CVE-2021-4189

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.(CVE-2022-0391)

An attacker could exploit this vulnerability to set up a malicious FTP server that could trick an FTP client into connecting back to a given IP address and port. This can cause the FTP client to scan the port.(CVE-2021-4189)

Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 packages provide a stable release of Python 2.7 with a number of additional utilities and database connectors for MySQL and PostgreSQL.

Security Fix(es):

• python: urllib: Regular expression DoS in AbstractBasicAuthHandler (CVE-2021-3733)

• python: ftplib should not use the host from the PASV response (CVE-2021-4189)

• python-lxml: HTML Cleaner allows crafted and SVG embedded scripts to pass through (CVE-2021-43818)

• python: urllib.parse does not sanitize URLs containing ASCII newline and tabs (CVE-2022-0391)

• python: urllib: HTTP client possible infinite loop on a 100 Continue response (CVE-2021-3737)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.

Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 packages provide a stable release of Python 2.7 with a number of additional utilities and database connectors for MySQL and PostgreSQL.

Security Fix(es):

• python: urllib: Regular expression DoS in AbstractBasicAuthHandler (CVE-2021-3733)

• python: ftplib should not use the host from the PASV response (CVE-2021-4189)

• python-lxml: HTML Cleaner allows crafted and SVG embedded scripts to pass through (CVE-2021-43818)

• python: urllib.parse does not sanitize URLs containing ASCII newline and tabs (CVE-2022-0391)

• python: urllib: HTTP client possible infinite loop on a 100 Continue response (CVE-2021-3737)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: ftplib should not use the host from the PASV response (CVE-2021-4189)

• python: urllib: HTTP client possible infinite loop on a 100 Continue response (CVE-2021-3737)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.

A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.

A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.

• SECURITY UPDATE: Expose sensitive information
  • debian/patches/CVE-2021-4189.patch: alters ftplib.FTP class behavior to not trust the IPv4 address sent from the remote server when setting up a passive data channel in resposne in Lib/ftplib.py, Lib/test/test_ftplib.py.
  • CVE-2021-4189

• SECURITY UPDATE: Expose sensitive information
  • debian/patches/CVE-2021-4189.patch: alters ftplib.FTP class behavior to not trust the IPv4 address sent from the remote server when setting up a passive data channel in resposne in Lib/ftplib.py, Lib/test/test_ftplib.py.
  • CVE-2021-4189

• CVE-2021-3426: Remove the pydoc getfile feature which could lead to information disclosure (rhbz#1935913)
• CVE-2021-3737: urllib: HTTP client possible infinite loop on a 100 Continue response (rhbz#2036020)
• CVE-2021-4189: ftplib should not use the host from the PASV response (rhbz#2036020)
• CVE-2022-0391: urllib.parse does not sanitize URLs containing ASCII newline and tabs (rhbz#2047376)

• CVE-2021-3737: urllib: HTTP client possible infinite loop on a 100 Continue response (rhbz#2036020)
• CVE-2021-4189: ftplib should not use the host from the PASV response (rhbz#2036020)
• CVE-2022-0391: urllib.parse does not sanitize URLs containing ASCII newline and tabs (rhbz#2047376)

• CVE-2021-3733: urllib: Regular expression DoS in AbstractBasicAuthHandler (rhbz#2047376)
• CVE-2021-3737: urllib: HTTP client possible infinite loop on a 100 Continue response (rhbz#2047376)
• CVE-2021-4189: ftplib should not use the host from the PASV response (rhbz#2047376)
• CVE-2022-0391: urllib.parse does not sanitize URLs containing ASCII newline and tabs (rhbz#2047376)

• CVE-2021-3733: urllib: Regular expression DoS in AbstractBasicAuthHandler (rhbz#2047376)
• CVE-2021-3737: urllib: HTTP client possible infinite loop on a 100 Continue response (rhbz#2047376)
• CVE-2021-4189: ftplib should not use the host from the PASV response (rhbz#2047376)
• CVE-2022-0391: urllib.parse does not sanitize URLs containing ASCII newline and tabs (rhbz#2047376)

