cesnimda/jobtrackingapp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
aea7c29e702ced636a8db696c4c1b9b833b869e4
jobtrackingapp/docs/redesign/phase-9/p9-sec-02/DISPOSITIONS.json
T
cesnimda b48f25c4ff
MariaDB persistence qualification / mariadb (push) Has been cancelled
Details
test: qualify immutable models and Phase 9 regression
2026-10-25 13:43:50 +01:00

3898 lines
320 KiB
JSON
Raw Blame History

{
"schemaVersion": 1,
"generatedUtc": "2026-10-25T07:30:51.879487+00:00",
"gate": "SCOPED_LOCAL_QUALIFICATION_COMPLETE_WITH_RECORDED_PROVIDER_QUERY_GAP",
"scope": "Exact supported CPU BART/text/parser flow and fixed artifacts/library graph. No global package safety, trained-model quality, GPU, production cache/deployment or release claim.",
"accounting": {
"originalGroups": 109,
"previouslyVersionRemediated": 65,
"thisMissionFollowups": 44,
"currentOriginalDispositions": {
"Fixed and verified": 99,
"Not affected, with evidence": 10
},
"newTestOnlyGroups": 1,
"totalTrackedGroups": 110,
"baselineProviderRecords": 249,
"f17dba2ProviderRecords": 99,
"newInstalledProviderRecords": 0,
"installedDistributionCount": 63,
"exactQueries": 126,
"coverageErrors": [
{
"package": "torch",
"version": "2.13.0+cpu",
"provider": "pypi",
"httpStatus": 404,
"error": "HTTPError"
}
]
},
"originalGroups": [
{
"package": "certifi",
"groupId": "GHSA-6q48-6c7w-9gw2",
"identifiers": [
"GHSA-6q48-6c7w-9gw2",
"PYSEC-2026-4320"
],
"originalLockedVersion": "2026.7.22",
"f17dba2LockedVersion": "2026.10.19",
"installedQualifiedVersion": "2026.10.19",
"dependencyRole": "security-constrained transitive dependency",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/0/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"2026.10.19"
],
"vulnerableFunction": "certifi bundles emSign root CAs with compromised intermediate CA keys",
"untrustedCallPathAssessment": "POTENTIALLY REACHABLE: Requests/Hugging Face TLS trust uses the CA bundle on model/dependency fetches; an on-path attacker plus compromised CA is required. No interception reproduced.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "filelock",
"groupId": "CVE-2026-112940",
"identifiers": [
"CVE-2026-112940",
"GHSA-v4x8-3wr5-3wq8"
],
"originalLockedVersion": "3.32.4",
"f17dba2LockedVersion": "3.32.4",
"installedQualifiedVersion": "4.2.1",
"dependencyRole": "explicit cache security constraint (previously transitive)",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/1/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"4.2.1"
],
"vulnerableFunction": "ReadWriteLock SQLite database reopen and POSIX symlink/side-file handling",
"untrustedCallPathAssessment": "SQLite-backed ReadWriteLock is a different lock type from Hub WeakFileLock; installed Hub _fixes.py constructs FileLock then SoftFileLock. Remote document text cannot choose lock type or database filename. No ReadWriteLock application import/call.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/0"
}
},
{
"package": "filelock",
"groupId": "CVE-2026-112913",
"identifiers": [
"CVE-2026-112913",
"GHSA-9vhv-jxww-xfm5"
],
"originalLockedVersion": "3.32.4",
"f17dba2LockedVersion": "3.32.4",
"installedQualifiedVersion": "4.2.1",
"dependencyRole": "explicit cache security constraint (previously transitive)",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/2/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"4.2.1"
],
"vulnerableFunction": "ReadWriteLock Windows SQLite -wal/-journal/-shm handling",
"untrustedCallPathAssessment": "Requires local attacker-created SQLite side files in shared writable directory. Current cache helper uses native FileLock or SoftFileLock, not SQLite ReadWriteLock; parser has no filelock import.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/1"
}
},
{
"package": "filelock",
"groupId": "CVE-2026-112907",
"identifiers": [
"CVE-2026-112907",
"GHSA-567q-5qvw-pf92"
],
"originalLockedVersion": "3.32.4",
"f17dba2LockedVersion": "3.32.4",
"installedQualifiedVersion": "4.2.1",
"dependencyRole": "explicit cache security constraint (previously transitive)",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/3/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"4.2.1"
],
"vulnerableFunction": "SoftFileLock marker open/stale breaking on Windows oplock",
"untrustedCallPathAssessment": "Hub WeakFileLock fallback reaches SoftFileLock; filelock native lock can also fall back. Local user able to open cache marker can stall open beyond timeout. Cannot dismiss using HTTP request limits or parser child timeout.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/2"
}
},
{
"package": "pillow",
"groupId": "GHSA-4558-3h8r-v8xp",
"identifiers": [
"CVE-2026-112394",
"GHSA-4558-3h8r-v8xp"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/4/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size",
"untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-8g5g-8vmr-9782",
"identifiers": [
"CVE-2026-112403",
"GHSA-8g5g-8vmr-9782"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/5/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow: Heap buffer overflow in ImagingJpegDecode",
"untrustedCallPathAssessment": "POTENTIALLY REACHABLE: accepted PNG/JPEG bytes reach Image.open; image dimensions/frame validation occurs after opening. APNG pre-check allocation reproduced safely at64 pixels and repaired by13.0.0.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-rfgq-q3w2-pmv2",
"identifiers": [
"CVE-2026-112898",
"GHSA-rfgq-q3w2-pmv2"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/6/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow: Image.quantize() with empty palette leaks uninitialized stack memory",
"untrustedCallPathAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-xvh5-g6gv-559v",
"identifiers": [
"CVE-2026-112902",
"GHSA-xvh5-g6gv-559v"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/7/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": " Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags",
"untrustedCallPathAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-p4wg-p73j-c528",
"identifiers": [
"CVE-2026-112895",
"GHSA-p4wg-p73j-c528"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/8/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)",
"untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-65qm-jvmh-6pqg",
"identifiers": [
"CVE-2026-112400",
"GHSA-65qm-jvmh-6pqg"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/9/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS",
"untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-58r4-6rv3-gfh8",
"identifiers": [
"CVE-2026-112397",
"GHSA-58r4-6rv3-gfh8"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/10/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow: Out-of-bounds access in _imagingmorph on a zero-width image",
"untrustedCallPathAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-pchr-8j38-3x4p",
"identifiers": [
"CVE-2026-112896",
"GHSA-pchr-8j38-3x4p"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/11/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read",
"untrustedCallPathAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-q45j-58j2-45rg",
"identifiers": [
"CVE-2026-112897",
"GHSA-q45j-58j2-45rg"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/12/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips",
"untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-462x-pgg6-55fp",
"identifiers": [
"CVE-2026-112395",
"GHSA-462x-pgg6-55fp"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/13/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)",
"untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-c6hw-5grf-ff96",
"identifiers": [
"CVE-2026-112404",
"GHSA-c6hw-5grf-ff96"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/14/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels",
"untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-vx6w-vv9f-6gvg",
"identifiers": [
"CVE-2026-112899",
"GHSA-vx6w-vv9f-6gvg"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/15/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit",
"untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-7mwm-ghpf-9vrm",
"identifiers": [
"CVE-2026-112402",
"GHSA-7mwm-ghpf-9vrm"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/16/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform",
"untrustedCallPathAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-w889-685w-c8fh",
"identifiers": [
"CVE-2026-112900",
"GHSA-w889-685w-c8fh"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/17/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow: Argument Injection in Ghostscript call, potentially leading into RCE",
"untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-j4m9-6w36-pw47",
"identifiers": [
"CVE-2026-112893",
"GHSA-j4m9-6w36-pw47"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/18/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow: Invalid free in FreeType glyph rendering when a stroker is active",
"untrustedCallPathAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-27h8-gf7j-v5hc",
"identifiers": [
"CVE-2026-112392",
"GHSA-27h8-gf7j-v5hc"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/19/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images",
"untrustedCallPathAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-fc9g-5qg7-mf45",
"identifiers": [
"CVE-2026-112891",
"GHSA-fc9g-5qg7-mf45"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/20/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow: Quadratic GIF comment copying during save",
"untrustedCallPathAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-cp9v-662q-vvx9",
"identifiers": [
"CVE-2026-112405",
"GHSA-cp9v-662q-vvx9"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/21/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0",
"untrustedCallPathAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-22hg-r758-rrw9",
"identifiers": [
"CVE-2026-112390",
"GHSA-22hg-r758-rrw9"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/22/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow: Infinite loop in MIC n_frames when the embedded TIFF",
"untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-74r2-7ff9-mjj2",
"identifiers": [
"CVE-2026-112401",
"GHSA-74r2-7ff9-mjj2"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/23/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()",
"untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-xgh8-jp6q-p5x8",
"identifiers": [
"CVE-2026-112901",
"GHSA-xgh8-jp6q-p5x8"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/24/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes",
"untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-254f-3936-288h",
"identifiers": [
"CVE-2026-112391",
