CVE-2026-0672

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish an "alternative base64 alphabet" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.

This behavior can only be insecure if your application uses an alternate base64 alphabet (without "+/"). If your application does not use the "altchars" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.

The attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 alphabet they are expecting or verify that their application would not be affected if the b64decode() functions accepted "+" or "/" outside of altchars.(CVE-2025-12781)

The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.(CVE-2025-15367)

When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.(CVE-2026-0672)

The wsgiref.headers.Headers module has an HTTP header injection vulnerability where user-controlled header names and values containing newlines can allow injecting malicious HTTP headers.(CVE-2026-0865)

The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. This is only applicable if using "LiteralHeader" writing headers that don't respect email folding rules, the new behavior will reject the incorrectly folded headers in "BytesGenerator".(CVE-2026-1299)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish an "alternative base64 alphabet" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.

This behavior can only be insecure if your application uses an alternate base64 alphabet (without "+/"). If your application does not use the "altchars" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.

The attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 alphabet they are expecting or verify that their application would not be affected if the b64decode() functions accepted "+" or "/" outside of altchars.(CVE-2025-12781)

The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.(CVE-2025-15367)

When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.(CVE-2026-0672)

The wsgiref.headers.Headers module has an HTTP header injection vulnerability where user-controlled header names and values containing newlines can allow injecting malicious HTTP headers.(CVE-2026-0865)

The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. This is only applicable if using "LiteralHeader" writing headers that don't respect email folding rules, the new behavior will reject the incorrectly folded headers in "BytesGenerator".(CVE-2026-1299)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish an "alternative base64 alphabet" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.

This behavior can only be insecure if your application uses an alternate base64 alphabet (without "+/"). If your application does not use the "altchars" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.

The attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 alphabet they are expecting or verify that their application would not be affected if the b64decode() functions accepted "+" or "/" outside of altchars.(CVE-2025-12781)

The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.(CVE-2025-15367)

When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.(CVE-2026-0672)

The wsgiref.headers.Headers module has an HTTP header injection vulnerability where user-controlled header names and values containing newlines can allow injecting malicious HTTP headers.(CVE-2026-0865)

The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. This is only applicable if using "LiteralHeader" writing headers that don't respect email folding rules, the new behavior will reject the incorrectly folded headers in "BytesGenerator".(CVE-2026-1299)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

In CPython's email module, when folding a long comment containing exclusively unfoldable characters, the parentheses are not preserved. This could be exploited to inject headers into email messages in scenarios where email addresses are user-controlled and not sanitized.(CVE-2025-11468)

When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish an "alternative base64 alphabet" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.

This behavior can only be insecure if your application uses an alternate base64 alphabet (without "+/"). If your application does not use the "altchars" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.

The attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 alphabet they are expecting or verify that their application would not be affected if the b64decode() functions accepted "+" or "/" outside of altchars.(CVE-2025-12781)

User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.(CVE-2025-15282)

The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.(CVE-2025-15367)

When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.(CVE-2026-0672)

The wsgiref.headers.Headers module has an HTTP header injection vulnerability where user-controlled header names and values containing newlines can allow injecting malicious HTTP headers.(CVE-2026-0865)

The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. This is only applicable if using "LiteralHeader" writing headers that don't respect email folding rules, the new behavior will reject the incorrectly folded headers in "BytesGenerator".(CVE-2026-1299)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.(CVE-2026-0672)

The wsgiref.headers.Headers module has an HTTP header injection vulnerability where user-controlled header names and values containing newlines can allow injecting malicious HTTP headers.(CVE-2026-0865)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.(CVE-2026-0672)

The wsgiref.headers.Headers module has an HTTP header injection vulnerability where user-controlled header names and values containing newlines can allow injecting malicious HTTP headers.(CVE-2026-0865)

The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. This is only applicable if using "LiteralHeader" writing headers that don't respect email folding rules, the new behavior will reject the incorrectly folded headers in "BytesGenerator".(CVE-2026-1299)

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)

• python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

• cpython: Out-of-memory when loading Plist (CVE-2025-13837)

• cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)

• cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)

• cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)

• cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)

• cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)

• python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)

• python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)

• python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)

• python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

• cpython: Out-of-memory when loading Plist (CVE-2025-13837)

• cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)

• cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)

• cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)

• cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)

• cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)

• python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)

• python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)

• python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)

• python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)

• python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

• cpython: Out-of-memory when loading Plist (CVE-2025-13837)

• cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)

• cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)

• cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)

• cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)

• cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)

• python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)

• python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)

• python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)

• python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)
• python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)
• cpython: Out-of-memory when loading Plist (CVE-2025-13837)
• cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)
• cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)
• cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)
• cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)
• cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)
• python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)
• python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)
• python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)
• python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)
• cpython: Out-of-memory when loading Plist (CVE-2025-13837)
• cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)
• cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)
• cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)
• cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)
• cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)
• python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)
• python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)
• python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)
• python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)
• python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)
• cpython: Out-of-memory when loading Plist (CVE-2025-13837)
• cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)
• cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)
• cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)
• cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)
• cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)
• python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)
• python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)
• python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)
• python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.