• CVE-2026-3276: sort each combining-character run in unicodedata.normalize() with a counting sort once the run exceeds a length threshold, instead of the quadratic insertion sort, so crafted input with long runs of alternating canonical combining classes can no longer burn CPU
• CVE-2026-8328: apply the CVE-2021-4189 PASV fix to ftplib.ftpcp() as well, taking the data connection address from the source socket's peer instead of the host the server advertises, unless trust_server_pasv_ipv4_address opts back in
• CVE-2026-15806: scope urllib.request HTTPPasswordMgr credentials by URL scheme, so credentials registered for an https:// URL are no longer sent over http://; a bare authority still matches any scheme, keeping proxy authentication working
• CVE-2026-7774: validate the written link target in tarfile's data filter, rejecting a link member that resolves to the destination directory itself and resolving symlink targets against the stripped member name, so crafted link entries can no longer redirect later members outside the destination
• CVE-2026-82049: resolve the hard-link source with os.path.realpath() in tarfile's makelink_with_filter, so an archive holding a hard link to a symlink can no longer duplicate that symlink to a shallower path whose relative target escapes the destination

• CVE-2026-8328: stop ftplib.ftpcp() trusting the IPv4 address the source server advertises in its PASV reply, completing the CVE-2021-4189 fix
• CVE-2026-15806: scope HTTPPasswordMgr credentials by URL scheme, so a credential stored for an https URI is no longer sent to the matching http URI
• CVE-2026-19672: normalize tar member names containing .. components in the tarfile tar/data extraction filters, so a name that leaves the destination and comes back no longer creates directories outside the destination
• CVE-2026-87910: honor a None result from the extraction filter when tarfile falls back to extracting a hardlink target, so a rejected member is skipped instead of being written at the link's path

The mailcap module does not add escape characters into commands discovered in the system mailcap file. (CVE-2015-20107) Allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. (CVE-2021-4189) The urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. (CVE-2022-0391)

This update for python fixes the following issues:

• CVE-2022-0391: Fixed URL sanitization containing ASCII newline and tabs in urlparse (bsc#1195396).
• CVE-2021-4189: Fixed ftplib not to trust the PASV response (bsc#1194146).
• CVE-2021-3572: Fixed an improper handling of unicode characters in pip (bsc#1186819).

These are all security issues fixed in the python-2.7.18-15.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python315-3.15.0~b2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python314-3.14.6-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-3.13.14-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-3.10.21-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python311-3.11.16-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python312-3.12.14-1.1 package on the GA media of openSUSE Tumbleweed.

This update for python313, python3 fixes the following issues:

Changes in python313:

Update to 3.13.14:

• Security

  • gh-151159: Bumps the OpenSSL version to 3.0.21 on Android.
  • gh-150599: Fix a possible stack buffer overflow in bz2 when a bz2.BZ2Decompressor is reused after a decompression error. The decompressor now becomes unusable after libbz2 reports an error.
  • gh-149835: shutil.move() now resolves symlinks via os.path.realpath() when checking whether the destination is inside the source directory, preventing a symlink-based bypass of that guard.
  • gh-149698: Update bundled libexpat to version 2.8.1 for the fix for CVE 2026-45186.
  • gh-87451: The ftplib module’s undocumented ftpcp function no longer trusts the IPv4 address value returned from the source server in response to the PASV command by default, completing the fix for CVE-2021-4189. As with ftplib.FTP, the former behavior can be re-enabled by setting the trust_server_pasv_ipv4_address attribute on the source ftplib.FTP instance to True. Thanks to Qi Deng at Aurascape AI for the report.
  • gh-149486: tarfile.data_filter() now validates link targets using the same normalised value that is written to disk, strips trailing separators from the member name when resolving a symlink’s directory, and rejects link members that would replace the destination directory itself. This closes several path-traversal bypasses of the data extraction filter.
  • gh-149079: Fix a potential denial of service in unicodedata.normalize(). The canonical ordering step of Unicode normalization used a quadratic-time insertion sort for reordering combining characters, which could be exploited with crafted input containing many combining characters in non-canonical order. Replaced with a linear-time counting sort for long runs.
  • gh-149018: Improved protection against XML hash-flooding attacks in xml.parsers.expat and xml.etree.ElementTree when Python is compiled with libExpat 2.8.0 or later.
  • gh-149017: Update bundled libexpat to version 2.8.0.
  • gh-90309: Base64-encode values when embedding cookies to JavaScript using the http.cookies.BaseCookie.js_output() method to avoid injection and escaping. (bsc#1262654, CVE-2026-6019)
  • gh-148808: Added buffer boundary check when using nbytes parameter with asyncio.AbstractEventLoop.sock_recvfrom_into(). Only relevant for Windows and the asyncio.ProactorEventLoop.
  • gh-148395: Fix a dangling input pointer in lzma.LZMADecompressor, bz2.BZ2Decompressor, and internal zlib._ZlibDecompressor when memory allocation fails with MemoryError, which could let a subsequent decompress() call read or write through a stale pointer to the already-released caller buffer. (bsc#1262098, CVE-2026-6100, seems like it has been incompletely applied gh#python/cpython#151605)
  • gh-148169: A bypass in webbrowser allowed URLs prefixed with %action to pass the dash-prefix safety check (bsc#1262098, CVE-2026-6100).
  • gh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP files on Windows which allowed to write files outside of the destination tree if the patch in the archive contains a Windows drive prefix. Now such invalid paths will be skipped. Files containing “..” in the name (like “foo..bar”) are no longer skipped.
  • gh-146333: Fix quadratic backtracking in configparser.RawConfigParser option parsing regexes (OPTCRE and OPTCRE_NV). A crafted configuration line with many whitespace characters could cause excessive CPU usage.
  • gh-146211: Reject CR/LF characters in tunnel request headers for the HTTPConnection.set_tunnel() method. (bsc#1261969, CVE-2026-1502)

