CVE-2025-4516

There is an issue in CPython when using bytes.decode("unicode_escape", error="ignore|replace"). If you are not using the "unicode_escape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

There is an issue in CPython when using bytes.decode("unicode_escape", error="ignore|replace"). If you are not using the "unicode_escape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.(CVE-2025-4516)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

There is an issue in CPython when using bytes.decode("unicode_escape", error="ignore|replace"). If you are not using the "unicode_escape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.(CVE-2025-4516)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the separating comma remains a plan comma. This can result in the address header being misinterpreted by some mail servers.(CVE-2025-1795)

There is an issue in CPython when using bytes.decode("unicode_escape", error="ignore|replace"). If you are not using the "unicode_escape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.(CVE-2025-4516)

There is a defect in the CPython 'tarfile' module affecting the 'TarFile' extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives.(CVE-2025-8194)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the separating comma remains a plan comma. This can result in the address header being misinterpreted by some mail servers.(CVE-2025-1795)

There is an issue in CPython when using bytes.decode("unicode_escape", error="ignore|replace"). If you are not using the "unicode_escape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.(CVE-2025-4516)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the separating comma remains a plan comma. This can result in the address header being misinterpreted by some mail servers.(CVE-2025-1795)

There is an issue in CPython when using bytes.decode("unicode_escape", error="ignore|replace"). If you are not using the "unicode_escape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.(CVE-2025-4516)

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: Invalid value for OpenSSL API may cause Buffer over-read when NPN is used (CVE-2024-5642)

• python: Virtual environment (venv) activation scripts don't quote paths (CVE-2024-9287)

• python: Improper validation of IPv6 and IPvFuture addresses (CVE-2024-11168)

• python: cpython: URL parser allowed square brackets in domain names (CVE-2025-0938)

• cpython: python: CPython DecodeError Handling Vulnerability (CVE-2025-4516)

• cpython: Tarfile extracts filtered members when errorlevel=0 (CVE-2025-4435)

• cpython: python: Extraction filter bypass for linking outside extraction directory (CVE-2025-4330)

• python: cpython: Arbitrary writes via tarfile realpath overflow (CVE-2025-4517)

• cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory (CVE-2025-4138)

• cpython: Python HTMLParser quadratic complexity (CVE-2025-6069)

• cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked (CVE-2025-8291)

• python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

There is an issue in CPython when using bytes.decode("unicode_escape", error="ignore|replace"). If you are not using the "unicode_escape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: Invalid value for OpenSSL API may cause Buffer over-read when NPN is used (CVE-2024-5642)
• python: Virtual environment (venv) activation scripts don't quote paths (CVE-2024-9287)
• python: Improper validation of IPv6 and IPvFuture addresses (CVE-2024-11168)
• python: cpython: URL parser allowed square brackets in domain names (CVE-2025-0938)
• cpython: python: CPython DecodeError Handling Vulnerability (CVE-2025-4516)
• cpython: Tarfile extracts filtered members when errorlevel=0 (CVE-2025-4435)
• cpython: python: Extraction filter bypass for linking outside extraction directory (CVE-2025-4330)
• python: cpython: Arbitrary writes via tarfile realpath overflow (CVE-2025-4517)
• cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory (CVE-2025-4138)
• cpython: Python HTMLParser quadratic complexity (CVE-2025-6069)
• cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked (CVE-2025-8291)
• python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

There is an issue in CPython when using bytes.decode("unicode_escape", error="ignore|replace"). If you are not using the "unicode_escape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.

There is an issue in CPython when using bytes.decode("unicode_escape", error="ignore|replace"). If you are not using the "unicode_escape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.

There is an issue in CPython when using bytes.decode("unicode_escape", error="ignore|replace"). If you are not using the "unicode_escape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.

There is an issue in CPython when using bytes.decode("unicode_escape", error="ignore|replace"). If you are not using the "unicode_escape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.

There is an issue in CPython when using bytes.decode("unicode_escape", error="ignore|replace"). If you are not using the "unicode_escape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.

