gitsafehub
github.com/redis/redis-benchmarks-specification ↗

redis/redis-benchmarks-specification

scanned 2026-07-08 · git 25bb7c0
1 of 6 checks flagged a security issue
🟡 Worth a look
Only 4 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets—Vulnerable dependencies45Known OSS vulnerabilities—Risky code patterns✓Malicious dependencies✓Project health8

Security checks

Leaked secrets — Gitleaksⓘ timed out

API keys, passwords or tokens committed into the repo.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Gitleaks v8.21.2 · MIT

error: timeout after 120s

Vulnerable dependencies — Trivyⓘ 45 found

Packages you depend on that have known security holes (CVEs).

  • Worth fixing CVE-2026-26007 cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves
    poetry.lock
    A package you depend on has a known security hole (CVE-2026-26007). Fix: Update that package to its patched version.
  • Worth fixing GHSA-537c-gmf6-5ccf Vulnerable OpenSSL included in cryptography wheels
    poetry.lock
    A package you depend on has a known security hole (GHSA-537c-gmf6-5ccf). Fix: Update that package to its patched version.
  • Worth fixing GHSA-h4gh-qq45-vh27 pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels
    poetry.lock
    A package you depend on has a known security hole (GHSA-h4gh-qq45-vh27). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-34531 Flask-HTTPAuth provides Basic, Digest and Token HTTP authentication fo ...
    poetry.lock
    A package you depend on has a known security hole (CVE-2026-34531). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-66034 fonttools: fontTools: Arbitrary file write leading to remote code execution via malicious .designspace file
    poetry.lock
    A package you depend on has a known security hole (CVE-2025-66034). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-42215 GitPython is a python library used to interact with Git repositories. ...
    poetry.lock
    A package you depend on has a known security hole (CVE-2026-42215). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-42284 GitPython is a python library used to interact with Git repositories. ...
    poetry.lock
    A package you depend on has a known security hole (CVE-2026-42284). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-44243 GitPython: GitPython: Arbitrary file write via crafted reference paths
    poetry.lock
    A package you depend on has a known security hole (CVE-2026-44243). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-44244 GitPython is a python library used to interact with Git repositories. ...
    poetry.lock
    A package you depend on has a known security hole (CVE-2026-44244). Fix: Update that package to its patched version.
  • Worth fixing GHSA-mv93-w799-cj2w GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath
    poetry.lock
    A package you depend on has a known security hole (GHSA-mv93-w799-cj2w). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-45409 Internationalized Domain Names in Applications (IDNA) for Python provi ...
    poetry.lock
    A package you depend on has a known security hole (CVE-2026-45409). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-56201 jinja2: Jinja has a sandbox breakout through malicious filenames
    poetry.lock
    A package you depend on has a known security hole (CVE-2024-56201). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-56326 jinja2: Jinja has a sandbox breakout through indirect reference to format method
    poetry.lock
    A package you depend on has a known security hole (CVE-2024-56326). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-27516 jinja2: Jinja sandbox breakout through attr filter selecting format method
    poetry.lock
    A package you depend on has a known security hole (CVE-2025-27516). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-68480 github.com/marshmallow-code/marshmallow: Marshmallow: Denial of Service via crafted request to Schema.load function
    poetry.lock
    A package you depend on has a known security hole (CVE-2025-68480). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-25990 pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image
    poetry.lock
    A package you depend on has a known security hole (CVE-2026-25990). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-40192 Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing
    poetry.lock
    A package you depend on has a known security hole (CVE-2026-40192). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-42311 Pillow: python-pillow: Pillow: Arbitrary code execution via malicious PSD file processing
    poetry.lock
    A package you depend on has a known security hole (CVE-2026-42311). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-42308 Pillow: python: Pillow: Denial of Service via integer overflow in font processing
    poetry.lock
    A package you depend on has a known security hole (CVE-2026-42308). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-42310 Pillow: Pillow: Denial of Service via malicious PDF processing
    poetry.lock
    A package you depend on has a known security hole (CVE-2026-42310). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-32597 pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
    poetry.lock
    A package you depend on has a known security hole (CVE-2026-32597). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-48526 python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens
    poetry.lock
    A package you depend on has a known security hole (CVE-2026-48526). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-48522 python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient
    poetry.lock
    A package you depend on has a known security hole (CVE-2026-48522). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-48523 python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access
    poetry.lock
    A package you depend on has a known security hole (CVE-2026-48523). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-48525 python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens
    poetry.lock
    A package you depend on has a known security hole (CVE-2026-48525). Fix: Update that package to its patched version.
… 20 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ timed out

Your dependencies cross-checked against the OSV vulnerability database.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OSV-Scanner v1.9.2 · Apache-2.0

error: timeout after 120s

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ 8 notes

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

  • Minor scorecard-overall OpenSSF Scorecard overall: 4.3/10
    A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.
  • Minor scorecard-CII-Best-Practices CII-Best-Practices scored 0: no effort to earn an OpenSSF best practices badge detected
    A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.
  • Minor scorecard-Dependency-Update-Tool Dependency-Update-Tool scored 0: no update tool detected
    A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.
  • Minor scorecard-Fuzzing Fuzzing scored 0: project is not fuzzed
    A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.
  • Minor scorecard-Pinned-Dependencies Pinned-Dependencies scored 0: dependency not pinned by hash detected -- score normalized to 0
    A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.
  • Minor scorecard-SAST SAST scored 0: SAST tool is not run on all commits -- score normalized to 0
    A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.
  • Minor scorecard-Security-Policy Security-Policy scored 0: security policy file not detected
    A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.
  • Minor scorecard-Token-Permissions Token-Permissions scored 0: detected GitHub workflow tokens with excessive permissions
    A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.

via OpenSSF Scorecard v5.5.0 · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.