GHSA-jm66-cg57-jjv5
Azure Core is vulnerable to deserialization of untrusted data
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| PyPI | azure-core | < 1.38.0 | 1.38.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
Deserialization of untrusted data in Azure Core shared client library for Python allows an authorized attacker to execute code over a network.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2026-21226
- https://github.com/Azure/azure-sdk-for-python
- https://github.com/Azure/azure-sdk-for-python/blob/6d2e6431ea0991861640e449e51e894247a7771a/sdk/core/azure-core/CHANGELOG.md#1380-2026-01-12
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21226