When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.

When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.

When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.

When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.

• CVE-2025-8291: fix zipfile ZIP64 EOCD Locator offset validation
• CVE-2025-6069: fix quadratic complexity in HTMLParser
• CVE-2025-4516: fix use-after-free in unicode-escape decoder with error handler
• CVE-2026-2297: ensure SourcelessFileLoader uses io.open_code
• CVE-2026-3479: reject invalid resource arguments in pkgutil.get_data()
• CVE-2025-1795: fix email header list separator incorrectly encoded during folding
• CVE-2026-0672: reject control characters in http cookies
• CVE-2025-15282: reject control characters in data URL mediatypes
• CVE-2026-3644: reject control characters in http.cookies.Morsel.update(), |=, unpickling, and js_output()
• CVE-2026-4224: avoid unbound C recursion in conv_content_model in pyexpat.c
• CVE-2025-11468: preserve parens when folding email comments to prevent header injection

• CVE-2026-0672: reject control characters in http.cookies cookie names, values, and parameters to prevent header injection
• CVE-2026-3644: reject control characters in Morsel.update(), |= operator, and unpickling paths missed by CVE-2026-0672; add output validation to BaseCookie.js_output()
• CVE-2026-2297: ensure SourcelessFileLoader uses io.open_code so sys.audit handlers fire for legacy .pyc imports
• CVE-2025-8291: validate ZIP64 End of Central Directory locator offset to prevent ZIP archive parser confusion
• CVE-2025-6069: fix quadratic complexity in html.parser.HTMLParser when processing crafted malformed inputs
• CVE-2025-4516: fix use-after-free in unicode-escape decoder when an error handler is invoked
• CVE-2025-1795: stop incorrectly RFC 2047 encoding the comma separator when an address list is folded

• CVE-2026-4224: avoid unbound C recursion in conv_content_model in pyexpat
• CVE-2026-3644: reject control characters in http.cookies.Morsel.update()
• CVE-2026-0672: reject control characters in http.cookies.Morsel
• CVE-2025-8291: check consistency of zip64 end of central directory record
• CVE-2025-6069: fix quadratic complexity in processing special input in HTMLParser
• CVE-2025-4516: fix use-after-free in the unicode-escape decoder with error handler
• CVE-2025-15282: reject control characters in data URL mediatypes
• CVE-2025-11468: preserve parenthesis when folding email comments
• CVE-2026-3479: reject invalid resource arguments in pkgutil.get_data()
• CVE-2026-2297: ensure SourcelessFileLoader uses io.open_code
• CVE-2024-5642: disallow setting an empty list for ssl NPN protocols

• CVE-2026-0672: reject control characters in http.cookies.Morsel keys/values
• CVE-2026-3644: extend control-character rejection to Morsel.update(), |=, and setstate
• CVE-2026-4224: avoid unbound C recursion in pyexpat conv_content_model for deeply nested DTDs
• CVE-2026-1502: reject CR/LF in HTTP tunnel request headers and tunnel host

• SECURITY UPDATE: C stack overflow (DoS) in pyexpat when parsing deeply nested DTD content models
  • debian/patches/CVE-2026-4224.patch: guard conv_content_model() in Modules/pyexpat.c with Py_EnterRecursiveCall/Py_LeaveRecursiveCall to bound recursion when a registered ElementDeclHandler converts a deeply nested content model.
  • CVE-2026-4224
• SECURITY UPDATE: HTTP header injection via control characters in cookies
  • debian/patches/CVE-2026-0672.patch: add _has_control_character() and reject control characters in Morsel.setitem()/setdefault()/set() and BaseCookie.output() in Lib/http/cookies.py.
  • CVE-2026-0672
• SECURITY UPDATE: incomplete fix for CVE-2026-0672 (control characters in cookies via additional Morsel paths)
  • debian/patches/CVE-2026-3644.patch: reject control characters in Morsel.update(), Morsel.setstate() and Morsel.js_output() in Lib/http/cookies.py.
  • CVE-2026-3644
• SECURITY UPDATE: tarfile member type confusion (regular file parsed as directory) via GNU long name/link headers
  • debian/patches/CVE-2025-13462.patch: skip the AREGTYPE->DIRTYPE normalization while reading GNU LONGNAME/LONGLINK and PAX follow-up headers (dircheck=False) in Lib/tarfile.py.
  • CVE-2025-13462

