Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

dfir-unfurl

2 known vulnerabilities (1 critical, 1 high), with the versions each affects and the releases that fix them.

Latest release
20261101.0.0 (Oct 29, 2026): no advisory affects it
Newest unaffected release
20261101.0.0 (Oct 29, 2026), the latest release
Advisories
2 · 1 critical, 1 high
Weekly downloads
1,186
Dependents
1
Releases
31 since 20200629.0.0 (Jun 30, 2020)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-40036
    Affects 20200629.0.0 to 20250810.0.0 (20260405.0.0 is outside it)
  • CVE-2026-40035
    Affects 20200629.0.0 to 20250810.0.0 (20260405.0.0 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 2

  • Unfurl < 2026.04 - Denial of Service via Unbounded zlib Decompression

    Affected: fixed in 20260405.

    Fixed in 20260405.0.0 (released Apr 5, 2026, 3 days before disclosure).

    The latest release, 20261101.0.0, is not affected.

  • CVE-2026-40035Critical 9.3

    Unfurl - Werkzeug Debugger Exposure via String Config Parsing

    Affected: through 20250810.

    Fixed in 20260405.0.0 (released Apr 5, 2026, 3 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 20261101.0.0, is not affected.