GitHub's reviewed advisory database added two Python parser batches on Oct 30. Neither is reported exploited, but both libraries are pulled in transitively by many services that parse untrusted input.

• pyasn1 ≤ 0.6.4 → fix 0.6.5 (all CVSS 3.1 7.5): quadratic CPU in schemaless BER/CER/DER container decoding (CVE-2026-119194, GHSA-fm9c-5rcf-2q5p; colliding tag-set hashes); constructed string and indefinite-length ANY decoding (CVE-2026-119195); constructed BIT STRING decoding (CVE-2026-119196); binary REAL decoding (CVE-2026-119197).
• pypdf → fixes 6.21.3 / 6.21.4 (CVSS 4.0 7.1): infinite loop at EOF during xref trailer search (CVE-2026-119203), memory blow-up parsing the page tree (119204), infinite loop cloning dictionaries (119205), all fixed in 6.21.4; long runtimes retrieving page labels (119206), memory use for exceptions in strict mode (119207), encrypted PDFs with a wrong /Count (119208) and cross-reference stream parsing (119209), fixed in 6.21.3.

Who should care: anything that decodes attacker-supplied ASN.1 (LDAP/ldap3, SNMP/pysnmp, Kerberos, certificate tooling, older google-auth/rsa stacks) or ingests user-uploaded PDFs (document pipelines, RAG and agent loaders, mail scanners). What to do: pin pyasn1>=0.6.5 and pypdf>=6.21.4, rebuild images, and run PDF parsing in a worker with CPU-time and memory limits so one bad file cannot stall the service.