"GHSA-254f-3936-288h"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/25/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()",
"untrustedCallPathAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-jg86-v3jv-hrpm",
"identifiers": [
"CVE-2026-112894",
"GHSA-jg86-v3jv-hrpm"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/26/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)",
"untrustedCallPathAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-f2g6-542v-9j58",
"identifiers": [
"CVE-2026-112406",
"GHSA-f2g6-542v-9j58"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/27/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle",
"untrustedCallPathAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-5xm2-6676-qcp9",
"identifiers": [
"CVE-2026-112399",
"GHSA-5xm2-6676-qcp9"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/28/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow: APNG background disposal allocates full canvas before decompression bomb check",
"untrustedCallPathAssessment": "POTENTIALLY REACHABLE: accepted PNG/JPEG bytes reach Image.open; image dimensions/frame validation occurs after opening. APNG pre-check allocation reproduced safely at64 pixels and repaired by13.0.0.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-gg2r-wvfm-q9rx",
"identifiers": [
"CVE-2026-112892",
"GHSA-gg2r-wvfm-q9rx"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/29/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow: MSP RLE decoder expands a tiny file into unbounded memory",
"untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-332p-7hrc-92wf",
"identifiers": [
"CVE-2026-112393",
"GHSA-332p-7hrc-92wf"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/30/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO",
"untrustedCallPathAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-4rr5-89j8-mwwm",
"identifiers": [
"CVE-2026-112396",
"GHSA-4rr5-89j8-mwwm"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/31/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer",
"untrustedCallPathAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-24rc-8hj2-v98c",
"identifiers": [
"CVE-2026-96638",
"GHSA-24rc-8hj2-v98c"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/32/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode",
"untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-4rm8-3hmm-39fg",
"identifiers": [
"CVE-2026-96641",
"GHSA-4rm8-3hmm-39fg"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/33/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise",
"untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-mrfp-p49p-3hf2",
"identifiers": [
"CVE-2026-96640",
"GHSA-mrfp-p49p-3hf2"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/34/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion",
"untrustedCallPathAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-3j72-p6qg-6xp7",
"identifiers": [
"CVE-2026-96642",
"GHSA-3j72-p6qg-6xp7"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/35/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow: TarIO negative size field causes infinite CPU-spin loop",
"untrustedCallPathAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-v9pv-5gc8-w2m6",
"identifiers": [
"CVE-2026-96639",
"GHSA-v9pv-5gc8-w2m6"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/36/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow multi-frame loaders can reuse stale native image storage after mode transitions",
"untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-g4qv-2jxx-769h",
"identifiers": [
"CVE-2026-96643",
"GHSA-g4qv-2jxx-769h"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/37/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time",
"untrustedCallPathAssessment": "POTENTIALLY REACHABLE: accepted PNG/JPEG bytes reach Image.open; image dimensions/frame validation occurs after opening. APNG pre-check allocation reproduced safely at64 pixels and repaired by13.0.0.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-g842-9rc4-69pw",
"identifiers": [
"CVE-2026-96637",
"GHSA-g842-9rc4-69pw"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/38/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS",
"untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-9v9v-9qvf-h2hj",
"identifiers": [
"CVE-2026-96644",
"GHSA-9v9v-9qvf-h2hj"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/39/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)",
"untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-g7cr-3p24-7wf7",
"identifiers": [
"CVE-2026-96778",
"GHSA-g7cr-3p24-7wf7"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/40/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer",
"untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-p8hx-v2p6-rp84",
"identifiers": [
"CVE-2026-96636",
"GHSA-p8hx-v2p6-rp84"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/41/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)",
"untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-78g4-xqwv-q3g8",
"identifiers": [
"GHSA-78g4-xqwv-q3g8"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/42/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()",
"untrustedCallPathAssessment": "FORMAT/OPERATION CONDITIONAL: app accepts PNG/JPEG/WebP signatures and Image.open auto-detects content before validation; specialized format/frame/decoder conditions are not all reproduced. Do not infer security solely from extension allowlisting.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-654x-cwwv-5j9c",
"identifiers": [
"CVE-2026-114501",
"GHSA-654x-cwwv-5j9c"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/43/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1",
"untrustedCallPathAssessment": "NO MATCHING APPLICATION OPERATION FOUND for the named encoder/filter/export/helper. Jobjakt opens/validates/possibly converts accepted images and invokes OCR; this does not independently prove every decoder condition unreachable.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pillow",
"groupId": "GHSA-5x8w-8jj5-q52h",
"identifiers": [
"CVE-2026-112398",
"GHSA-5x8w-8jj5-q52h"
],
"originalLockedVersion": "12.3.0",
"f17dba2LockedVersion": "13.0.0",
"installedQualifiedVersion": "13.0.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/44/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"13.0.0"
],
"vulnerableFunction": "Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution",
"untrustedCallPathAssessment": "POTENTIALLY REACHABLE: accepted PNG/JPEG bytes reach Image.open; image dimensions/frame validation occurs after opening. APNG pre-check allocation reproduced safely at64 pixels and repaired by13.0.0.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pypdf",
"groupId": "GHSA-5jq2-8x83-x246",
"identifiers": [
"CVE-2026-102994",
"GHSA-5jq2-8x83-x246",
"PYSEC-2026-4153"
],
"originalLockedVersion": "6.16.2",
"f17dba2LockedVersion": "6.21.2",
"installedQualifiedVersion": "6.21.2",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/45/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"6.18.0"
],
"vulnerableFunction": "pypdf: Possible long runtimes/large memory usage when parsing indirect objects",
"untrustedCallPathAssessment": "POTENTIALLY REACHABLE: untrusted PDF bytes reach PdfReader construction, page enumeration and extract_text before/within application page/text limits. Existing child resource limits reduce impact but do not patch parser complexity.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pypdf",
"groupId": "GHSA-fp3h-c4fm-7vvf",
"identifiers": [
"CVE-2026-102995",
"GHSA-fp3h-c4fm-7vvf",
"PYSEC-2026-4154"
],
"originalLockedVersion": "6.16.2",
"f17dba2LockedVersion": "6.21.2",
"installedQualifiedVersion": "6.21.2",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/46/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"6.18.1"
],
"vulnerableFunction": "pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)",
"untrustedCallPathAssessment": "POTENTIALLY REACHABLE: untrusted PDF bytes reach PdfReader construction, page enumeration and extract_text before/within application page/text limits. Existing child resource limits reduce impact but do not patch parser complexity.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pypdf",
"groupId": "GHSA-w23x-9jrw-r45c",
"identifiers": [
"CVE-2026-103000",
"GHSA-w23x-9jrw-r45c",
"PYSEC-2026-4160"
],
"originalLockedVersion": "6.16.2",
"f17dba2LockedVersion": "6.21.2",
"installedQualifiedVersion": "6.21.2",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/47/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"6.19.0"
],
"vulnerableFunction": "pypdf: Possible large memory usage when retrieving alphabetical page labels",
"untrustedCallPathAssessment": "NO MATCHING HIGH-LEVEL CALL FOUND: extraction reads PdfReader/pages and extract_text, not writer outline removal, field/appearance, labels, embedded-file extraction or images. Shared low-level parsing dependencies remain possible.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pypdf",
"groupId": "GHSA-v247-6f48-mgcj",
"identifiers": [
"CVE-2026-102999",
"GHSA-v247-6f48-mgcj",
"PYSEC-2026-4159"
],
"originalLockedVersion": "6.16.2",
"f17dba2LockedVersion": "6.21.2",
"installedQualifiedVersion": "6.21.2",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/48/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"6.19.0"
],
"vulnerableFunction": "pypdf: Possible long runtimes with large amount of embedded files",
"untrustedCallPathAssessment": "NO MATCHING HIGH-LEVEL CALL FOUND: extraction reads PdfReader/pages and extract_text, not writer outline removal, field/appearance, labels, embedded-file extraction or images. Shared low-level parsing dependencies remain possible.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pypdf",
"groupId": "GHSA-jw7q-gvrg-4vj3",
"identifiers": [
"CVE-2026-102997",
"GHSA-jw7q-gvrg-4vj3",
"PYSEC-2026-4156"
],
"originalLockedVersion": "6.16.2",
"f17dba2LockedVersion": "6.21.2",
"installedQualifiedVersion": "6.21.2",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/49/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"6.18.1"
],
"vulnerableFunction": "pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)",
"untrustedCallPathAssessment": "POTENTIALLY REACHABLE: untrusted PDF bytes reach PdfReader construction, page enumeration and extract_text before/within application page/text limits. Existing child resource limits reduce impact but do not patch parser complexity.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pypdf",
"groupId": "GHSA-g9cg-prrw-2r8q",
"identifiers": [
"CVE-2026-102996",
"GHSA-g9cg-prrw-2r8q",
"PYSEC-2026-4155"
],
"originalLockedVersion": "6.16.2",
"f17dba2LockedVersion": "6.21.2",