• SECURITY UPDATE: C stack overflow (DoS) in pyexpat when parsing deeply nested DTD content models
  • debian/patches/CVE-2026-4224.patch: guard conv_content_model() in Modules/pyexpat.c with Py_EnterRecursiveCall/Py_LeaveRecursiveCall to bound recursion when a registered ElementDeclHandler converts a deeply nested content model.
  • CVE-2026-4224
• SECURITY UPDATE: HTTP header injection via control characters in cookies
  • debian/patches/CVE-2026-0672.patch: add _has_control_character() and reject control characters in Morsel.setitem()/setdefault()/set() and BaseCookie.output() in Lib/http/cookies.py.
  • CVE-2026-0672
• SECURITY UPDATE: incomplete fix for CVE-2026-0672 (control characters in cookies via additional Morsel paths)
  • debian/patches/CVE-2026-3644.patch: reject control characters in Morsel.update(), Morsel.setstate() and Morsel.js_output() in Lib/http/cookies.py.
  • CVE-2026-3644
• SECURITY UPDATE: tarfile member type confusion (regular file parsed as directory) via GNU long name/link headers
  • debian/patches/CVE-2025-13462.patch: skip the AREGTYPE->DIRTYPE normalization while reading GNU LONGNAME/LONGLINK and PAX follow-up headers (dircheck=False) in Lib/tarfile.py.
  • CVE-2025-13462

• SECURITY UPDATE: C stack overflow (DoS) in pyexpat when parsing deeply nested DTD content models
  • debian/patches/CVE-2026-4224.patch: guard conv_content_model() in Modules/pyexpat.c with Py_EnterRecursiveCall/Py_LeaveRecursiveCall to bound recursion when a registered ElementDeclHandler converts a deeply nested content model.
  • CVE-2026-4224
• SECURITY UPDATE: HTTP header injection via control characters in cookies
  • debian/patches/CVE-2026-0672.patch: reject control characters in Morsel.setitem()/set(), add a validating Morsel.setdefault() override, and guard BaseCookie.output() in Lib/Cookie.py.
  • CVE-2026-0672
• SECURITY UPDATE: incomplete fix for CVE-2026-0672 (control characters in cookies via additional Morsel paths)
  • debian/patches/CVE-2026-3644.patch: add a validating Morsel.update() override and reject control characters in Morsel.js_output() in Lib/Cookie.py.
  • CVE-2026-3644
• SECURITY UPDATE: tarfile member type confusion (regular file parsed as directory) via GNU long name/link headers
  • debian/patches/CVE-2025-13462.patch: skip the AREGTYPE->DIRTYPE normalization while reading GNU LONGNAME/LONGLINK and PAX follow-up headers (dircheck=False) in Lib/tarfile.py.
  • CVE-2025-13462

