Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

agronholm/apscheduler

              master @ 4de0633
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Denial of Service: 4 prior fixes. Scrutinize any change in this area.

apscheduler/executors/base.py: most-fixed (2 issues). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Insecure Deserialization: APScheduler allows remote attackers to execute arbitrary code via crafted JSON or CBOR payloads due to insecure object deserialization during state injection. This represents the highest severity risk in the project.

Denial of Service: Scheduling jobs far in the future causes scheduler crashes due to platform-specific OverflowErrors (specifically on Windows and Qt engines). Safeguarding these boundaries globally across all scheduler variants is necessary to prevent crashes.

Denial of Service: Cyclic references in traceback objects from failed jobs cause memory leaks that degrade system performance over time. Standard cleanup using traceback.clear_frames is required when handling job exceptions.