"installedQualifiedVersion": "6.21.2",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/50/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"6.18.1"
],
"vulnerableFunction": "pypdf: Possible large memory usage when parsing font data",
"untrustedCallPathAssessment": "POTENTIALLY REACHABLE: untrusted PDF bytes reach PdfReader construction, page enumeration and extract_text before/within application page/text limits. Existing child resource limits reduce impact but do not patch parser complexity.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pypdf",
"groupId": "GHSA-qv6h-rv94-w285",
"identifiers": [
"CVE-2026-102993",
"GHSA-qv6h-rv94-w285",
"PYSEC-2026-4158"
],
"originalLockedVersion": "6.16.2",
"f17dba2LockedVersion": "6.21.2",
"installedQualifiedVersion": "6.21.2",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/51/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"6.17.0"
],
"vulnerableFunction": "pypdf: Possible large memory usage when retrieving Roman page labels",
"untrustedCallPathAssessment": "NO MATCHING HIGH-LEVEL CALL FOUND: extraction reads PdfReader/pages and extract_text, not writer outline removal, field/appearance, labels, embedded-file extraction or images. Shared low-level parsing dependencies remain possible.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pypdf",
"groupId": "GHSA-php9-fj8v-98fj",
"identifiers": [
"CVE-2026-102998",
"GHSA-php9-fj8v-98fj",
"PYSEC-2026-4157"
],
"originalLockedVersion": "6.16.2",
"f17dba2LockedVersion": "6.21.2",
"installedQualifiedVersion": "6.21.2",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/52/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"6.19.0"
],
"vulnerableFunction": "pypdf: Possible long runtimes when generating appearance streams",
"untrustedCallPathAssessment": "NO MATCHING HIGH-LEVEL CALL FOUND: extraction reads PdfReader/pages and extract_text, not writer outline removal, field/appearance, labels, embedded-file extraction or images. Shared low-level parsing dependencies remain possible.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pypdf",
"groupId": "GHSA-qfv9-64jg-mh7p",
"identifiers": [
"CVE-2026-113792",
"GHSA-qfv9-64jg-mh7p"
],
"originalLockedVersion": "6.16.2",
"f17dba2LockedVersion": "6.21.2",
"installedQualifiedVersion": "6.21.2",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/53/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"6.20.1"
],
"vulnerableFunction": "pypdf: Possible infinite loop in PdfWriter.find_outline_item",
"untrustedCallPathAssessment": "NO MATCHING HIGH-LEVEL CALL FOUND: extraction reads PdfReader/pages and extract_text, not writer outline removal, field/appearance, labels, embedded-file extraction or images. Shared low-level parsing dependencies remain possible.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pypdf",
"groupId": "GHSA-7mh2-4gg2-979f",
"identifiers": [
"CVE-2026-113795",
"GHSA-7mh2-4gg2-979f"
],
"originalLockedVersion": "6.16.2",
"f17dba2LockedVersion": "6.21.2",
"installedQualifiedVersion": "6.21.2",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/54/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"6.20.0"
],
"vulnerableFunction": "pypdf: Possible large memory usage for streams with multiple filters",
"untrustedCallPathAssessment": "POTENTIALLY REACHABLE: untrusted PDF bytes reach PdfReader construction, page enumeration and extract_text before/within application page/text limits. Existing child resource limits reduce impact but do not patch parser complexity.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pypdf",
"groupId": "GHSA-9mx8-4j7g-633p",
"identifiers": [
"CVE-2026-113793",
"GHSA-9mx8-4j7g-633p"
],
"originalLockedVersion": "6.16.2",
"f17dba2LockedVersion": "6.21.2",
"installedQualifiedVersion": "6.21.2",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/55/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"6.20.1"
],
"vulnerableFunction": "pypdf: Possible infinite loop when removing tree items",
"untrustedCallPathAssessment": "NO MATCHING HIGH-LEVEL CALL FOUND: extraction reads PdfReader/pages and extract_text, not writer outline removal, field/appearance, labels, embedded-file extraction or images. Shared low-level parsing dependencies remain possible.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pypdf",
"groupId": "GHSA-39mj-jf6j-2qj3",
"identifiers": [
"CVE-2026-113794",
"GHSA-39mj-jf6j-2qj3"
],
"originalLockedVersion": "6.16.2",
"f17dba2LockedVersion": "6.21.2",
"installedQualifiedVersion": "6.21.2",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/56/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"6.20.0"
],
"vulnerableFunction": "pypdf: Possible infinite loop when hitting EOF in standard xref table",
"untrustedCallPathAssessment": "POTENTIALLY REACHABLE: untrusted PDF bytes reach PdfReader construction, page enumeration and extract_text before/within application page/text limits. Existing child resource limits reduce impact but do not patch parser complexity.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pypdf",
"groupId": "GHSA-5hx5-vpf9-5wcv",
"identifiers": [
"CVE-2026-113786",
"GHSA-5hx5-vpf9-5wcv"
],
"originalLockedVersion": "6.16.2",
"f17dba2LockedVersion": "6.21.2",
"installedQualifiedVersion": "6.21.2",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/57/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"6.21.1"
],
"vulnerableFunction": "pypdf: Unvalidated JPEG image data loading",
"untrustedCallPathAssessment": "NO MATCHING HIGH-LEVEL CALL FOUND: extraction reads PdfReader/pages and extract_text, not writer outline removal, field/appearance, labels, embedded-file extraction or images. Shared low-level parsing dependencies remain possible.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pypdf",
"groupId": "GHSA-cgf9-327m-v77c",
"identifiers": [
"CVE-2026-113791",
"GHSA-cgf9-327m-v77c"
],
"originalLockedVersion": "6.16.2",
"f17dba2LockedVersion": "6.21.2",
"installedQualifiedVersion": "6.21.2",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/58/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"6.21.0"
],
"vulnerableFunction": "pypdf: Possible large memory usage when parsing content streams",
"untrustedCallPathAssessment": "POTENTIALLY REACHABLE: untrusted PDF bytes reach PdfReader construction, page enumeration and extract_text before/within application page/text limits. Existing child resource limits reduce impact but do not patch parser complexity.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pypdf",
"groupId": "GHSA-f54x-cmq8-qg57",
"identifiers": [
"CVE-2026-113790",
"GHSA-f54x-cmq8-qg57"
],
"originalLockedVersion": "6.16.2",
"f17dba2LockedVersion": "6.21.2",
"installedQualifiedVersion": "6.21.2",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/59/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"6.21.0"
],
"vulnerableFunction": "pypdf: Possible large memory usage when parsing arrays and dictionaries",
"untrustedCallPathAssessment": "POTENTIALLY REACHABLE: untrusted PDF bytes reach PdfReader construction, page enumeration and extract_text before/within application page/text limits. Existing child resource limits reduce impact but do not patch parser complexity.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pypdf",
"groupId": "GHSA-6vvc-x485-93v7",
"identifiers": [
"CVE-2026-113789",
"GHSA-6vvc-x485-93v7"
],
"originalLockedVersion": "6.16.2",
"f17dba2LockedVersion": "6.21.2",
"installedQualifiedVersion": "6.21.2",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/60/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"6.21.0"
],
"vulnerableFunction": "pypdf: Possible long runtimes/large memory usage when retrieving form fields",
"untrustedCallPathAssessment": "NO MATCHING HIGH-LEVEL CALL FOUND: extraction reads PdfReader/pages and extract_text, not writer outline removal, field/appearance, labels, embedded-file extraction or images. Shared low-level parsing dependencies remain possible.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pypdf",
"groupId": "GHSA-6c7f-9265-g8fw",
"identifiers": [
"CVE-2026-115572",
"GHSA-6c7f-9265-g8fw"
],
"originalLockedVersion": "6.16.2",
"f17dba2LockedVersion": "6.21.2",
"installedQualifiedVersion": "6.21.2",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/61/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"6.21.2"
],
"vulnerableFunction": "pypdf: Possible long runtimes for repeated references to the same missing object",
"untrustedCallPathAssessment": "POTENTIALLY REACHABLE: untrusted PDF bytes reach PdfReader construction, page enumeration and extract_text before/within application page/text limits. Existing child resource limits reduce impact but do not patch parser complexity.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pypdf",
"groupId": "GHSA-jr96-gvgh-j3r4",
"identifiers": [
"CVE-2026-115585",
"GHSA-jr96-gvgh-j3r4"
],
"originalLockedVersion": "6.16.2",
"f17dba2LockedVersion": "6.21.2",
"installedQualifiedVersion": "6.21.2",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/62/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"6.21.2"
],
"vulnerableFunction": "pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)",
"untrustedCallPathAssessment": "POTENTIALLY REACHABLE: untrusted PDF bytes reach PdfReader construction, page enumeration and extract_text before/within application page/text limits. Existing child resource limits reduce impact but do not patch parser complexity.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "pypdf",
"groupId": "GHSA-gmh7-3g9r-mjh5",
"identifiers": [
"CVE-2026-115580",
"GHSA-gmh7-3g9r-mjh5"
],
"originalLockedVersion": "6.16.2",
"f17dba2LockedVersion": "6.21.2",
"installedQualifiedVersion": "6.21.2",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/63/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"6.21.2"
],
"vulnerableFunction": "pypdf: Possible long runtimes for large xref table header limits",
"untrustedCallPathAssessment": "POTENTIALLY REACHABLE: untrusted PDF bytes reach PdfReader construction, page enumeration and extract_text before/within application page/text limits. Existing child resource limits reduce impact but do not patch parser complexity.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "setuptools",
"groupId": "GHSA-xmj3-9gf7-h52w",
"identifiers": [
"GHSA-xmj3-9gf7-h52w"
],
"originalLockedVersion": "84.0.0",
"f17dba2LockedVersion": "84.1.0",
"installedQualifiedVersion": "84.1.0",
"dependencyRole": "security-constrained transitive dependency",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/64/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"84.1.0"
],
"vulnerableFunction": "setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description",
