CVE-2026-49265
MediumAdvisory
Published 29 Sept 2026In the index since 30 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.8
- base score, highest
- EPSS
- —
- probability of exploitation
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 524
- of 17,957 indexed, latest versions
- Container images
- 471
- deployed by those charts
- Fix available
- 1 of 1
- affected package
Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)
Carried by container images the latest versions of 524 of 17,957 indexed charts deploy, on 471 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| oauthlibpypi | 3.0.1, 3.0.2, 3.1.0, 3.1.1+4 more | 4.0.0 | 471 |
- OSV records
- GHSA-xpv3-w29h-x7cv
- Trending
- Rank 25 in indexed charts, since 30 Sept 2026. See the ranking →
Charts affected
524 by stars
Container images carrying it
471 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| buntha/ | 154542cc3083 | oauthlib | 4.0.0 | 1 |
| byjg/ | 230fdb7b00ae | oauthlib | 4.0.0 | 1 |
| camptocamp/ | ae874f70cc16 | oauthlib | 4.0.0 | 1 |
| caronc/ | cc5ef662ad2a | oauthlib | 4.0.0 | 1 |
| castai/ | da62858c8381 | oauthlib | 4.0.0 | 1 |
| cccs/ | 25fdf4aa72ab | oauthlib | 4.0.0 | 1 |
| cccs/ | ba390e87f340 | oauthlib | 4.0.0 | 1 |
| cccs/ | 0623c3fd039e | oauthlib | 4.0.0 | 1 |
| checkmk/ | c11b422210c4 | oauthlib | 4.0.0 | 1 |
| chiefonboarding/ | d0964135ea82 | oauthlib | 4.0.0 | 1 |
| codecov/ | 0475cb1c3136 | oauthlib | 4.0.0 | 1 |
| codecov/ | 837f546b479b | oauthlib | 4.0.0 | 1 |
| crocodilestick/ | c31a738b6d5e | oauthlib | 4.0.0 | 1 |
| dagster/ | 94e5e5dd6da0 | oauthlib | 4.0.0 | 1 |
| dagster/ | e29285673c2c | oauthlib | 4.0.0 | 1 |
| danialnabiyan1382/ | f96a7ebf1f42 | oauthlib | 4.0.0 | 1 |
| datadog/ | 8f20e56b5311 | oauthlib | 4.0.0 | 1 |
| datadog/ | aad9994de6a7 | oauthlib | 4.0.0 | 1 |
| datagrok/ | 8c2d48c1545c | oauthlib | 4.0.0 | 1 |
| datamate/ | 2dd66b722464 | oauthlib | 4.0.0 | 1 |
| datawire/ | 07f8fe4f4f8e | oauthlib | 4.0.0 | 1 |
| datawire/ | 2beb65062c8b | oauthlib | 4.0.0 | 1 |
| datawire/ | 9716efbdd24b | oauthlib | 4.0.0 | 1 |
| devopsgoofy/ | ad865312099f | oauthlib | 4.0.0 | 1 |
| devopstales/ | 8bb837da5aec | oauthlib | 4.0.0 | 1 |
| devopstales/ | 42c40a0e9f1b | oauthlib | 4.0.0 | 1 |
| devopstales/ | 75136aa7a26e | oauthlib | 4.0.0 | 1 |
| djjudas21/ | f17233350c4f | oauthlib | 4.0.0 | 1 |
| dockerid31415926/ | 354309669f16 | oauthlib | 4.0.0 | 1 |
| dockerid31415926/ | 5a1dd17e0e07 | oauthlib | 4.0.0 | 1 |
| dpage/ | 18cd5711fc9a | oauthlib | 4.0.0 | 1 |
| dpage/ | 37946e4f3e7b | oauthlib | 4.0.0 | 1 |
| dpage/ | 50700ac17936 | oauthlib | 4.0.0 | 1 |
| dpage/ | 52cb72a9e3da | oauthlib | 4.0.0 | 1 |
| dpage/ | 561c1f8f99f2 | oauthlib | 4.0.0 | 1 |
| dserio83/ | 6b3d9115fee2 | oauthlib | 4.0.0 | 1 |
| dserio83/ | d5deae589229 | oauthlib | 4.0.0 | 1 |
| eclipseaerios/ | d4ed3d8e5db4 | oauthlib | 4.0.0 | 1 |
| elautoestopista/ | b6f74db9fc81 | oauthlib | 4.0.0 | 1 |
| elyra/ | c922f1f1646a | oauthlib | 4.0.0 | 1 |
| evgkrsk/ | 37f0e1f435c3 | oauthlib | 4.0.0 | 1 |
| evk02/ | ef6ff257ef35 | oauthlib | 4.0.0 | 1 |
| fiware/ | 29456835bb2c | oauthlib | 4.0.0 | 1 |
| flag5/ | 4ad5748bfcc6 | oauthlib | 4.0.0 | 1 |
| flanksource/ | 689687a7cf95 | oauthlib | 4.0.0 | 1 |
| galaxy/ | e5c265fe9fcd | oauthlib | 4.0.0 | 1 |
| gethue/ | 7d5c1b9f8a79 | oauthlib | 4.0.0 | 1 |
| getsentry/ | 6ac37974fd2a | oauthlib | 4.0.0 | 1 |
| gluufederation/ | fe944d2e5d0f | oauthlib | 4.0.0 | 1 |
| gluufederation/ | 1a1128b28b95 | oauthlib | 4.0.0 | 1 |