• Core and…

This update for python3 fixes the following issues:

• CVE-2021-4189: Fixed default access from PASV response in the FTP client (bsc#1194146).
• CVE-2022-0391: Fixed sanitizing of URLs containing ASCII newline and tabs in urlparse (bsc#1195396).

This update for python fixes the following issues:

• CVE-2022-0391: Fixed URL sanitization containing ASCII newline and tabs in urlparse (bsc#1195396).
• CVE-2021-4189: Fixed ftplib not to trust the PASV response (bsc#1194146).
• CVE-2021-3572: Fixed an improper handling of unicode characters in pip (bsc#1186819).

This update for python rebuilds python against a symbol versioned openssl 1.0.2 to allow usage with openssl 1.1.1.

Also the following security issues are fixed:

• CVE-2022-0391: Fixed sanitizing URLs containing ASCII newline and tabs in urlparse (bsc#1195396).
• CVE-2021-4189: Make ftplib not trust the PASV response (bsc#1194146).

This update for python313, python3 fixes the following issues:

Changes in python313:

Update to 3.13.14:

• Security

  • gh-151159: Bumps the OpenSSL version to 3.0.21 on Android.
  • gh-150599: Fix a possible stack buffer overflow in bz2 when a bz2.BZ2Decompressor is reused after a decompression error. The decompressor now becomes unusable after libbz2 reports an error.
  • gh-149835: shutil.move() now resolves symlinks via os.path.realpath() when checking whether the destination is inside the source directory, preventing a symlink-based bypass of that guard.
  • gh-149698: Update bundled libexpat to version 2.8.1 for the fix for CVE 2026-45186.
  • gh-87451: The ftplib module’s undocumented ftpcp function no longer trusts the IPv4 address value returned from the source server in response to the PASV command by default, completing the fix for CVE-2021-4189. As with ftplib.FTP, the former behavior can be re-enabled by setting the trust_server_pasv_ipv4_address attribute on the source ftplib.FTP instance to True. Thanks to Qi Deng at Aurascape AI for the report.
  • gh-149486: tarfile.data_filter() now validates link targets using the same normalised value that is written to disk, strips trailing separators from the member name when resolving a symlink’s directory, and rejects link members that would replace the destination directory itself. This closes several path-traversal bypasses of the data extraction filter.
  • gh-149079: Fix a potential denial of service in unicodedata.normalize(). The canonical ordering step of Unicode normalization used a quadratic-time insertion sort for reordering combining characters, which could be exploited with crafted input containing many combining characters in non-canonical order. Replaced with a linear-time counting sort for long runs.
  • gh-149018: Improved protection against XML hash-flooding attacks in xml.parsers.expat and xml.etree.ElementTree when Python is compiled with libExpat 2.8.0 or later.
  • gh-149017: Update bundled libexpat to version 2.8.0.
  • gh-90309: Base64-encode values when embedding cookies to JavaScript using the http.cookies.BaseCookie.js_output() method to avoid injection and escaping. (bsc#1262654, CVE-2026-6019)
  • gh-148808: Added buffer boundary check when using nbytes parameter with asyncio.AbstractEventLoop.sock_recvfrom_into(). Only relevant for Windows and the asyncio.ProactorEventLoop.
  • gh-148395: Fix a dangling input pointer in lzma.LZMADecompressor, bz2.BZ2Decompressor, and internal zlib._ZlibDecompressor when memory allocation fails with MemoryError, which could let a subsequent decompress() call read or write through a stale pointer to the already-released caller buffer. (bsc#1262098, CVE-2026-6100, seems like it has been incompletely applied gh#python/cpython#151605)
  • gh-148169: A bypass in webbrowser allowed URLs prefixed with %action to pass the dash-prefix safety check (bsc#1262098, CVE-2026-6100).
  • gh-146581: Fix vulnerability in shutil.unpack_archive() for ZIP files on Windows which allowed to write files outside of the destination tree if the patch in the archive contains a Windows drive prefix. Now such invalid paths will be skipped. Files containing “..” in the name (like “foo..bar”) are no longer skipped.
  • gh-146333: Fix quadratic backtracking in configparser.RawConfigParser option parsing regexes (OPTCRE and OPTCRE_NV). A crafted configuration line with many whitespace characters could cause excessive CPU usage.
  • gh-146211: Reject CR/LF characters in tunnel request headers for the HTTPConnection.set_tunnel() method. (bsc#1261969, CVE-2026-1502)