"untrustedCallPathAssessment": "BUILD/INSTALL PATH: no runtime install or legacy namespace-wheel processing call is exposed by Jobjakt. Installation supply chain remains relevant, especially on Windows.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "torch",
"groupId": "CVE-2025-3001",
"identifiers": [
"BIT-pytorch-2025-3001",
"CVE-2025-3001",
"GHSA-qfhq-4f3w-5fph",
"PYSEC-2025-195"
],
"originalLockedVersion": "2.6.0+cpu",
"f17dba2LockedVersion": "2.6.0+cpu",
"installedQualifiedVersion": "2.13.0+cpu",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/65/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"2.10.0"
],
"vulnerableFunction": "torch.lstm_cell / native LSTM cell tensor validation",
"untrustedCallPathAssessment": "Installed LSTMCell forwards to _VF.lstm_cell. BART decoder uses attention, linear and layer norms, not recurrent LSTMCell. Request text becomes bounded token IDs, not arbitrary tensor dimensions or Python graphs.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/3"
}
},
{
"package": "torch",
"groupId": "CVE-2025-3000",
"identifiers": [
"BIT-pytorch-2025-3000",
"CVE-2025-3000",
"GHSA-rrmf-rvhw-rf47",
"PYSEC-2025-194"
],
"originalLockedVersion": "2.6.0+cpu",
"f17dba2LockedVersion": "2.6.0+cpu",
"installedQualifiedVersion": "2.13.0+cpu",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/66/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"2.13.0"
],
"vulnerableFunction": "torch.jit.script compilation",
"untrustedCallPathAssessment": "Application does not call script or torch.compile; model loader creates Python BART class and generate uses eager no_grad. Text cannot submit Python source or choose a compiled graph. Third-party optional branches/native internals are not runtime qualified.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/4"
}
},
{
"package": "torch",
"groupId": "CVE-2025-2999",
"identifiers": [
"BIT-pytorch-2025-2999",
"CVE-2025-2999",
"GHSA-vgrw-7cvw-pwgx",
"PYSEC-2025-193"
],
"originalLockedVersion": "2.6.0+cpu",
"f17dba2LockedVersion": "2.6.0+cpu",
"installedQualifiedVersion": "2.13.0+cpu",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/67/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"2.9.1"
],
"vulnerableFunction": "torch.nn.utils.rnn.unpack_sequence",
"untrustedCallPathAssessment": "BART accepts padded input_ids plus attention_mask and does not construct PackedSequence or unpack_sequence; malicious tensor metadata is not an HTTP input.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/5"
}
},
{
"package": "torch",
"groupId": "CVE-2025-2953",
"identifiers": [
"BIT-pytorch-2025-2953",
"CVE-2025-2953",
"GHSA-3749-ghw9-m3mg",
"PYSEC-2025-191"
],
"originalLockedVersion": "2.6.0+cpu",
"f17dba2LockedVersion": "2.6.0+cpu",
"installedQualifiedVersion": "2.13.0+cpu",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/68/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"2.7.1-rc1"
],
"vulnerableFunction": "torch.mkldnn_max_pool2d",
"untrustedCallPathAssessment": "Vendor names mkldnn_max_pool2d. BART attention/linear architecture contains no image/max-pooling layer. Raw image bytes go to separate OCR parser; they are not passed as model tensor graphs.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/6"
}
},
{
"package": "torch",
"groupId": "CVE-2025-46148",
"identifiers": [
"BIT-pytorch-2025-46148",
"CVE-2025-46148",
"PYSEC-2025-198"
],
"originalLockedVersion": "2.6.0+cpu",
"f17dba2LockedVersion": "2.6.0+cpu",
"installedQualifiedVersion": "2.13.0+cpu",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/69/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"2.7.0"
],
"vulnerableFunction": "nn.PairwiseDistance(p=2), eager/Inductor inconsistent result",
"untrustedCallPathAssessment": "Installed PairwiseDistance wrapper exists; BART/generate path does not compute pairwise distances. Vendor issue describes numeric correctness, not a demonstrated remotely supplied model graph.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/7"
}
},
{
"package": "torch",
"groupId": "CVE-2025-46149",
"identifiers": [
"BIT-pytorch-2025-46149",
"CVE-2025-46149",
"PYSEC-2025-199"
],
"originalLockedVersion": "2.6.0+cpu",
"f17dba2LockedVersion": "2.6.0+cpu",
"installedQualifiedVersion": "2.13.0+cpu",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/70/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"2.7.0"
],
"vulnerableFunction": "nn.Fold Inductor code generation assertion",
"untrustedCallPathAssessment": "Fold constructs image blocks; BART text inference has no Fold and does not call torch.compile or Inductor.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/8"
}
},
{
"package": "torch",
"groupId": "CVE-2025-46150",
"identifiers": [
"BIT-pytorch-2025-46150",
"CVE-2025-46150",
"PYSEC-2025-200"
],
"originalLockedVersion": "2.6.0+cpu",
"f17dba2LockedVersion": "2.6.0+cpu",
"installedQualifiedVersion": "2.13.0+cpu",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/71/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"2.7.0"
],
"vulnerableFunction": "FractionalMaxPool2d torch.compile correctness",
"untrustedCallPathAssessment": "No FractionalMaxPool2d in selected BART layers; application performs eager eval generation without compilation.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/9"
}
},
{
"package": "torch",
"groupId": "CVE-2025-46152",
"identifiers": [
"BIT-pytorch-2025-46152",
"CVE-2025-46152",
"PYSEC-2025-201"
],
"originalLockedVersion": "2.6.0+cpu",
"f17dba2LockedVersion": "2.6.0+cpu",
"installedQualifiedVersion": "2.13.0+cpu",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/72/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"2.7.0"
],
"vulnerableFunction": "bitwise_right_shift boundary shift in Inductor",
"untrustedCallPathAssessment": "Vendor issue concerns compiled out-of-range shift count. Application accepts text, no arbitrary shift operand/compiler graph; selected BART layer source has no bitwise_right_shift.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/10"
}
},
{
"package": "torch",
"groupId": "CVE-2025-46153",
"identifiers": [
"BIT-pytorch-2025-46153",
"CVE-2025-46153",
"PYSEC-2025-202"
],
"originalLockedVersion": "2.6.0+cpu",
"f17dba2LockedVersion": "2.6.0+cpu",
"installedQualifiedVersion": "2.13.0+cpu",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/73/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"2.7.0"
],
"vulnerableFunction": "bernoulli_p decomposition, fallback_random, Dropout1d/2d/3d",
"untrustedCallPathAssessment": "BART contains functional.dropout, so merely saying no dropout would be false. model.eval() disables training dropout; app does not enable Inductor fallback_random nor spatial Dropout1d/2d/3d.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/11"
}
},
{
"package": "torch",
"groupId": "CVE-2025-55551",
"identifiers": [
"BIT-pytorch-2025-55551",
"CVE-2025-55551",
"PYSEC-2025-203"
],
"originalLockedVersion": "2.6.0+cpu",
"f17dba2LockedVersion": "2.6.0+cpu",
"installedQualifiedVersion": "2.13.0+cpu",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/74/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"2.9.0"
],
"vulnerableFunction": "torch.linalg.lu with slicing in Inductor/AOT",
"untrustedCallPathAssessment": "Vendor issue contrasts compiled/AOT and eager LU slicing. BART attention does not perform LU decomposition and application has no compile/AOT route.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/12"
}
},
{
"package": "torch",
"groupId": "CVE-2025-55552",
"identifiers": [
"BIT-pytorch-2025-55552",
"CVE-2025-55552",
"PYSEC-2025-204"
],
"originalLockedVersion": "2.6.0+cpu",
"f17dba2LockedVersion": "2.6.0+cpu",
"installedQualifiedVersion": "2.13.0+cpu",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/75/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"2.9.0"
],
"vulnerableFunction": "torch.rot90 and randn_like compiled graph",
"untrustedCallPathAssessment": "BART does not rotate image tensors or compile rot90/randn_like graphs. Text token IDs cannot select these APIs.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/13"
}
},
{
"package": "torch",
"groupId": "CVE-2025-55553",
"identifiers": [
"BIT-pytorch-2025-55553",
"CVE-2025-55553",
"PYSEC-2025-205"
],
"originalLockedVersion": "2.6.0+cpu",
"f17dba2LockedVersion": "2.6.0+cpu",
"installedQualifiedVersion": "2.13.0+cpu",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/76/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"2.7.1"
],
"vulnerableFunction": "proxy_tensor.py tracing .random_ syntax error",
"untrustedCallPathAssessment": "Proxy tensor tracing/compiler route, not ordinary BART no_grad eager generation. Application exposes no graph tracing or caller-defined modules.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/14"
}
},
{
"package": "torch",
"groupId": "CVE-2025-55554",
"identifiers": [
"BIT-pytorch-2025-55554",
"CVE-2025-55554",
"PYSEC-2025-206"
],
"originalLockedVersion": "2.6.0+cpu",
"f17dba2LockedVersion": "2.6.0+cpu",
"installedQualifiedVersion": "2.13.0+cpu",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/77/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"2.9.0"
],
"vulnerableFunction": "torch.nan_to_num then long edge-case numeric conversion",
"untrustedCallPathAssessment": "Selected BART source has no nan_to_num().long() chain. Vendor issue remains open despite provider2.9.0 fix event; report does not infer closed/resolved from version metadata.",
"disposition": "Not affected, with evidence",
"justification": "Current-source and real-CPU BART boundary assessment excludes the named vulnerable operation from the supported fixed-model text/parser flow. This is not a global upstream fix claim.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "Published severity retained for other/library uses; not an exposed path in the qualified service scope. Reassess on any scope falsifier.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/15"
},
"currentSourceReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-current-scope.json",
"jsonPointer": "/advisories/0"
},
"upstreamState": "No verified general fix for nine named alternate-loader/conversion groups; numeric55554 has conflicting/open vendor evidence. Original source records retained. Scoped non-applicability does not close upstream issues.",
"scopeFalsifiers": [
"Any nan_to_num result cast to int64/long introduced into BART forward, generation/logits helpers or caller/custom processor.",
"CPU graph compilation explicitly enabled, different native kernel path/quantization/backend/device used, or user tensor/model/processor graph input added.",
"Evidence that the named upstream issue is reached by the exact preserved BART/logits/token-ID operations despite the absent chain."