• SECURITY UPDATE: improper handling of 'decode' function with 'unicode_escape' encoding in bytes
  • debian/patches/CVE-2025-4516.patch: Fix use-after-free in the 'unicode- escape' decoder with a non-'strict' error handler
  • CVE-2025-4516

• CVE-2025-4516: use-after-free in unicode-escape decoder with custom error handlers

• CVE-2025-4516: use-after-free in unicode-escape decoder with custom error handlers

• CVE-2025-8291: fix zipfile ZIP64 EOCD Locator offset validation
• CVE-2025-6069: fix quadratic complexity in HTMLParser
• CVE-2025-4516: fix use-after-free in unicode-escape decoder with error handler
• CVE-2026-2297: ensure SourcelessFileLoader uses io.open_code
• CVE-2026-3479: reject invalid resource arguments in pkgutil.get_data()
• CVE-2025-1795: fix email header list separator incorrectly encoded during folding
• CVE-2026-0672: reject control characters in http cookies
• CVE-2025-15282: reject control characters in data URL mediatypes
• CVE-2026-3644: reject control characters in http.cookies.Morsel.update(), |=, unpickling, and js_output()
• CVE-2026-4224: avoid unbound C recursion in conv_content_model in pyexpat.c
• CVE-2025-11468: preserve parens when folding email comments to prevent header injection

• CVE-2026-0672: reject control characters in http.cookies cookie names, values, and parameters to prevent header injection
• CVE-2026-3644: reject control characters in Morsel.update(), |= operator, and unpickling paths missed by CVE-2026-0672; add output validation to BaseCookie.js_output()
• CVE-2026-2297: ensure SourcelessFileLoader uses io.open_code so sys.audit handlers fire for legacy .pyc imports
• CVE-2025-8291: validate ZIP64 End of Central Directory locator offset to prevent ZIP archive parser confusion
• CVE-2025-6069: fix quadratic complexity in html.parser.HTMLParser when processing crafted malformed inputs
• CVE-2025-4516: fix use-after-free in unicode-escape decoder when an error handler is invoked
• CVE-2025-1795: stop incorrectly RFC 2047 encoding the comma separator when an address list is folded

• CVE-2025-1795: fix incorrect parsing of email addresses with special chars
• CVE-2025-4516: fix use-after-free in unicode-escape decoder with non-strict error handler
• CVE-2025-6069: fix quadratic complexity in HTMLParser special input
• CVE-2025-8291: fix zip64 end-of-central-directory record validation
• CVE-2025-11468: fix incorrect parsing of empty email display names
• CVE-2025-15282: fix control character injection in data: URL mediatype in urllib.request.DataHandler
• CVE-2024-5642: fix buffer over-read in ssl.SSLContext.set_npn_protocols with empty list

• CVE-2026-4224: avoid unbound C recursion in conv_content_model in pyexpat
• CVE-2026-3644: reject control characters in http.cookies.Morsel.update()
• CVE-2026-0672: reject control characters in http.cookies.Morsel
• CVE-2025-8291: check consistency of zip64 end of central directory record
• CVE-2025-6069: fix quadratic complexity in processing special input in HTMLParser
• CVE-2025-4516: fix use-after-free in the unicode-escape decoder with error handler
• CVE-2025-15282: reject control characters in data URL mediatypes
• CVE-2025-11468: preserve parenthesis when folding email comments
• CVE-2026-3479: reject invalid resource arguments in pkgutil.get_data()
• CVE-2026-2297: ensure SourcelessFileLoader uses io.open_code
• CVE-2024-5642: disallow setting an empty list for ssl NPN protocols

URL parser allowed square brackets in domain names. (CVE-2025-0938) Mishandling of comma during folding and unicode-encoding of email headers. (CVE-2025-1795) Virtual environment (venv) activation scripts don't quote paths. (CVE-2024-9287) Use-after-free in "unicode_escape" decoder with error handler. (CVE-2025-4516) Bypass extraction filter to modify file metadata outside extraction directory. (CVE-2024-12718) Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory. (CVE-2025-4138) Extraction filter bypass for linking outside extraction directory. (CVE-2025-4330) Tarfile extracts filtered members when errorlevel=0. (CVE-2025-4435) Arbitrary writes via tarfile realpath overflow. (CVE-2025-4517) Tarfile infinite loop during parsing with negative member offset. (CVE-2025-8194)

These are all security issues fixed in the python314-3.14.0~b1-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-3.13.3-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python312-3.12.10-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-3.10.17-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python311-3.11.12-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python39-3.9.22-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python315-3.15.0~a1-1.1 package on the GA media of openSUSE Tumbleweed.

There is an issue in CPython when using bytes.decode("unicode_escape", error="ignore|replace"). If you are not using the "unicode_escape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.