• SECURITY UPDATE: tarfile AREGTYPE->DIRTYPE misnormalization of multi-block member headers
  • debian/patches/CVE-2025-13462.patch: in Lib/tarfile.py, add a dircheck flag to frombuf()/fromtarfile() and read the follow-up header of GNU long-name and PAX multi-block members with dircheck=False in _proc_gnulong()/_proc_pax(), so the old-V7 "AREGTYPE name ending in / is a directory" normalization is no longer applied to a follow-up header based on its truncated name. Prevents a crafted tar archive from being interpreted differently by tarfile than by other tools. Backport of upstream commit 42d754e34c (gh-141707), the same fix shipped by Debian in DLA-4583-1; applies to 3.7.3 without code changes (the affected functions are structurally identical). Bundles the upstream regression test test_longname_file_not_directory (test_tarfile.py).
  • CVE-2025-13462
• SECURITY UPDATE: C stack overflow in pyexpat via deeply nested DTD content model
  • debian/patches/CVE-2026-4224.patch: guard the recursion in Modules/pyexpat.c conv_content_model() with Py_EnterRecursiveCall()/Py_LeaveRecursiveCall() so a deeply nested inline DTD content model parsed by an Expat parser with a registered ElementDeclHandler raises RecursionError instead of crashing the interpreter. Adapted from upstream commit eb0e8be3a7 (gh-145986); upstream uses the private _Py_EnterRecursiveCall() API, replaced here with the equivalent public 3.7 macros. The upstream regression test is not bundled (it needs 3.7-absent test.support helpers and a 500000-deep model); the fix was verified manually.
  • CVE-2026-4224
• SECURITY UPDATE: control-character injection in http.cookies (HTTP response splitting)
  • debian/patches/CVE-2026-3644.patch: reject control characters (\x00-\x1F, \x7F) in Lib/http/cookies.py across all Morsel/BaseCookie paths via a new _has_control_character() helper. CVE-2026-3644 is the incomplete-fix follow-up to CVE-2026-0672 and its upstream fix (commit 57e88c1cf9, gh-145599) depends on the helper introduced by the CVE-2026-0672 base commit (95746b3a13, gh-143919). 3.7.3 shipped neither fix, so this patch bundles both: the base validation in Morsel.setitem/setdefault/set and BaseCookie.output, plus the follow-up validation in Morsel.update/setstate and BaseCookie.js_output. Also closes CVE-2026-0672. The upstream Morsel.ior override is omitted: it only exists to neutralize dict.ior (PEP 584, Python 3.9+), which 3.7 does not have, so there is no |= bypass to close. The module docstring doctest and the test_basic keebler fixture in test_http_cookies.py are updated to drop a \012 control character now rejected by load(), and the upstream regression tests test_control_characters/test_control_characters_output are bundled with the test.support.control_characters_c0() helper they require.
  • CVE-2026-3644

• SECURITY UPDATE: C stack overflow (DoS) in pyexpat when parsing deeply nested DTD content models
  • debian/patches/CVE-2026-4224.patch: guard conv_content_model() in Modules/pyexpat.c with Py_EnterRecursiveCall/Py_LeaveRecursiveCall to bound recursion when a registered ElementDeclHandler converts a deeply nested content model.
  • CVE-2026-4224
• SECURITY UPDATE: HTTP header injection via control characters in cookies
  • debian/patches/CVE-2026-0672.patch: reject control characters in Morsel.setitem()/set(), add a validating Morsel.setdefault() override, and guard BaseCookie.output() in Lib/Cookie.py.
  • CVE-2026-0672
• SECURITY UPDATE: incomplete fix for CVE-2026-0672 (control characters in cookies via additional Morsel paths)
  • debian/patches/CVE-2026-3644.patch: add a validating Morsel.update() override and reject control characters in Morsel.js_output() in Lib/Cookie.py.
  • CVE-2026-3644
• SECURITY UPDATE: tarfile member type confusion (regular file parsed as directory) via GNU long name/link headers
  • debian/patches/CVE-2025-13462.patch: skip the AREGTYPE->DIRTYPE normalization while reading GNU LONGNAME/LONGLINK and PAX follow-up headers (dircheck=False) in Lib/tarfile.py.
  • CVE-2025-13462

• CVE-2026-0672: reject control characters in http.cookies.Morsel fields and values
• CVE-2026-3644: complete CVE-2026-0672 fix: reject control chars in Morsel.update(), |=, unpickling and js_output()
• CVE-2026-4224: avoid unbound C recursion in pyexpat conv_content_model to prevent C stack overflow
• CVE-2025-13462: skip TarInfo AREGTYPE->DIRTYPE normalization on GNU longname/longlink follow-up headers in tarfile

• CVE-2026-0672: reject control characters in http.cookies.Morsel fields and values
• CVE-2026-3644: complete CVE-2026-0672 fix: reject control chars in Morsel.update(), |=, unpickling and js_output()
• CVE-2026-4224: avoid unbound C recursion in pyexpat conv_content_model to prevent C stack overflow
• CVE-2025-13462: skip TarInfo AREGTYPE->DIRTYPE normalization on GNU longname/longlink follow-up headers in tarfile

• CVE-2026-0672: reject control characters in http.cookies.Morsel fields and values
• CVE-2026-3644: complete CVE-2026-0672 fix: reject control chars in Morsel.update(), |=, unpickling and js_output()
• CVE-2026-4224: avoid unbound C recursion in pyexpat conv_content_model to prevent C stack overflow
• CVE-2025-13462: skip TarInfo AREGTYPE->DIRTYPE normalization on GNU longname/longlink follow-up headers in tarfile