]
},
{
"package": "torch",
"groupId": "CVE-2025-55557",
"identifiers": [
"BIT-pytorch-2025-55557",
"CVE-2025-55557",
"PYSEC-2025-207"
],
"originalLockedVersion": "2.6.0+cpu",
"f17dba2LockedVersion": "2.6.0+cpu",
"installedQualifiedVersion": "2.13.0+cpu",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/78/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"2.7.1"
],
"vulnerableFunction": "Inductor compiled cummin Triton NameError",
"untrustedCallPathAssessment": "Selected BART attention and beam generation do not call compiled cummin; eager app supplies token text and uses CPU baseline rather than authored Triton kernels.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/16"
}
},
{
"package": "torch",
"groupId": "CVE-2025-55558",
"identifiers": [
"BIT-pytorch-2025-55558",
"CVE-2025-55558",
"PYSEC-2025-208"
],
"originalLockedVersion": "2.6.0+cpu",
"f17dba2LockedVersion": "2.6.0+cpu",
"installedQualifiedVersion": "2.13.0+cpu",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/79/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"2.7.1"
],
"vulnerableFunction": "Inductor Conv2d/hardshrink/view/mv compiler failure",
"untrustedCallPathAssessment": "Vendor issue reports CppCompileError while scanner summary calls buffer overflow. BART is text attention/linear model, lacks this Conv2d/hardshrink chain, and app does not compile.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/17"
}
},
{
"package": "torch",
"groupId": "CVE-2025-55560",
"identifiers": [
"BIT-pytorch-2025-55560",
"CVE-2025-55560",
"PYSEC-2025-209"
],
"originalLockedVersion": "2.6.0+cpu",
"f17dba2LockedVersion": "2.6.0+cpu",
"installedQualifiedVersion": "2.13.0+cpu",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/80/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"2.7.1"
],
"vulnerableFunction": "Inductor to_sparse/to_dense lowering",
"untrustedCallPathAssessment": "BART does not create sparse model inputs and app does not enable Inductor. Sparse tensor graph cannot be submitted through summarize text.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/18"
}
},
{
"package": "torch",
"groupId": "CVE-2026-4538",
"identifiers": [
"BIT-pytorch-2026-4538",
"CVE-2026-4538",
"PYSEC-2026-139"
],
"originalLockedVersion": "2.6.0+cpu",
"f17dba2LockedVersion": "2.6.0+cpu",
"installedQualifiedVersion": "2.13.0+cpu",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/81/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [],
"vulnerableFunction": "torch.export.load .pt2 deserialization",
"untrustedCallPathAssessment": "Installed export.load API exists but Transformers load_state_dict uses safetensors or torch.load, not export.load. Neither app nor parser accepts .pt2 or model uploads. Fixed repository alone does not establish checkpoint integrity.",
"disposition": "Not affected, with evidence",
"justification": "Current-source and real-CPU BART boundary assessment excludes the named vulnerable operation from the supported fixed-model text/parser flow. This is not a global upstream fix claim.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "Published severity retained for other/library uses; not an exposed path in the qualified service scope. Reassess on any scope falsifier.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/19"
},
"currentSourceReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-current-scope.json",
"jsonPointer": "/advisories/1"
},
"upstreamState": "No verified general fix for nine named alternate-loader/conversion groups; numeric55554 has conflicting/open vendor evidence. Original source records retained. Scoped non-applicability does not close upstream issues.",
"scopeFalsifiers": [
"Identify exact runtime image/wheel and fixed application call path, not just version-range exclusion.",
"Show vulnerable script is absent, or exact API/model family is excluded by actual loader mapping and pinned verified config. No arbitrary caller model path/architecture/loader kwargs.",
"Trace indirect ordinary model loading separately: Transformers load_state_dict reaches torch.load(weights_only=True), not torch.export.load. Shared unsafe boundaries require independent remediation.",
"Retain upstream no-fix status, source severity and aliases. Scoped non-applicability does not mean dependency globally fixed or production accepted.",
"Limit conclusion to observed artifact identity and trusted deployment inputs; re-review on changed dispatch/config/packages or accepted formats."
]
},
{
"package": "torch",
"groupId": "CVE-2025-3730",
"identifiers": [
"BIT-pytorch-2025-3730",
"CVE-2025-3730",
"GHSA-887c-mr87-cxwp",
"PYSEC-2026-1970"
],
"originalLockedVersion": "2.6.0+cpu",
"f17dba2LockedVersion": "2.6.0+cpu",
"installedQualifiedVersion": "2.13.0+cpu",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/82/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"2.8.0"
],
"vulnerableFunction": "torch.nn.functional.ctc_loss / native LossCTC",
"untrustedCallPathAssessment": "Vendor identifies CTC loss; service invokes BARTForConditionalGeneration.generate without labels, training or CTC. OCR uses Tesseract in parser child, not torch CTC.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/20"
}
},
{
"package": "torch",
"groupId": "CVE-2026-24747",
"identifiers": [
"BIT-pytorch-2026-24747",
"CVE-2026-24747",
"GHSA-63cw-57p8-fm3p",
"PYSEC-2026-1856",
"PYSEC-2026-2286"
],
"originalLockedVersion": "2.6.0+cpu",
"f17dba2LockedVersion": "2.6.0+cpu",
"installedQualifiedVersion": "2.13.0+cpu",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/83/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"2.10.0"
],
"vulnerableFunction": "torch.load(weights_only=True) unpickler memory corruption",
"untrustedCallPathAssessment": "Actual installed load_state_dict493 forwards non-safetensors checkpoints to torch.load535 with weights_only=True. app.from_pretrained does not require safetensors or pin revision; therefore malicious or compromised model/cache checkpoint can reach vulnerable loader even though no direct app torch.load exists.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/21"
}
},
{
"package": "transformers",
"groupId": "CVE-2025-14929",
"identifiers": [
"CVE-2025-14929",
"PYSEC-2025-217"
],
"originalLockedVersion": "4.48.3",
"f17dba2LockedVersion": "4.48.3",
"installedQualifiedVersion": "5.10.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/84/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [],
"vulnerableFunction": "X-CLIP checkpoint conversion unsafe deserialization",
"untrustedCallPathAssessment": "Installed wheel contains no *convert* files under transformers/models. BART auto model selection does not run X-CLIP conversion CLI; service accepts no checkpoint conversion arguments.",
"disposition": "Not affected, with evidence",
"justification": "Current-source and real-CPU BART boundary assessment excludes the named vulnerable operation from the supported fixed-model text/parser flow. This is not a global upstream fix claim.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "Published severity retained for other/library uses; not an exposed path in the qualified service scope. Reassess on any scope falsifier.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/22"
},
"currentSourceReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-current-scope.json",
"jsonPointer": "/advisories/2"
},
"upstreamState": "No verified general fix for nine named alternate-loader/conversion groups; numeric55554 has conflicting/open vendor evidence. Original source records retained. Scoped non-applicability does not close upstream issues.",
"scopeFalsifiers": [
"Identify exact runtime image/wheel and fixed application call path, not just version-range exclusion.",
"Show vulnerable script is absent, or exact API/model family is excluded by actual loader mapping and pinned verified config. No arbitrary caller model path/architecture/loader kwargs.",
"Trace indirect ordinary model loading separately: Transformers load_state_dict reaches torch.load(weights_only=True), not torch.export.load. Shared unsafe boundaries require independent remediation.",
"Retain upstream no-fix status, source severity and aliases. Scoped non-applicability does not mean dependency globally fixed or production accepted.",
"Limit conclusion to observed artifact identity and trusted deployment inputs; re-review on changed dispatch/config/packages or accepted formats."
]
},
{
"package": "transformers",
"groupId": "CVE-2025-2099",
"identifiers": [
"CVE-2025-2099",
"GHSA-qq3j-4f4f-9583",
"PYSEC-2025-40"
],
"originalLockedVersion": "4.48.3",
"f17dba2LockedVersion": "4.48.3",
"installedQualifiedVersion": "5.10.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/85/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"4.50.0"
],
"vulnerableFunction": "testing_utils.preprocess_string doctest ReDoS",
"untrustedCallPathAssessment": "Installed2593 preprocess_string processes Python/Markdown doctest contents. App tokenizer does not use testing_utils; CV text/Markdown uploads go through parser normalization, not doctest preparation.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/23"
}
},
{
"package": "transformers",
"groupId": "CVE-2025-14926",
"identifiers": [
"CVE-2025-14926",
"PYSEC-2025-214"
],
"originalLockedVersion": "4.48.3",
"f17dba2LockedVersion": "4.48.3",
"installedQualifiedVersion": "5.10.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/86/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [],
"vulnerableFunction": "SEW conversion convert_config string eval",
"untrustedCallPathAssessment": "Conversion script is absent from installed models tree; BART inference has no SEW conversion or checkpoint argument input.",
"disposition": "Not affected, with evidence",
"justification": "Current-source and real-CPU BART boundary assessment excludes the named vulnerable operation from the supported fixed-model text/parser flow. This is not a global upstream fix claim.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "Published severity retained for other/library uses; not an exposed path in the qualified service scope. Reassess on any scope falsifier.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/24"
},
"currentSourceReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-current-scope.json",
"jsonPointer": "/advisories/3"
},
"upstreamState": "No verified general fix for nine named alternate-loader/conversion groups; numeric55554 has conflicting/open vendor evidence. Original source records retained. Scoped non-applicability does not close upstream issues.",
"scopeFalsifiers": [
"Identify exact runtime image/wheel and fixed application call path, not just version-range exclusion.",
"Show vulnerable script is absent, or exact API/model family is excluded by actual loader mapping and pinned verified config. No arbitrary caller model path/architecture/loader kwargs.",
"Trace indirect ordinary model loading separately: Transformers load_state_dict reaches torch.load(weights_only=True), not torch.export.load. Shared unsafe boundaries require independent remediation.",
"Retain upstream no-fix status, source severity and aliases. Scoped non-applicability does not mean dependency globally fixed or production accepted.",
"Limit conclusion to observed artifact identity and trusted deployment inputs; re-review on changed dispatch/config/packages or accepted formats."