• Core and…

This update for python311 fixes the following issues:

• CVE-2025-13462: incorrect parsing of TarInfo header when GNU long name and type AREGTYPE are combined (bsc#1259611).
• CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used (bsc#1269066).
• CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF (bsc#1261969).
• CVE-2026-2297: cpython: incorrectly handled hook in FileLoader can lead to validation bypass (bsc#1259240).
• CVE-2026-3276: quadratic complexity in unicodedata.normalize() can lead to DoS when processing specially crafted Unicode input (bsc#1267581).
• CVE-2026-3644: incomplete control character validation in http.cookies (bsc#1259734).
• CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735).
• CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks (bsc#1269959).
• CVE-2026-4519: leading dashes in URLs are accepted by the webbrowser.open() API and allow for web browser command line option injection (bsc#1260026).
• CVE-2026-4786: Incomplete mitigation of %action expansion for command injection to webbrowser.open() (bsc#1262319).
• CVE-2026-6100: Arbitrary code execution or information disclosure via use-after-free in decompression modules (bsc#1262098).
• CVE-2026-7210: xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection (bsc#1264962).
• CVE-2026-7774: tarfile.data_filter path traversal bypass allows writing outside the extraction directory (bsc#1267821).
• CVE-2026-8328: ftpcp() does not use actual peer address and trusts server-supplied PASV host address (bsc#1265268).
• CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).
• CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and enables arbitrary file reads and writes (bsc#1268977).
• CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS (bsc#1269788).
• CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations (bsc#1271192).
• CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).
• CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).

Changes for python311:

• Update to 3.11.16:
• Build
• gh-153438: Update Windows build and installer tooling and documentation to use the current download URL for nuget.exe.
• Library
• gh-109638: Fix exponential time in csv.Sniffer.sniff() for a sample which contains many quote characters. A doubled quote character is now also detected in a field which contains the delimiter or a line break.
• gh-98820: Fix quadratic time in csv.Sniffer.sniff() for a sample which contains quoted fields, in particular for a single column of quoted fields.
• gh-149231: In tomllib, the number of parts in TOML keys is now limited.
• gh-146083: Update bundled libexpat to version 2.7.5.
• gh-141707: Don't change tarfile.TarInfo type from AREGTYPE to DIRTYPE when parsing GNU long name or link headers (bsc#1259611, CVE-2025-13462).
• gh-90949: Add SetBillionLaughsAttackProtectionActivationThreshold() and SetBillionLaughsAttackProtectionMaximumAmplification() to xmlparser objects to tune protections against billion laughs attacks. Patch by B�n�dikt Tran.
• gh-100372: ssl.SSLContext.load_verify_locations() no longer incorrectly accepts some cases of trailing data when parsing DER.
• Security
• gh-155558: Update bundled libexpat to version 2.8.3 for the fix to CVE-2026-72522.
• gh-153030: Fixed quadratic complexity in incremental parsing of long unterminated constructs (such as tags or comments) in…

This update for python312 fixes the following issues:

