{
  "entries": [
    {
      "slug": "daf-sa-2026-003",
      "id": "DAF-SA-2026-003",
      "title": "Denial of service through the trace context header (OpenTelemetry)",
      "published": "2026-10-27T00:00:00.000Z",
      "updated": null,
      "severity": "High",
      "cves": [
        "CVE-2026-114603"
      ],
      "summary": "An unauthenticated request with a crafted tracestate header could stall the API and document processing for several seconds per request. Fixed in release 2026.10.24-1 (cloud) and image 2026.10.26-1 (self-hosted).",
      "credit": null,
      "announce": false,
      "products": [
        {
          "name": "DocAI Fabric cloud (US and Australia)",
          "affected": "Releases before 2026.10.24-1",
          "fixed": "2026.10.24-1, deployed 2026-10-24",
          "action": "Nothing. The fix is deployed."
        },
        {
          "name": "Self-hosted image",
          "affected": "Images before 2026.10.26-1, only when Azure Monitor telemetry is enabled (APPLICATIONINSIGHTS_CONNECTION_STRING is set)",
          "fixed": "2026.10.26-1, published 2026-10-26",
          "action": "Update the image to 2026.10.26-1 or later. A deployment without APPLICATIONINSIGHTS_CONNECTION_STRING is not affected."
        }
      ],
      "url": "https://docaifabric.com/security/advisories/daf-sa-2026-003/"
    },
    {
      "slug": "daf-sa-2026-002",
      "id": "DAF-SA-2026-002",
      "title": "Out-of-bounds write in the Brotli decoder (Node.js and Python)",
      "published": "2026-10-27T00:00:00.000Z",
      "updated": "2026-10-28T00:00:00.000Z",
      "severity": "Critical",
      "cves": [
        "CVE-2026-111497",
        "CVE-2026-105483",
        "CVE-2026-106069",
        "CVE-2026-106072",
        "CVE-2026-105481"
      ],
      "summary": "A server reached by a business rule, a model endpoint or a connector could answer with a crafted compressed response that triggers an out-of-bounds write in the Brotli decoder. Fixed in release 2026.10.24-1 (cloud) and image 2026.10.26-1 (self-hosted).",
      "credit": null,
      "announce": false,
      "products": [
        {
          "name": "DocAI Fabric cloud (US and Australia)",
          "affected": "Releases before 2026.10.24-1",
          "fixed": "2026.10.24-1, deployed 2026-10-24",
          "action": "Nothing. The fix is deployed."
        },
        {
          "name": "Self-hosted image",
          "affected": "Images before 2026.10.26-1",
          "fixed": "2026.10.26-1, published 2026-10-26",
          "action": "Update the image to 2026.10.26-1 or later."
        }
      ],
      "url": "https://docaifabric.com/security/advisories/daf-sa-2026-002/"
    },
    {
      "slug": "daf-sa-2026-001",
      "id": "DAF-SA-2026-001",
      "title": "Memory-safety vulnerabilities in image decoding (Pillow)",
      "published": "2026-10-27T00:00:00.000Z",
      "updated": null,
      "severity": "Critical",
      "cves": [
        "CVE-2026-112403",
        "CVE-2026-112395",
        "CVE-2026-112404",
        "CVE-2026-112897",
        "CVE-2026-112896",
        "CVE-2026-112397",
        "CVE-2026-112895",
        "CVE-2026-112400",
        "CVE-2026-112899"
      ],
      "summary": "A crafted image uploaded or imported into a project could trigger memory-safety bugs in the image library DocAI Fabric uses to open page images. Fixed in release 2026.10.22-1.",
      "credit": null,
      "announce": false,
      "products": [
        {
          "name": "DocAI Fabric cloud (US and Australia)",
          "affected": "Releases before 2026.10.22-1",
          "fixed": "2026.10.22-1, deployed 2026-10-22",
          "action": "Nothing. The fix is deployed."
        },
        {
          "name": "Self-hosted image",
          "affected": "Images before 2026.10.22-1",
          "fixed": "2026.10.22-1, published 2026-10-22",
          "action": "Update the image to 2026.10.26-1 or later, which also fixes DAF-SA-2026-002 and DAF-SA-2026-003."
        }
      ],
      "url": "https://docaifabric.com/security/advisories/daf-sa-2026-001/"
    }
  ]
}