]
},
{
"package": "transformers",
"groupId": "CVE-2025-14930",
"identifiers": [
"CVE-2025-14930",
"PYSEC-2025-218"
],
"originalLockedVersion": "4.48.3",
"f17dba2LockedVersion": "4.48.3",
"installedQualifiedVersion": "5.10.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/87/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [],
"vulnerableFunction": "GLM4 weights parsing unsafe deserialization",
"untrustedCallPathAssessment": "No glm4 directory in installed4.48.3; selected mapping is BART, not GLM4. Advisory version range broader than named architecture availability; no assumption newest release fixes this.",
"disposition": "Not affected, with evidence",
"justification": "Current-source and real-CPU BART boundary assessment excludes the named vulnerable operation from the supported fixed-model text/parser flow. This is not a global upstream fix claim.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "Published severity retained for other/library uses; not an exposed path in the qualified service scope. Reassess on any scope falsifier.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/25"
},
"currentSourceReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-current-scope.json",
"jsonPointer": "/advisories/4"
},
"upstreamState": "No verified general fix for nine named alternate-loader/conversion groups; numeric55554 has conflicting/open vendor evidence. Original source records retained. Scoped non-applicability does not close upstream issues.",
"scopeFalsifiers": [
"Identify exact runtime image/wheel and fixed application call path, not just version-range exclusion.",
"Show vulnerable script is absent, or exact API/model family is excluded by actual loader mapping and pinned verified config. No arbitrary caller model path/architecture/loader kwargs.",
"Trace indirect ordinary model loading separately: Transformers load_state_dict reaches torch.load(weights_only=True), not torch.export.load. Shared unsafe boundaries require independent remediation.",
"Retain upstream no-fix status, source severity and aliases. Scoped non-applicability does not mean dependency globally fixed or production accepted.",
"Limit conclusion to observed artifact identity and trusted deployment inputs; re-review on changed dispatch/config/packages or accepted formats."
]
},
{
"package": "transformers",
"groupId": "CVE-2025-14920",
"identifiers": [
"CVE-2025-14920",
"PYSEC-2025-211"
],
"originalLockedVersion": "4.48.3",
"f17dba2LockedVersion": "4.48.3",
"installedQualifiedVersion": "5.10.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/88/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [],
"vulnerableFunction": "Perceiver model conversion/deserialization",
"untrustedCallPathAssessment": "Perceiver model package exists but no conversion scripts are installed. AutoModelForSeq2SeqLM maps bart to BartForConditionalGeneration; Perceiver has distinct model/configuration and tokenizer modules. No model upload endpoint.",
"disposition": "Not affected, with evidence",
"justification": "Current-source and real-CPU BART boundary assessment excludes the named vulnerable operation from the supported fixed-model text/parser flow. This is not a global upstream fix claim.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "Published severity retained for other/library uses; not an exposed path in the qualified service scope. Reassess on any scope falsifier.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/26"
},
"currentSourceReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-current-scope.json",
"jsonPointer": "/advisories/5"
},
"upstreamState": "No verified general fix for nine named alternate-loader/conversion groups; numeric55554 has conflicting/open vendor evidence. Original source records retained. Scoped non-applicability does not close upstream issues.",
"scopeFalsifiers": [
"Identify exact runtime image/wheel and fixed application call path, not just version-range exclusion.",
"Show vulnerable script is absent, or exact API/model family is excluded by actual loader mapping and pinned verified config. No arbitrary caller model path/architecture/loader kwargs.",
"Trace indirect ordinary model loading separately: Transformers load_state_dict reaches torch.load(weights_only=True), not torch.export.load. Shared unsafe boundaries require independent remediation.",
"Retain upstream no-fix status, source severity and aliases. Scoped non-applicability does not mean dependency globally fixed or production accepted.",
"Limit conclusion to observed artifact identity and trusted deployment inputs; re-review on changed dispatch/config/packages or accepted formats."
]
},
{
"package": "transformers",
"groupId": "CVE-2025-14921",
"identifiers": [
"CVE-2025-14921",
"PYSEC-2025-212"
],
"originalLockedVersion": "4.48.3",
"f17dba2LockedVersion": "4.48.3",
"installedQualifiedVersion": "5.10.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/89/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [],
"vulnerableFunction": "Transformer-XL tokenizer/model pickle deserialization",
"untrustedCallPathAssessment": "Installed TransfoXL tokenizer explicitly contains pickle.load and warns/deprecates unsafe loading. BartTokenizer/BartTokenizerFast map uses JSON vocab/merges and byte BPE; no Transformer-XL vocab accepted by service.",
"disposition": "Not affected, with evidence",
"justification": "Current-source and real-CPU BART boundary assessment excludes the named vulnerable operation from the supported fixed-model text/parser flow. This is not a global upstream fix claim.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "Published severity retained for other/library uses; not an exposed path in the qualified service scope. Reassess on any scope falsifier.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/27"
},
"currentSourceReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-current-scope.json",
"jsonPointer": "/advisories/6"
},
"upstreamState": "No verified general fix for nine named alternate-loader/conversion groups; numeric55554 has conflicting/open vendor evidence. Original source records retained. Scoped non-applicability does not close upstream issues.",
"scopeFalsifiers": [
"Identify exact runtime image/wheel and fixed application call path, not just version-range exclusion.",
"Show vulnerable script is absent, or exact API/model family is excluded by actual loader mapping and pinned verified config. No arbitrary caller model path/architecture/loader kwargs.",
"Trace indirect ordinary model loading separately: Transformers load_state_dict reaches torch.load(weights_only=True), not torch.export.load. Shared unsafe boundaries require independent remediation.",
"Retain upstream no-fix status, source severity and aliases. Scoped non-applicability does not mean dependency globally fixed or production accepted.",
"Limit conclusion to observed artifact identity and trusted deployment inputs; re-review on changed dispatch/config/packages or accepted formats."
]
},
{
"package": "transformers",
"groupId": "CVE-2025-14924",
"identifiers": [
"CVE-2025-14924",
"PYSEC-2025-213"
],
"originalLockedVersion": "4.48.3",
"f17dba2LockedVersion": "4.48.3",
"installedQualifiedVersion": "5.10.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/90/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [],
"vulnerableFunction": "megatron_gpt2 checkpoint conversion deserialization",
"untrustedCallPathAssessment": "Conversion scripts absent in installed models tree; selected BART loader uses standard load_state_dict, not Megatron conversion. General torch.load checkpoint risk tracked separately under24747.",
"disposition": "Not affected, with evidence",
"justification": "Current-source and real-CPU BART boundary assessment excludes the named vulnerable operation from the supported fixed-model text/parser flow. This is not a global upstream fix claim.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "Published severity retained for other/library uses; not an exposed path in the qualified service scope. Reassess on any scope falsifier.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/28"
},
"currentSourceReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-current-scope.json",
"jsonPointer": "/advisories/7"
},
"upstreamState": "No verified general fix for nine named alternate-loader/conversion groups; numeric55554 has conflicting/open vendor evidence. Original source records retained. Scoped non-applicability does not close upstream issues.",
"scopeFalsifiers": [
"Identify exact runtime image/wheel and fixed application call path, not just version-range exclusion.",
"Show vulnerable script is absent, or exact API/model family is excluded by actual loader mapping and pinned verified config. No arbitrary caller model path/architecture/loader kwargs.",
"Trace indirect ordinary model loading separately: Transformers load_state_dict reaches torch.load(weights_only=True), not torch.export.load. Shared unsafe boundaries require independent remediation.",
"Retain upstream no-fix status, source severity and aliases. Scoped non-applicability does not mean dependency globally fixed or production accepted.",
"Limit conclusion to observed artifact identity and trusted deployment inputs; re-review on changed dispatch/config/packages or accepted formats."
]
},
{
"package": "transformers",
"groupId": "CVE-2025-14927",
"identifiers": [
"CVE-2025-14927",
"PYSEC-2025-215"
],
"originalLockedVersion": "4.48.3",
"f17dba2LockedVersion": "4.48.3",
"installedQualifiedVersion": "5.10.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/91/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [],
"vulnerableFunction": "SEW-D convert_config eval",
"untrustedCallPathAssessment": "SEW-D conversion source absent from installed wheel. HTTP summarize does not expose conversion/config strings or select audio model families.",
"disposition": "Not affected, with evidence",
"justification": "Current-source and real-CPU BART boundary assessment excludes the named vulnerable operation from the supported fixed-model text/parser flow. This is not a global upstream fix claim.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "Published severity retained for other/library uses; not an exposed path in the qualified service scope. Reassess on any scope falsifier.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/29"
},
"currentSourceReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-current-scope.json",
"jsonPointer": "/advisories/8"
},
"upstreamState": "No verified general fix for nine named alternate-loader/conversion groups; numeric55554 has conflicting/open vendor evidence. Original source records retained. Scoped non-applicability does not close upstream issues.",
"scopeFalsifiers": [
"Identify exact runtime image/wheel and fixed application call path, not just version-range exclusion.",
"Show vulnerable script is absent, or exact API/model family is excluded by actual loader mapping and pinned verified config. No arbitrary caller model path/architecture/loader kwargs.",
"Trace indirect ordinary model loading separately: Transformers load_state_dict reaches torch.load(weights_only=True), not torch.export.load. Shared unsafe boundaries require independent remediation.",
"Retain upstream no-fix status, source severity and aliases. Scoped non-applicability does not mean dependency globally fixed or production accepted.",
"Limit conclusion to observed artifact identity and trusted deployment inputs; re-review on changed dispatch/config/packages or accepted formats."