Root has patched CVE-2025-4516 in the rootio-python3.11 package for Root:Debian:12. Multiple fixed versions available.

This update for python3 fixes the following issues:

• CVE-2025-4516: use-after-free in the unicode-escape decoder when using the error handler (bsc#1243273).

This update for python3 fixes the following issues:

• CVE-2025-4516: CPython DecodeError Handling Vulnerability (bsc#1243273)

Other fixes:

• Add python36-* provides/obsoletes to enable SLE-12 -> SLE-15 migration (bsc#1233012)
• Update vendored ipaddress module to 3.8 equivalent
• Limit buffer size for IPv6 address parsing (bsc#1244401).

This update for python310 fixes the following issues:

python310 was updated from version 3.10.16 to 3.10.18:

• Security issues fixed:

  • CVE-2025-4516: Fixed blocking DecodeError handling vulnerability, which could lead to DoS (bsc#1243273)
  • CVE-2024-12718, CVE-2025-4138, CVE-2025-4330, CVE-2025-4517: Fixed multiple issues that allowed tarfile extraction filters to be bypassed using crafted symlinks and hard links (bsc#1244056, bsc#1244059, bsc#1244060, bsc#1244032)

• Other changes and bugs fixed:

  • Improved handling of system call failures that OpenSSL reports (bsc#1241067)
  • Fixed issue with test_ssl pass with OpenSSL 3.5 (bsc#1241067)
  • Fixed issue with reproducible builds (bsc#1239210)
  • Fixed a potential denial of service vulnerability in the imaplib module.
  • Fixed bugs in the in the folding of rfc2047 encoded-words and in the folding of quoted strings when flattening an email message using a modern email policy.
  • Fixed parsing long IPv6 addresses with embedded IPv4 address.
  • Fixed ipaddress.IPv6Address.reverse_pointer output according to RFC 3596
  • Improved handling of system call failures that OpenSSL reports
  • Improved the textual representation of IPv4-mapped IPv6 addresses in ipaddress.
  • ipaddress: fixed hash collisions for IPv4Network and IPv6Network objects
  • os.path.realpath() now accepts a strict keyword-only argument.
  • Stop the processing of long IPv6 addresses early in ipaddress to prevent excessive memory consumption and a minor denial-of-service.
  • Updated bundled libexpat to 2.7.1
  • Writers of documentation can now use next as the version for the versionchanged, versionadded, deprecated directives.

This update for python312 fixes the following issues:

python312 was updated from version 3.12.9 to 3.12.11:

• Security issues fixed:

  • CVE-2025-4516: Fixed blocking DecodeError handling vulnerability, which could lead to DoS (bsc#1243273)
  • CVE-2024-12718, CVE-2025-4138, CVE-2025-4330, CVE-2025-4517: Fixed multiple issues that allowed tarfile extraction filters to be bypassed using crafted symlinks and hard links (bsc#1244056, bsc#1244059, bsc#1244060, bsc#1244032)

• Other changes and bugs fixed:

  • Added --single-process option to the Python test runner (regrtest).
  • Added support for text/x-rst MIME type.
  • Corrected issues in various modules.
  • Fixed bugs in the in the folding of rfc2047 encoded-words and in the folding of quoted strings when flattening an email message using a modern email policy.
  • Fixed f-string handling of lambda expressions with non-ASCII characters.
  • Fixed ipaddress.IPv6Address.reverse_pointer output according to RFC 3596.
  • Fixed parsing long IPv6 addresses with embedded IPv4 address.
  • Fixed resource leaks in gzip and multiprocessing Resource Tracker.
  • Improved IDLE's documentation display.
  • Improved the textual representation of IPv4-mapped IPv6 addresses in ipaddress.
  • ipaddress: fixed hash collisions for IPv4Network and IPv6Network objects
  • Made from future import barry_as_FLUFL work in more contexts.
  • Resolved potential crashes in contextvars, xml.etree.ElementTree, sqlite3, and the sys module.
  • Scheduled deprecation of the check_home argument in sysconfig.is_python_build() for Python 3.15.
  • Stop the processing of long IPv6 addresses early in ipaddress to prevent excessive memory consumption and a minor denial-of-service.
  • Undeprecated functional API for importlib.resources and added Anchor.
  • Updated bundled libexpat to 2.7.1
  • Updated bundled pip to version 25.0.1.
  • Updated documentation for generic classes, wheel tags, and the C API.

