalScope": "New test-only group outside original109; four overlapping provider records, not four vulnerabilities.", "before": "8.3.5", "installedQualifiedVersion": "9.0.3", "dependencyRole": "direct development/test dependency only", "affectedRange": "<9.0.3", "patchedVersion": "9.0.3", "vulnerableFunction": "Temporary test directory ownership/permissions", "reachability": "Local shared test/tmp environment; not installed in the production application lock. Private container/tmp reduces exposure but was not used to waive the finding.", "disposition": "Fixed and verified", "evidence": [ "https://github.com/pytest-dev/pytest/releases/tag/9.0.3", "https://github.com/pytest-dev/pytest/commit/95d8423bd24992deea5b9df32555fa1741679e2c", "docs/redesign/phase-9/p9-sec-02/qualification.json" ], "verification": "Actual pytest9.0.3 complete59-case Linux suite and exact installed scan0records. No exploit executed.", "ownerRiskAccepted": false } ], "sourceAssessments": { "originalInventorySha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b", "researchSha256": "70984291d7c76fc8b903def0807ed2a468e173e8d99bd59d85cd3f0c69fb8964", "currentSourceSha256": "92056abac9ceecc29ba371fb65822ed0f4d4fe5453431533f62519dae18c7dfc", "qualificationSha256": "30ef69334a1684277ebf889930d275236d4205aa19968a6ad038604fbfc2e4c0", "exactInstalledAuditSha256": "804a01d79bb3ba295eab59284018a2060b680307720548ffcf804536a5d66fd0" }, "formalRiskAcceptance": false, "finalQualificationUtc": "2026-10-25T12:34:43.376715+00:00", "finalQualification": { "finalRuntimeQualification": { "path": ".artifacts/p9-sec-02/model-regression/result.json", "sha256": "41ff9bcd961120cb726c336dd6593054dfe96caf1e87781458a3b96cf591639c" }, "trainedModelQualification": { "path": ".artifacts/p9-sec-02/full-model/result.json", "sha256": "a12cffa865f19bbf475f65501b17cb55dda4d79d3f5d71ae736b185425805678" }, "finalInstalledAdvisoryScan": { "path": ".artifacts/p9-sec-02/final-advisories/summary.json", "sha256": "37278c67b44a07088ecb9c2bdb53a252b4aef0bf080b733ff4b8af4d160afb4b" }, "limits": "Exact supported CPU BART/text/parser graph and private new-generation cache; no global package, full-image/stdlib/native advisory audit, old native Windows virtualenv, semantic quality, GPU, mixed-generation shared-cache migration or deployed-production safety claim. Raw scan INCOMPLETE for one known vendor PyPI404; exact OSV and official CPU wheel/vendor/source evidence supplement that unavailable response. No owner risk accepted." } }