• CVE-2025-13462: incorrect parsing of TarInfo header when GNU long name and type AREGTYPE are combined (bsc#1259611).
• CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used (bsc#1269066).
• CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF (bsc#1261969).
• CVE-2026-2297: cpython: incorrectly handled hook in FileLoader can lead to validation bypass (bsc#1259240).
• CVE-2026-3276: quadratic complexity in unicodedata.normalize() can lead to DoS when processing specially crafted Unicode input (bsc#1267581).
• CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735).
• CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks (bsc#1269959).
• CVE-2026-4519: leading dashes in URLs are accepted by the webbrowser.open() API and allow for web browser command line option injection (bsc#1260026).
• CVE-2026-6100: Arbitrary code execution or information disclosure via use-after-free in decompression modules (bsc#1262098).
• CVE-2026-7210: xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection (bsc#1264962).
• CVE-2026-7774: tarfile.data_filter path traversal bypass allows writing outside the extraction directory (bsc#1267821).
• CVE-2026-8328: ftpcp() does not use actual peer address and trusts server-supplied PASV host address (bsc#1265268).
• CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).
• CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and enables arbitrary file reads and writes (bsc#1268977).
• CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS (bsc#1269788).
• CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations (bsc#1271192).
• CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).
• CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).
• CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).
• CVE-2026-19672: The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and retu (bsc#1276227).

Changes for python312:

• Update to 3.12.14:
• Core and Builtins
• gh-139808: Add branch protections for AArch64 (BTI/PAC) in assembly code used by -X perf_jit (Linux perf profiler integration).
• Documentation
• gh-136155: We are now checking for fatal errors in EPUB builds in CI.
• Library
• gh-109638: Fix exponential time in csv.Sniffer.sniff() for a sample which contains many quote characters. A doubled quote character is now also detected in a field which contains the delimiter or a line break.
• gh-98820: Fix quadratic time in csv.Sniffer.sniff() for a sample which contains quoted fields, in particular for a single column of quoted fields.
• gh-149231: In tomllib, the number of parts in TOML keys is now limited.
• gh-146083: Update bundled libexpat to version 2.7.5.
• gh-141707: Don't change tarfile.TarInfo type from AREGTYPE to DIRTYPE when parsing GNU long name or link headers (bsc#1259611, CVE-2025-13462).
• gh-90949: Add SetBillionLaughsAttackProtectionActivationThreshold() and SetBillionLaughsAttackProtectionMaximumAmplification() to xmlparser objects to tune protections against billion laughs attacks. Patch by B�n�dikt Tran.
• Security
• gh-155558: Update bundled libexpat to version 2.8.3 for the fix to CVE 2026-72522.
• gh-153030: Fixed quadratic complexity in incremental parsing of long…

David Schwörer discovered that Python incorrectly handled certain inputs. An attacker could possibly use this issue to expose sensitive information. This issue only affected Ubuntu 18.04 LTS. (CVE-2021-3426)

It was discovered that Python incorrectly handled certain FTP requests. An attacker could possibly use this issue to expose sensitive information. This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, and Ubuntu 18.04 LTS. (CVE-2021-4189)

It was discovered that Python incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. (CVE-2022-0391)

USN-5342-1 fixed several vulnerabilities in Python. This update provides the corresponding update for Ubuntu 14.04 ESM, Ubuntu 20.04 ESM and Ubuntu 22.04 ESM.

Original advisory details:

It was discovered that Python incorrectly handled certain FTP requests. An attacker could possibly use this issue to expose sensitive information. (CVE-2021-4189)

It was discovered that Python incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. (CVE-2022-0391)

It was discovered that Python incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 18.04 LTS. (CVE-2015-20107)

It was discovered that Python incorrectly used regular expressions vulnerable to catastrophic backtracking. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2018-1060, CVE-2018-1061)

It was discovered that Python failed to initialize Expat’s hash salt. A remote attacker could possibly use this issue to cause hash collisions, leading to a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2018-14647)

It was discovered that Python incorrectly handled certain pickle files. An attacker could possibly use this issue to consume memory, leading to a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2018-20406)

It was discovered that Python incorrectly validated the domain when handling cookies. An attacker could possibly trick Python into sending cookies to the wrong domain. This issue only affected Ubuntu 14.04 LTS. (CVE-2018-20852)

Jonathan Birch and Panayiotis Panayiotou discovered that Python incorrectly handled Unicode encoding during NFKC normalization. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 14.04 LTS. (CVE-2019-9636, CVE-2019-10160)