This update for python311 fixes the following issues:

python311 was updated from version 3.11.10 to 3.11.13:

• Security issues fixed:

  • CVE-2025-4516: Fixed blocking DecodeError handling vulnerability, which could lead to DoS (bsc#1243273).
  • CVE-2024-12718, CVE-2025-4138, CVE-2025-4330, CVE-2025-4517: Fixed multiple issues that allowed tarfile extraction filters to be bypassed using crafted symlinks and hard links (bsc#1244056, bsc#1244059, bsc#1244060, bsc#1244032)

• Other bugs fixed:

  • Improved handling of system call failures that OpenSSL reports (bsc#1241067)
  • Disable GC during thread operations to prevent deadlocks.
  • Fixed a potential denial of service vulnerability in the imaplib module.
  • Fixed bugs in the in the folding of rfc2047 encoded-words and in the folding of quoted strings when flattening an email message using a modern email policy.
  • Fixed parsing long IPv6 addresses with embedded IPv4 address.
  • Fixed ipaddress.IPv6Address.reverse_pointer output according to RFC 3596.
  • Improved the textual representation of IPv4-mapped IPv6 addresses in ipaddress.
  • ipaddress: fixed hash collisions for IPv4Network and IPv6Network objects
  • os.path.realpath() now accepts a strict keyword-only argument.
  • Stop the processing of long IPv6 addresses early in ipaddress to prevent excessive memory consumption and a minor denial-of-service.
  • Updated bundled libexpat to 2.7.1
  • Writers of CPython documentation can now use next as the version for the versionchanged, versionadded, deprecated directives.

This update for python39 fixes the following issues:

python39 was updated from version 3.9.21 to version 3.9.23:

• Security issues fixed:

  • CVE-2025-4516: Fixed blocking DecodeError handling vulnerability, which could lead to DoS (bsc#1243273)
  • CVE-2024-12718, CVE-2025-4138, CVE-2025-4330, CVE-2025-4517: Fixed multiple issues that allowed tarfile extraction filters to be bypassed using crafted symlinks and hard links (bsc#1244056, bsc#1244059, bsc#1244060, bsc#1244032)

• Other changes and bugs fixed:

  • Fixed issue with reproducible builds (bsc#1239210)
  • Fixed a potential denial of service vulnerability in the imaplib module.
  • Fixed bugs in the in the folding of rfc2047 encoded-words and in the folding of quoted strings when flattening an email message using a modern email policy.
  • Fixed parsing long IPv6 addresses with embedded IPv4 address.
  • Fixed ipaddress.IPv6Address.reverse_pointer output according to RFC 3596, §2.5.
  • Improved the textual representation of IPv4-mapped IPv6 addresses in ipaddress.
  • ipaddress: fixed hash collisions for IPv4Network and IPv6Network objects
  • os.path.realpath() now accepts a strict keyword-only argument.
  • Stop the processing of long IPv6 addresses early in ipaddress to prevent excessive memory consumption and a minor denial-of-service.
  • Updated bundled libexpat to 2.7.1
  • Writers of CPython’s documentation can now use next as the version for the versionchanged, versionadded, deprecated directives.

This update for python311 fixes the following issues:

python311 was updated from version 3.11.10 to 3.11.13:

• Security issues fixed:

  • CVE-2025-4516: Fixed blocking DecodeError handling vulnerability, which could lead to DoS (bsc#1243273).
  • CVE-2024-12718, CVE-2025-4138, CVE-2025-4330, CVE-2025-4517: Fixed multiple issues that allowed tarfile extraction filters to be bypassed using crafted symlinks and hard links (bsc#1244056, bsc#1244059, bsc#1244060, bsc#1244032)

• Other changes and bugs fixed:

  • Improved handling of system call failures that OpenSSL reports (bsc#1241067)
  • Disable GC during thread operations to prevent deadlocks.
  • Fixed a potential denial of service vulnerability in the imaplib module.
  • Fixed bugs in the in the folding of rfc2047 encoded-words and in the folding of quoted strings when flattening an email message using a modern email policy.
  • Fixed parsing long IPv6 addresses with embedded IPv4 address.
  • Fixed ipaddress.IPv6Address.reverse_pointer output according to RFC 3596
  • Improved the textual representation of IPv4-mapped IPv6 addresses in ipaddress.
  • ipaddress: fixed hash collisions for IPv4Network and IPv6Network objects
  • os.path.realpath() now accepts a strict keyword-only argument.
  • Stop the processing of long IPv6 addresses early in ipaddress to prevent excessive memory consumption and a minor denial-of-service.
  • Updated bundled libexpat to 2.7.1
  • Writers of CPython documentation can now use next as the version for the versionchanged, versionadded, deprecated directives.

