Saleor

v3.22.56 Security

This release includes 6 security fixes for security teams reviewing exposed deployments.

Published 23d Productivity & Wikis

✓ No known CVEs patched

This release patches 6 known CVEs

Topics

cart checkout commerce composable e-commerce ecommerce

+12 more

graphql headless headless-commerce multichannel oms order-management payments pim python shop shopping-cart store

Affected surfaces

deps breaking_upgrade

Summary

AI summary

Multiple dependency upgrades fix CVEs including denial‑of‑service and open‑redirect vulnerabilities.

Full changelog

Upgrade 8 dependencies to latest patches by @NyanKiyoshi in https://github.com/saleor/saleor/pull/19403:

Upgraded pillow to v12.3.0 which fixes multiple out-of-bounds writes & reads, as well a denial of services vulnerabilities. Full details: https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html#security
Upgraded pyasn1 to v0.6.3 which fixes CVE-2026-30922, "Fixes Denial of Service in pyasn1 via Unbounded Recursion"
Upgraded Pygments to v2.20.0 which fixes CVE-2026-4539, "Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching"
Upgraded requests to v2.34.2 which fixes CVE-2026-25645, "Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function"
Upgraded ecdsa to v0.19.2 which fixes CVE-2026-33936, "Denial of Service via improper DER length validation in crafted private keys"
Upgraded authlib to v1.7.2 which fixes:
- CVE-2026-44681, "Open Redirect in Authlib OIDC Implicit/Hybrid Authorization"
- CVE-2026-41479, "Authlib OAuth 2.0 has Open Redirect in Authorization API that allows attacker-controlled redirect_uri through unsupported response_type"
Upgraded cryptography to v49.0.0 which applies latest OpenSSL fixes

Full Changelog: https://github.com/saleor/saleor/compare/3.22.55...3.22.56

CVE-2026-30922 — Denial of Service in pyasn1 via unbounded recursion
CVE-2026-4539 — Regular Expression Denial of Service (ReDoS) in Pygments GUID matching
CVE-2026-25645 — Insecure Temp File Reuse in requests extract_zipped_paths() utility function
CVE-2026-33936 — Denial of Service via improper DER length validation in ecdsa crafted private keys
CVE-2026-44681 — Open Redirect in Authlib OIDC Implicit/Hybrid Authorization
CVE-2026-41479 — Open Redirect in Authlib OAuth 2.0 Authorization API with unsupported response_type

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Saleor

Get notified when new releases ship.

About Saleor

Django based open-sourced e-commerce storefront.