]
},
{
"package": "transformers",
"groupId": "CVE-2025-14928",
"identifiers": [
"CVE-2025-14928",
"PYSEC-2025-216"
],
"originalLockedVersion": "4.48.3",
"f17dba2LockedVersion": "4.48.3",
"installedQualifiedVersion": "5.10.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/92/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [],
"vulnerableFunction": "HuBERT convert_config eval",
"untrustedCallPathAssessment": "HuBERT conversion source absent from installed wheel; BART tokenizer/model path does not invoke audio conversion.",
"disposition": "Not affected, with evidence",
"justification": "Current-source and real-CPU BART boundary assessment excludes the named vulnerable operation from the supported fixed-model text/parser flow. This is not a global upstream fix claim.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "Published severity retained for other/library uses; not an exposed path in the qualified service scope. Reassess on any scope falsifier.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/30"
},
"currentSourceReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-current-scope.json",
"jsonPointer": "/advisories/9"
},
"upstreamState": "No verified general fix for nine named alternate-loader/conversion groups; numeric55554 has conflicting/open vendor evidence. Original source records retained. Scoped non-applicability does not close upstream issues.",
"scopeFalsifiers": [
"Identify exact runtime image/wheel and fixed application call path, not just version-range exclusion.",
"Show vulnerable script is absent, or exact API/model family is excluded by actual loader mapping and pinned verified config. No arbitrary caller model path/architecture/loader kwargs.",
"Trace indirect ordinary model loading separately: Transformers load_state_dict reaches torch.load(weights_only=True), not torch.export.load. Shared unsafe boundaries require independent remediation.",
"Retain upstream no-fix status, source severity and aliases. Scoped non-applicability does not mean dependency globally fixed or production accepted.",
"Limit conclusion to observed artifact identity and trusted deployment inputs; re-review on changed dispatch/config/packages or accepted formats."
]
},
{
"package": "transformers",
"groupId": "CVE-2025-3933",
"identifiers": [
"CVE-2025-3933",
"GHSA-37mw-44qp-f5jm",
"PYSEC-2026-1977"
],
"originalLockedVersion": "4.48.3",
"f17dba2LockedVersion": "4.48.3",
"installedQualifiedVersion": "5.10.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/93/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"4.52.1"
],
"vulnerableFunction": "DonutProcessor.token2json ReDoS",
"untrustedCallPathAssessment": "Actual Donut token2json regex exists in separate processor. Service document OCR invokes Tesseract/Pillow, never DonutProcessor; BART decode returns text without token2json.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/31"
}
},
{
"package": "transformers",
"groupId": "CVE-2025-6638",
"identifiers": [
"CVE-2025-6638",
"GHSA-59p9-h35m-wg4g",
"PYSEC-2026-1981"
],
"originalLockedVersion": "4.48.3",
"f17dba2LockedVersion": "4.48.3",
"installedQualifiedVersion": "5.10.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/94/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"4.53.0"
],
"vulnerableFunction": "MarianTokenizer.remove_language_code ReDoS",
"untrustedCallPathAssessment": "Marian tokenizer removes language codes; BART maps to BartTokenizer/Fast with separate vocab/merges byte BPE. Request text cannot select Marian tokenizer.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/32"
}
},
{
"package": "transformers",
"groupId": "CVE-2025-3264",
"identifiers": [
"CVE-2025-3264",
"GHSA-jjph-296x-mrcr",
"PYSEC-2026-1985"
],
"originalLockedVersion": "4.48.3",
"f17dba2LockedVersion": "4.48.3",
"installedQualifiedVersion": "5.10.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/95/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"4.51.0"
],
"vulnerableFunction": "dynamic_module_utils.get_imports Python-source regex",
"untrustedCallPathAssessment": "Installed141 get_imports reads Python code. Auto factory540 executes dynamic module path only for has_remote_code and resolved trust_remote_code. Current app does not opt in, BART has local implementation; missing immutable artifact/config identity prevents universal dispatch proof.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/33"
}
},
{
"package": "transformers",
"groupId": "CVE-2025-1194",
"identifiers": [
"CVE-2025-1194",
"GHSA-fpwr-67px-3qhx",
"PYSEC-2026-1984"
],
"originalLockedVersion": "4.48.3",
"f17dba2LockedVersion": "4.48.3",
"installedQualifiedVersion": "5.10.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/96/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"4.50.0"
],
"vulnerableFunction": "SubWordJapaneseTokenizer GPT-NeoX-Japanese ReDoS",
"untrustedCallPathAssessment": "Named GPT-NeoX-Japanese tokenizer exists as separate implementation; selected BART tokenizer uses byte BPE, not SubWordJapaneseTokenizer. Text cannot select tokenizer class directly.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/34"
}
},
{
"package": "transformers",
"groupId": "CVE-2025-3777",
"identifiers": [
"CVE-2025-3777",
"GHSA-phhr-52qp-3mj4",
"PYSEC-2026-1986"
],
"originalLockedVersion": "4.48.3",
"f17dba2LockedVersion": "4.48.3",
"installedQualifiedVersion": "5.10.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/97/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"4.52.1"
],
"vulnerableFunction": "image_utils video URL username validation",
"untrustedCallPathAssessment": "Installed4.48.3 image_utils has load_image (HTTP image URL) but no load_video/YouTube helper; video_utils.py is absent. BART receives text only; uploaded image bytes handled by PIL/Tesseract in parser, never a Transformers media URL helper.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/35"
}
},
{
"package": "transformers",
"groupId": "CVE-2025-6051",
"identifiers": [
"CVE-2025-6051",
"GHSA-rcv9-qm8p-9p6j",
"PYSEC-2026-1988"
],
"originalLockedVersion": "4.48.3",
"f17dba2LockedVersion": "4.48.3",
"installedQualifiedVersion": "5.10.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/98/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"4.53.0"
],
"vulnerableFunction": "CLVP EnglishNormalizer.normalize_numbers ReDoS",
"untrustedCallPathAssessment": "Actual normalize_numbers197 is CLVP text/audio normalizer; selected BART tokenizer has no EnglishNormalizer call. This is not generic normalize_text in parser_child.py.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/36"
}
},
{
"package": "transformers",
"groupId": "CVE-2025-6921",
"identifiers": [
"CVE-2025-6921",
"GHSA-4w7r-h757-3r74",
"PYSEC-2026-1980"
],
"originalLockedVersion": "4.48.3",
"f17dba2LockedVersion": "4.48.3",
"installedQualifiedVersion": "5.10.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/99/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"4.53.0"
],
"vulnerableFunction": "AdamWeightDecay._do_use_weight_decay user regex",
"untrustedCallPathAssessment": "TensorFlow training optimizer branch. Service performs torch.no_grad model.eval generation; no optimizer, training patterns or TensorFlow model conversion requested.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/37"
}
},
{
"package": "transformers",
"groupId": "CVE-2025-3263",
"identifiers": [
"CVE-2025-3263",
"GHSA-q2wp-rjmx-x6x9",
"PYSEC-2026-1987"
],
"originalLockedVersion": "4.48.3",
"f17dba2LockedVersion": "4.48.3",
"installedQualifiedVersion": "5.10.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/100/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"4.51.0"
],
"vulnerableFunction": "configuration_utils.get_configuration_file ReDoS",
"untrustedCallPathAssessment": "Installed1134 function consumes configuration_files list from model config in shared from_pretrained path. Fixed repository name reduces caller control but unpinned upstream/cache config remains an input; token length does not bound config filename regex.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/38"
}
},
{
"package": "transformers",
"groupId": "CVE-2025-5197",
"identifiers": [
"CVE-2025-5197",
"GHSA-9356-575x-2w9m",
"PYSEC-2026-1983"
],
"originalLockedVersion": "4.48.3",
"f17dba2LockedVersion": "4.48.3",
"installedQualifiedVersion": "5.10.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/101/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"4.53.0"
],
"vulnerableFunction": "convert_tf_weight_name_to_pt_weight_name ReDoS",
"untrustedCallPathAssessment": "Installed55 TF\u2192PyTorch converter consumes tensor weight names; app default PyTorch from_pretrained does not request from_tf or TensorFlow conversion. Checkpoint download route does not automatically imply this conversion.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/39"
}
},
{
"package": "transformers",
"groupId": "CVE-2026-1839",
"identifiers": [
"CVE-2026-1839",
"GHSA-69w3-r845-3855",
"PYSEC-2026-2288"
],
"originalLockedVersion": "4.48.3",
"f17dba2LockedVersion": "4.48.3",
"installedQualifiedVersion": "5.10.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/102/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"5.0.0rc3"
],
"vulnerableFunction": "Trainer._load_rng_state unsafe torch.load",
"untrustedCallPathAssessment": "Installed3081 helper loads training rng_state checkpoint; app uses no Trainer, training resume or optimizer. GHSA text additionally limits exploit to torch below2.6; observed metadata2.6.0 does not satisfy that textual condition, although database Transformers range still matches.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/40"
}
},
{
"package": "transformers",