This update for python313 fixes the following issues:

Update to version 3.13.5.

Security issues fixed:

• CVE-2025-4517: arbitrary filesystem writes outside the extraction directory during extraction with filter='data' (bsc#1244032)
• CVE-2025-4516: use-after-free in the unicode-escape decoder when using the error handler (bsc#1243273).
• CVE-2025-4330: extraction filter bypass for linking outside extraction directory (bsc#1244060)
• CVE-2025-4138: may allow symlink targets to point outside the destination directory, and the modification of some file metadata. (bsc#1244059)
• CVE-2025-0938: domain names containing square brackets are not identified as incorrect by urlparse (bsc#1236705).
• CVE-2024-12718: bypass extraction filter to modify file metadata outside extraction directory (bsc#1244056)
• CVE-2024-12254: memory exhaustion due to unbounded memory buffering in SelectorSocketTransport.writelines() (bsc#1234290).

Other changes and issues fixed:

Changes from 3.13.5:

• Tests

  • gh-135120: Add test.support.subTests().

• Library

  • gh-133967: Do not normalize locale name ‘C.UTF-8’ to ‘en_US.UTF-8’.
  • gh-135326: Restore support of integer-like objects with index() in random.getrandbits().
  • gh-135321: Raise a correct exception for values greater than 0x7fffffff for the BINSTRING opcode in the C implementation of pickle.
  • gh-135276: Backported bugfixes in zipfile.Path from zipp 3.23. Fixed .name, .stem and other basename-based properties on Windows when working with a zipfile on disk.
  • gh-134151: email: Fix TypeError in email.utils.decode_params() when sorting RFC 2231 continuations that contain an unnumbered section.
  • gh-134152: email: Fix parsing of email message ID with invalid domain.
  • gh-127081: Fix libc thread safety issues with os by replacing getlogin with getlogin_r re-entrant version.
  • gh-131884: Fix formatting issues in json.dump() when both indent and skipkeys are used.

• Core and Builtins

  • gh-135171: Roll back changes to generator and list comprehensions that went into 3.13.4 to fix gh-127682, but which involved semantic and bytecode changes not appropriate for a bugfix release.

• C API

  • gh-134989: Fix Py_RETURN_NONE, Py_RETURN_TRUE and Py_RETURN_FALSE macros in the limited C API 3.11 and older: don’t treat Py_None, Py_True and Py_False as immortal. Patch by Victor Stinner.
  • gh-134989: Implement PyObject_DelAttr() and PyObject_DelAttrString() as macros in the limited C API 3.12 and older. Patch by Victor Stinner.

Changes from 3.13.4:

• Security

  • gh-135034: Fixes multiple issues that allowed tarfile extraction filters (filter='data' and filter='tar') to be bypassed using crafted symlinks and hard links. Addresses CVE-2024-12718 (bsc#1244056), CVE-2025-4138 (bsc#1244059), CVE-2025-4330 (bsc#1244060), and CVE-2025-4517 (bsc#1244032).
  • gh-133767: Fix use-after-free in the “unicode-escape” decoder with a non-“strict” error handler (CVE-2025-4516, bsc#1243273).
  • gh-128840: Short-circuit the processing of long IPv6 addresses early in ipaddress to prevent excessive memory consumption and a minor denial-of-service.

• Library

  • gh-134718: ast.dump() now only omits None and [] values if they are default values.
  • gh-128840: Fix parsing long IPv6 addresses with embedded IPv4 address.
  • gh-134696: Built-in HACL* and OpenSSL implementations of hash function constructors now correctly accept the same documented named arguments. For instance, md5() could be previously invoked as md5(data=data) or md5(string=string) depending on the underlying implementation but these calls were not compatible. Patch by Bénédikt Tran.
  • gh-134210: curses.window.getch() now correctly handles …

This update for python36 fixes the following issues:

• CVE-2024-12718: Fixed extraction filter bypass that allowed file metadata modification outside extraction directory (bsc#1244056)
• CVE-2025-4138: Fixed issue that might allow symlink targets to point outside the destination directory, and the modification of some file metadata (bsc#1244059)
• CVE-2025-4330: Fixed extraction filter bypass that allowed linking outside extraction directory (bsc#1244060)
• CVE-2025-4435: Fixed Tarfile extracts filtered members when errorlevel=0 (bsc#1244061)
• CVE-2025-4516: Fixed denial of service due to DecodeError handling vulnerability (bsc#1243273)
• CVE-2025-4517: Fixed arbitrary filesystem writes outside the extraction directory during extraction with filter='data' (bsc#1244032)
• CVE-2025-6069: Fixed worst case quadratic complexity when processing certain crafted malformed inputs with HTMLParser (bsc#1244705)

Other fixes:

• Add python36-* provides/obsoletes to enable SLE-12 -> SLE-15 migration (bsc#1233012)
• Update vendored ipaddress module to 3.8 equivalent
• Limit buffer size for IPv6 address parsing (bsc#1244401).

This update for python3 fixes the following issues:

• CVE-2025-4516: use-after-free in the unicode-escape decoder when using the error handler (bsc#1243273).
• CVE-2024-12718: Fixed extraction filter bypass that allowed file metadata modification outside extraction directory (bsc#1244056)
• CVE-2025-4138: Fixed issue that might allow symlink targets to point outside the destination directory, and the modification of some file metadata (bsc#1244059)
• CVE-2025-4330: Fixed extraction filter bypass that allowed linking outside extraction directory (bsc#1244060)
• CVE-2025-4435: Fixed Tarfile extracts filtered members when errorlevel=0 (bsc#1244061)
• CVE-2025-4517: Fixed arbitrary filesystem writes outside the extraction directory during extraction with filter='data' (bsc#1244032)
• CVE-2025-6069: Fixed worst case quadratic complexity when processing certain crafted malformed inputs with HTMLParser (bsc#1244705)
• CVE-2025-8194: Fixed denial of service caused by tar archives with negative offsets (bsc#1247249)

Other fixes:

• Limit buffer size for IPv6 address parsing (bsc#1244401).

This update for python311 fixes the following issues:

• CVE-2025-4516: Fixed blocking DecodeError handling vulnerability, which could lead to DoS. (bsc#1243273)

Update to 3.11.12:

• gh-105704: When using urllib.parse.urlsplit() and urllib.parse.urlparse() host parsing would not reject domain names containing square brackets ([ and ]). Square brackets are only valid for IPv6 and IPvFuture hosts according to RFC 3986 Section 3.2.2 (bsc#1236705, CVE-2025-0938, gh#python/cpython#105704).

• gh-121284: Fix bug in the folding of rfc2047 encoded-words when flattening an email message using a modern email policy. Previously when an encoded-word was too long for a line, it would be decoded, split across lines, and re-encoded. But commas and other special characters in the original text could be left unencoded and unquoted. This could theoretically be used to spoof header lines using a carefully constructed encoded-word if the resulting rendered email was transmitted or re-parsed.

• gh-80222: Fix bug in the folding of quoted strings when flattening an email message using a modern email policy. Previously when a quoted string was folded so that it spanned more than one line, the surrounding quotes and internal escapes would be omitted. This could theoretically be used to spoof header lines using a carefully constructed quoted string if the resulting rendered email was transmitted or re-parsed.

• gh-119511: Fix a potential denial of service in the imaplib module. When connecting to a malicious server, it could cause an arbitrary amount of memory to be allocated. On many systems this is harmless as unused virtual memory is only a mapping, but if this hit a virtual address size limit it could lead to a MemoryError or other process crash. On unusual systems or builds where all allocated memory is touched and backed by actual ram or storage it could’ve consumed resources doing so until similarly crashing.

• gh-127257: In ssl, system call failures that OpenSSL reports using ERR_LIB_SYS are now raised as OSError.

• gh-121277: Writers of CPython’s documentation can now use next as the version for the versionchanged, versionadded, deprecated directives.

• gh-106883: Disable GC during the _PyThread_CurrentFrames() and _PyThread_CurrentExceptions() calls to avoid the interpreter to deadlock.

• CVE-2025-0938: disallow square brackets ([ and ]) in domain names for parsed URLs (bsc#1236705, gh#python/cpython#105704)

Update to 3.11.11:

• Tools/Demos

  • gh-123418: Update GitHub CI workflows to use OpenSSL 3.0.15 and multissltests to use 3.0.15, 3.1.7, and 3.2.3.

• Security

  • gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to consistently use the mapped IPv4 address value for deciding properties. Properties which have their behavior fixed are is_multicast, is_reserved, is_link_local, is_global, and is_unspecified.