It was discovered that Python incorrectly parsed certain email addresses. A remote attacker could possibly use this issue to trick Python applications into accepting email addresses that should be denied. This issue only affected Ubuntu 14.04 LTS. (CVE-2019-16056)

It was discovered that the Python documentation XML-RPC server incorrectly handled certain fields. A remote attacker could use this issue to execute a cross-site scripting (XSS) attack. This issue only affected Ubuntu 14.04 LTS. (CVE-2019-16935)

It was discovered that Python documentation had a misleading information. A security issue could be possibly caused by wrong assumptions of this information. This issue only affected Ubuntu 14.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-17514)

It was discovered that Python incorrectly stripped certain characters from requests. A remote attacker could use this issue to perform CRLF injection. This issue only affected Ubuntu 14.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-18348)

It was discovered that Python incorrectly handled certain TAR archives. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-20907)

Colin Read and Nicolas Edet discovered that Python incorrectly handled parsing certain X509 certificates. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2019-5010)

It was discovered that incorrectly handled certain ZIP files. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2019-9674)

It was discovered that Python incorrectly handled certain urls. A remote attacker could possibly use this issue to perform CRLF injection attacks. This issue only affected Ubuntu 14.04 LTS. (CVE-2019-9740, CVE-2019-9947)

Sihoon Lee discovered that Python incorrectly handled the local_file: scheme. A remote attacker could possibly use this issue to bypass blocklist meschanisms. This issue only affected Ubuntu 14.04 LTS. (CVE-2019-9948)

It was discovered that Python incorrectly handled certain IP values. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 18.04 LTS. (CVE-2020-14422)

It was discovered that Python incorrectly handled certain character sequences. A remote attacker could possibly use this issue to perform CRLF injection. This issue only affected Ubuntu 14.04 LTS and Ubuntu…

It was discovered that Python incorrectly normalized paths in the tarfile module. An attacker could possibly use this issue to bypass path restrictions. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-13462)

It was discovered that Python's HTMLParser incorrectly handled certain malformed HTML input. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-69534)

It was discovered that Python's email module incorrectly quoted newlines in headers. An attacker could possibly use this issue to inject arbitrary email headers. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-1299)

It was discovered that Python's http.client module did not properly sanitize carriage return and linefeed characters when handling HTTP CONNECT tunnel request headers. An attacker could possibly use this issue to inject arbitrary HTTP headers. (CVE-2026-1502)

It was discovered that Python's importlib module did not generate an audit event when loading legacy .pyc files. An attacker could possibly use this issue to bypass auditing mechanisms. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-2297)

It was discovered that Python's unicodedata.normalize() function had incorrect algorithmic complexity. An attacker could possibly use this issue to cause Python to consume excessive resources, leading to a denial of service. (CVE-2026-3276)

It was discovered that Python's http.cookies module incorrectly handled control characters in certain cookie operations. An attacker could possibly use this issue to inject arbitrary content. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-3644)

It was discovered that the Python pyexpat module was vulnerable to unbounded recursion in the Expat XML parser. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4224)

It was discovered that Python's webbrowser module accepted leading dashes in URLs, which could be interpreted as command-line options. An attacker could possibly use this issue to execute arbitrary commands. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4519)

It was discovered that Python incorrectly handled webbrowser.open() handlers. An attacker could possibly use this issue to execute arbitrary commands. (CVE-2026-4786)

It was discovered that Python's remote debugging module did not properly validate offset tables when loading debug information. An attacker could possibly use this issue to cause Python to crash or execute arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-5713)

It was discovered that Python's http.cookies module incorrectly escaped values in the js_output() method. An attacker could possibly use this issue to inject arbitrary JavaScript. (CVE-2026-6019)

It was discovered that Python's lzma, bz2, and gzip decompressor objects had a use-after-free vulnerability. An attacker could possibly use this issue to cause Python to crash or execute arbitrary code. (CVE-2026-6100)

It was discovered that Python's tarfile module did not properly validate link targets when using the data filter. An attacker could possibly use this issue to bypass path restrictions. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-7774)

It was discovered that the fix for CVE-2021-4189 in Python's ftplib module was incomplete, allowing PASV responses to be used in ftplib.ftpcp(). An attacker could possibly use this issue to perform server-side request forgery attacks. (CVE-2026-8328)

It was discovered that Python's bz2 module allowed reuse of a BZ2Decompressor object after a decompression error. An attacker could possibly use this issue to cause Python to crash or execute arbitrary code. (CVE-2026-9669)