"groupId": "CVE-2026-4372",
"identifiers": [
"CVE-2026-4372",
"GHSA-29pf-2h5f-8g72",
"PYSEC-2026-2289"
],
"originalLockedVersion": "4.48.3",
"f17dba2LockedVersion": "4.48.3",
"installedQualifiedVersion": "5.10.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/103/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"5.3.0"
],
"vulnerableFunction": "model initialization config attention-kernel code loading",
"untrustedCallPathAssessment": "Shared config attention field exists in4.48.3, but _autoset_attn_implementation1486 rejects non-eager/non-known attention values with ValueError1498. No Hub kernel download dispatch in that method. Vendor describes later kernel-repository execution via serialized field; broad <5.3 range needs version-specific confirmation.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/41"
}
},
{
"package": "transformers",
"groupId": "CVE-2026-5241",
"identifiers": [
"CVE-2026-5241",
"GHSA-fgcw-684q-jj6r",
"PYSEC-2026-2290"
],
"originalLockedVersion": "4.48.3",
"f17dba2LockedVersion": "4.48.3",
"installedQualifiedVersion": "5.10.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/104/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"5.5.0"
],
"vulnerableFunction": "LightGlue nested AutoConfig remote-code override",
"untrustedCallPathAssessment": "No LightGlue files/package in installed4.48.3; installed AutoModelForSeq2SeqLM maps BART and not LightGlue. Vendor report describes5.2.0 despite broad<5.5 range.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/42"
}
},
{
"package": "transformers",
"groupId": "CVE-2026-9856",
"identifiers": [
"CVE-2026-9856",
"GHSA-xrqw-3rrv-vx5w",
"PYSEC-2026-3929"
],
"originalLockedVersion": "4.48.3",
"f17dba2LockedVersion": "4.48.3",
"installedQualifiedVersion": "5.10.0",
"dependencyRole": "direct application requirement",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/105/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"5.10.0"
],
"vulnerableFunction": "tokenizer/Processor save_pretrained chat_template traversal",
"untrustedCallPathAssessment": "save_pretrained exists, but application only from_pretrained, tokenizer call/decode, model.generate; no tokenizer/processor export or user save path. Cache download writes are Hub file_download, not save_pretrained.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Actual patched Linux CPU BART serialization/tokenizer/1024-token/finite-logit generation,59 sidecar cases, private-cache/native/soft/Hub checks, parsers/OCR/HTTP and dependency/hash verification. Individual malicious exploits are not reproduced.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria.",
"researchReference": {
"path": "docs/redesign/phase-9/p9-sec-02/advisory-research.json",
"jsonPointer": "/advisories/43"
}
},
{
"package": "urllib3",
"groupId": "GHSA-vxq7-64xx-v4gw",
"identifiers": [
"CVE-2026-97689",
"GHSA-vxq7-64xx-v4gw",
"PYSEC-2026-4177"
],
"originalLockedVersion": "2.7.0",
"f17dba2LockedVersion": "2.8.0",
"installedQualifiedVersion": "2.8.0",
"dependencyRole": "security-constrained transitive dependency",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/106/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"2.8.0"
],
"vulnerableFunction": "urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory",
"untrustedCallPathAssessment": "POTENTIALLY REACHABLE through Requests/Hugging Face downloads; specific proxy/response/chunked-decoder conditions depend on upstream responses and runtime proxy configuration. No malicious server/proxy tested.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "urllib3",
"groupId": "GHSA-gh4c-6fx4-qh6g",
"identifiers": [
"CVE-2026-97688",
"GHSA-gh4c-6fx4-qh6g",
"PYSEC-2026-4176"
],
"originalLockedVersion": "2.7.0",
"f17dba2LockedVersion": "2.8.0",
"installedQualifiedVersion": "2.8.0",
"dependencyRole": "security-constrained transitive dependency",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/107/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"2.8.0"
],
"vulnerableFunction": "urllib3: Chunked Deflate streaming can enter an infinite loop",
"untrustedCallPathAssessment": "POTENTIALLY REACHABLE through Requests/Hugging Face downloads; specific proxy/response/chunked-decoder conditions depend on upstream responses and runtime proxy configuration. No malicious server/proxy tested.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
},
{
"package": "urllib3",
"groupId": "GHSA-8988-9cw3-xx77",
"identifiers": [
"CVE-2026-97687",
"GHSA-8988-9cw3-xx77",
"PYSEC-2026-4175"
],
"originalLockedVersion": "2.7.0",
"f17dba2LockedVersion": "2.8.0",
"installedQualifiedVersion": "2.8.0",
"dependencyRole": "security-constrained transitive dependency",
"originalAffectedRangesReference": {
"path": "docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json",
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"jsonPointer": "/advisories/108/publishedAffectedRangesAndVersions"
},
"publishedPatchedVersions": [
"2.8.0"
],
"vulnerableFunction": "urllib3: HTTPS proxy TLS configuration may be ignored or overridden",
"untrustedCallPathAssessment": "POTENTIALLY REACHABLE through Requests/Hugging Face downloads; specific proxy/response/chunked-decoder conditions depend on upstream responses and runtime proxy configuration. No malicious server/proxy tested.",
"disposition": "Fixed and verified",
"justification": "Exact installed version is outside the reviewed published affected range; fixed-event/version evidence retained and patched graph passes actual compatibility. This is version/compatibility verification, not an exploit reproduction.",
"confidence": "High for exact installed versions, captured source boundaries and actual tested CPU format/API paths; no universal exploit, full-model/GPU or production claim.",
"remainingSeverity": "No current exact-pin advisory match for this record; published baseline severity retained, never silently downgraded.",
"qualificationEvidence": "docs/redesign/phase-9/p9-sec-02/qualification.json",
"testScope": "Prior bounded parser/TLS/build version repair retained; current exact installed-pin audit and59-case actual source-runtime successor plus parser/OCR checks. Prior focused reproductions are not reclassified as new tests.",
"mitigations": "Immutable default repository revision, trust_remote_code=False, explicit weights_only=True; independently verified fixture files before load; fixed-model text-only input; parser child quotas; network-none/read-only private qualification caches. Deployment cache permissions are separately unverified.",
"compatibilityAndExposureLimits": "No shared live cache migration, arbitrary model/checkpoint inputs, conversion/export/compile API, GPU, full trained DistilBART, C11 semantics or deployed security acceptance.",
"ownerRiskAccepted": false,
"phase9Impact": "No remaining blocker for this specific scoped disposition; broader acceptance still requires full successor regression and independent criteria."
}
],
"additionalGroups": [
{
"package": "pytest",
"groupId": "GHSA-6w46-j5rx-g56g",
"identifiers": [
"GHSA-6w46-j5rx-g56g",
"CVE-2025-71176",
"PYSEC-2026-1845"
],
"originalScope": "New test-only group outside original109; four overlapping provider records, not four vulnerabilities.",
"before": "8.3.5",
"installedQualifiedVersion": "9.0.3",
"dependencyRole": "direct development/test dependency only",
"affectedRange": "<9.0.3",
"patchedVersion": "9.0.3",
"vulnerableFunction": "Temporary test directory ownership/permissions",
"reachability": "Local shared test/tmp environment; not installed in the production application lock. Private container/tmp reduces exposure but was not used to waive the finding.",
"disposition": "Fixed and verified",
"evidence": [
"https://github.com/pytest-dev/pytest/releases/tag/9.0.3",
"https://github.com/pytest-dev/pytest/commit/95d8423bd24992deea5b9df32555fa1741679e2c",
"docs/redesign/phase-9/p9-sec-02/qualification.json"
],
"verification": "Actual pytest9.0.3 complete59-case Linux suite and exact installed scan0records. No exploit executed.",
"ownerRiskAccepted": false
}
],
"sourceAssessments": {
"originalInventorySha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
"researchSha256": "70984291d7c76fc8b903def0807ed2a468e173e8d99bd59d85cd3f0c69fb8964",
"currentSourceSha256": "92056abac9ceecc29ba371fb65822ed0f4d4fe5453431533f62519dae18c7dfc",
"qualificationSha256": "30ef69334a1684277ebf889930d275236d4205aa19968a6ad038604fbfc2e4c0",
"exactInstalledAuditSha256": "804a01d79bb3ba295eab59284018a2060b680307720548ffcf804536a5d66fd0"
},
"formalRiskAcceptance": false,
"finalQualificationUtc": "2026-10-25T12:34:43.376715+00:00",
"finalQualification": {
"finalRuntimeQualification": {
"path": ".artifacts/p9-sec-02/model-regression/result.json",
"sha256": "41ff9bcd961120cb726c336dd6593054dfe96caf1e87781458a3b96cf591639c"
},
"trainedModelQualification": {
"path": ".artifacts/p9-sec-02/full-model/result.json",
"sha256": "a12cffa865f19bbf475f65501b17cb55dda4d79d3f5d71ae736b185425805678"
},
"finalInstalledAdvisoryScan": {
"path": ".artifacts/p9-sec-02/final-advisories/summary.json",
"sha256": "37278c67b44a07088ecb9c2bdb53a252b4aef0bf080b733ff4b8af4d160afb4b"
},
"limits": "Exact supported CPU BART/text/parser graph and private new-generation cache; no global package, full-image/stdlib/native advisory audit, old native Windows virtualenv, semantic quality, GPU, mixed-generation shared-cache migration or deployed-production safety claim. Raw scan INCOMPLETE for one known vendor PyPI404; exact OSV and official CPU wheel/vendor/source evidence supplement that unavailable response. No owner risk accepted."
}
}
Reference in New Issue View Git Blame Copy Permalink