• SECURITY UPDATE: Control characters not rejected in Cookie module (HTTP header injection)
  • debian/patches/CVE-2026-0672.patch: add _has_control_character() helper and reject control characters in Morsel.setitem(), Morsel.set() and BaseCookie.output() in Lib/Cookie.py, plus regression tests in Lib/test/test_cookie.py
  • CVE-2026-0672
• SECURITY UPDATE: Incomplete rejection of control characters in Cookie module
  • debian/patches/CVE-2026-3644.patch: add control character validation to Morsel.update() and Morsel.js_output() in Lib/Cookie.py
  • CVE-2026-3644
• SECURITY UPDATE: C stack overflow via deeply nested inline DTD content model in pyexpat
  • debian/patches/CVE-2026-4224.patch: add Py_EnterRecursiveCall/Py_LeaveRecursiveCall guards to conv_content_model() in Modules/pyexpat.c to prevent unbounded C recursion when ElementDeclHandler is registered
  • CVE-2026-4224

• CVE-2026-0672: reject control characters in http.cookies Morsel keys, values, and parameters (and in BaseCookie.output) to prevent HTTP header injection via user-controlled cookie data
• CVE-2026-3644: follow-up to CVE-2026-0672, rejecting control characters in the http.cookies.Morsel paths the original fix missed (update(), the |= operator, and unpickling) and validating Morsel.js_output() output
• CVE-2026-4224: guard conv_content_model() in pyexpat against unbounded C recursion when an ElementDeclHandler parses a deeply nested inline DTD content model, raising RecursionError instead of crashing the interpreter

• CVE-2026-0672: reject control characters in http.cookies Morsel keys, values, and parameters (and in BaseCookie.output) to prevent HTTP header injection via user-controlled cookie data
• CVE-2026-3644: follow-up to CVE-2026-0672, rejecting control characters in the http.cookies.Morsel paths the original fix missed (update(), the |= operator, and unpickling) and validating Morsel.js_output() output
• CVE-2026-4224: guard conv_content_model() in pyexpat against unbounded C recursion when an ElementDeclHandler parses a deeply nested inline DTD content model, raising RecursionError instead of crashing the interpreter

• CVE-2026-0672: reject control characters in http.cookies Morsel keys, values, and parameters (and in BaseCookie.output) to prevent HTTP header injection via user-controlled cookie data
• CVE-2026-3644: follow-up to CVE-2026-0672, rejecting control characters in the http.cookies.Morsel paths the original fix missed (update(), the |= operator, and unpickling) and validating Morsel.js_output() output
• CVE-2026-4224: guard conv_content_model() in pyexpat against unbounded C recursion when an ElementDeclHandler parses a deeply nested inline DTD content model, raising RecursionError instead of crashing the interpreter

• CVE-2026-0672: reject control characters in the Cookie module - add the _has_control_character() helper and validate in Morsel.setitem, Morsel.setdefault(), Morsel.set() and BaseCookie.output(). Applied as the prerequisite for CVE-2026-3644; Python 2.7.5 shipped neither fix.
• CVE-2026-3644: reject control characters in Morsel.update(), the unpickling path (Morsel.setstate) and Morsel.js_output().
• CVE-2026-4224: guard conv_content_model() in pyexpat with Py_EnterRecursiveCall()/Py_LeaveRecursiveCall() to avoid a C stack overflow when parsing a deeply nested content model in an inline DTD with a registered ElementDeclHandler.
• CVE-2025-13462: skip the old-v7 AREGTYPE -> DIRTYPE normalization in tarfile when reading a follow-up header (GNU long name/link or PAX extended header), so crafted multi-block members are no longer misinterpreted.

• CVE-2026-0672: reject control characters in the Cookie module - add the _has_control_character() helper and validate in Morsel.setitem, Morsel.setdefault(), Morsel.set() and BaseCookie.output(). Applied as the prerequisite for CVE-2026-3644; Python 2.7.5 shipped neither fix.
• CVE-2026-3644: reject control characters in Morsel.update(), the unpickling path (Morsel.setstate) and Morsel.js_output().
• CVE-2026-4224: guard conv_content_model() in pyexpat with Py_EnterRecursiveCall()/Py_LeaveRecursiveCall() to avoid a C stack overflow when parsing a deeply nested content model in an inline DTD with a registered ElementDeclHandler.
• CVE-2025-13462: skip the old-v7 AREGTYPE -> DIRTYPE normalization in tarfile when reading a follow-up header (GNU long name/link or PAX extended header), so crafted multi-block members are no longer misinterpreted.

Please see the references for additional information about vulnerabilities.

These are all security issues fixed in the python315-3.15.0~a3-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-3.10.19-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python314-3.14.3-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python311-3.11.14-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python312-3.12.12-5.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-3.13.12-1.1 package on the GA media of openSUSE Tumbleweed.