• Library

  • gh-124651: Properly quote template strings in venv activation scripts (bsc#1232241, CVE-2024-9287).

• Remove -IVendor/ from python-config bsc#1231795

• CVE-2024-9287: Properly quote path names provided when creating a virtual environment (bsc#1232241,

• Drop .pyc files from docdir for reproducible builds (bsc#1230906).

Update to 3.11.10:

• Security

  • gh-121957: Fixed missing audit events around interactive use of Python, now also properly firing for python -i, as well as for python -m asyncio. The event in question is cpython.run_stdin.
  • gh-122133: Authenticate the socket connection for the socket.socketpair() fallback on platforms where AF_UNIX is not available like Windows. Patch by Gregory P. Smith [email protected] and Seth Larson [email protected]. Reported by Ellie [email protected]
  • gh-121285: Remove backtracking from…

This update for python311 fixes the following issues:

• CVE-2025-6069: Avoid worst case quadratic complexity when processing certain crafted malformed inputs with HTMLParser (bsc#1244705).

Update to 3.11.13:

• Security

  • gh-135034: Fixes multiple issues that allowed tarfile extraction filters (filter="data" and filter="tar") to be bypassed using crafted symlinks and hard links. Addresses CVE-2024-12718 (bsc#1244056), CVE-2025-4138 (bsc#1244059), CVE-2025-4330 (bsc#1244060), and CVE-2025-4517 (bsc#1244032). Also addresses CVE-2025-4435 (gh#135034, bsc#1244061).
  • gh-133767: Fix use-after-free in the “unicode-escape” decoder with a non-“strict” error handler (CVE-2025-4516, bsc#1243273).
  • gh-128840: Short-circuit the processing of long IPv6 addresses early in ipaddress to prevent excessive memory consumption and a minor denial-of-service.

• Library

  • gh-128840: Fix parsing long IPv6 addresses with embedded IPv4 address.
  • gh-134062: ipaddress: fix collisions in hash() for IPv4Network and IPv6Network objects.
  • gh-123409: Fix ipaddress.IPv6Address.reverse_pointer output according to RFC 3596, §2.5. Patch by Bénédikt Tran.
  • bpo-43633: Improve the textual representation of IPv4-mapped IPv6 addresses (RFC 4291 Sections 2.2, 2.5.5.2) in ipaddress. Patch by Oleksandr Pavliuk.

• CVE-2025-4516: Fixed blocking DecodeError handling vulnerability, which could lead to DoS. (bsc#1243273)

This update for python311 fixes the following issues:

• CVE-2025-6069: Avoid worst case quadratic complexity when processing certain crafted malformed inputs with HTMLParser (bsc#1244705).

Update to 3.11.13:

• Security

  • gh-135034: Fixes multiple issues that allowed tarfile extraction filters (filter="data" and filter="tar") to be bypassed using crafted symlinks and hard links. Addresses CVE-2024-12718 (bsc#1244056), CVE-2025-4138 (bsc#1244059), CVE-2025-4330 (bsc#1244060), and CVE-2025-4517 (bsc#1244032). Also addresses CVE-2025-4435 (gh#135034, bsc#1244061).
  • gh-133767: Fix use-after-free in the “unicode-escape” decoder with a non-“strict” error handler (CVE-2025-4516, bsc#1243273).
  • gh-128840: Short-circuit the processing of long IPv6 addresses early in ipaddress to prevent excessive memory consumption and a minor denial-of-service.

• Library

  • gh-128840: Fix parsing long IPv6 addresses with embedded IPv4 address.
  • gh-134062: ipaddress: fix collisions in hash() for IPv4Network and IPv6Network objects.
  • gh-123409: Fix ipaddress.IPv6Address.reverse_pointer output according to RFC 3596, §2.5. Patch by Bénédikt Tran.
  • bpo-43633: Improve the textual representation of IPv4-mapped IPv6 addresses (RFC 4291 Sections 2.2, 2.5.5.2) in ipaddress. Patch by Oleksandr Pavliuk.

It was discovered that Python incorrectly handled certain unicode characters during decoding. An attacker could possibly use this issue to cause a denial of service. (CVE-2025-4516)

It was discovered that Python incorrectly handled unicode encoding of email headers with list separators in folded lines. An attacker could possibly use this issue to expose sensitive information. (CVE-2025-1795)