CVE-2026-0864

When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.

When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.(CVE-2026-0864)

When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.(CVE-2026-11972)

unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.(CVE-2026-3276)

The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.(CVE-2026-8328)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.(CVE-2026-0864)

tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself.  The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory.  This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330.(CVE-2026-11940)

When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.(CVE-2026-11972)

unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.(CVE-2026-3276)

The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.(CVE-2026-8328)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.(CVE-2026-0864)

To allow builds of Python to be run from an in-tree layout (rather than an installed file layout), the VPATH variable is defined at build time and used to locate certain landmarks - specifically, Modules/setup.local. When this landmark is found relative to VPATH relative to the executable, Python assumes it is running in a source tree and generates a different default sys.path. This code remains in release builds, so that release-ready builds can be built in-tree.

On Windows, since builds are written to 'PCbuild/', the value of VPATH is set to '....', which results in a landmark of '....\Modules\setup.local'. This path is outside the install directory of Python, and may have different permissions, potentially allowing a low-privilege user to create the landmark and an alternative Lib folder that will be discovered by an otherwise restricted install.

Such a setup occurs with the legacy default install location for all users (in the now superseded EXE installer), due to how Windows allows all users to create folders in the root directory of their OS drive.

Our recommended mitigation on Windows is to migrate away from the legacy installer and use the new Python install manager to install for the current user. Installs where the directory two levels above the Python installation directory have equivalent permissions are unaffected (in general, a per-user install cannot be modified at all by other users, removing any escalation of privilege risk, and could be directly modified by a privileged user, making the potential tampering irrelevant). Alternative mitigations might include preemptively creating and restricting access to a Modules directory. Be aware that only 3.13 and 3.14 will receive updated legacy installers - earlier fixes are only provided as sources.

Platforms other than Windows allow VPATH to be overridden, but as they don't usually use a separated directory in the build for binaries, are unlikely to have a landmark reference outside of the install directory.

The landmark detection involving VPATH is a fallback for when a more specific landmark - .\pybuilddir.txt - is absent, and was included for compatibility. Future releases of Python will no longer include the fallback, and so builds will need to generate or preserve the pybuilddir.txt file in order to work in-tree. This landmark file has been generated on Windows since 3.11, and on other platforms for longer.(CVE-2026-12003)

unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.(CVE-2026-3276)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.(CVE-2026-0864)

To allow builds of Python to be run from an in-tree layout (rather than an installed file layout), the VPATH variable is defined at build time and used to locate certain landmarks - specifically, Modules/setup.local. When this landmark is found relative to VPATH relative to the executable, Python assumes it is running in a source tree and generates a different default sys.path. This code remains in release builds, so that release-ready builds can be built in-tree.

On Windows, since builds are written to 'PCbuild/', the value of VPATH is set to '....', which results in a landmark of '....\Modules\setup.local'. This path is outside the install directory of Python, and may have different permissions, potentially allowing a low-privilege user to create the landmark and an alternative Lib folder that will be discovered by an otherwise restricted install.

Such a setup occurs with the legacy default install location for all users (in the now superseded EXE installer), due to how Windows allows all users to create folders in the root directory of their OS drive.

Our recommended mitigation on Windows is to migrate away from the legacy installer and use the new Python install manager to install for the current user. Installs where the directory two levels above the Python installation directory have equivalent permissions are unaffected (in general, a per-user install cannot be modified at all by other users, removing any escalation of privilege risk, and could be directly modified by a privileged user, making the potential tampering irrelevant). Alternative mitigations might include preemptively creating and restricting access to a Modules directory. Be aware that only 3.13 and 3.14 will receive updated legacy installers - earlier fixes are only provided as sources.

Platforms other than Windows allow VPATH to be overridden, but as they don't usually use a separated directory in the build for binaries, are unlikely to have a landmark reference outside of the install directory.

The landmark detection involving VPATH is a fallback for when a more specific landmark - .\pybuilddir.txt - is absent, and was included for compatibility. Future releases of Python will no longer include the fallback, and so builds will need to generate or preserve the pybuilddir.txt file in order to work in-tree. This landmark file has been generated on Windows since 3.11, and on other platforms for longer.(CVE-2026-12003)

unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.(CVE-2026-3276)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.(CVE-2026-0864)

tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself.  The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory.  This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330.(CVE-2026-11940)

When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.(CVE-2026-11972)

To allow builds of Python to be run from an in-tree layout (rather than an installed file layout), the VPATH variable is defined at build time and used to locate certain landmarks - specifically, Modules/setup.local. When this landmark is found relative to VPATH relative to the executable, Python assumes it is running in a source tree and generates a different default sys.path. This code remains in release builds, so that release-ready builds can be built in-tree.

On Windows, since builds are written to 'PCbuild/', the value of VPATH is set to '....', which results in a landmark of '....\Modules\setup.local'. This path is outside the install directory of Python, and may have different permissions, potentially allowing a low-privilege user to create the landmark and an alternative Lib folder that will be discovered by an otherwise restricted install.

Such a setup occurs with the legacy default install location for all users (in the now superseded EXE installer), due to how Windows allows all users to create folders in the root directory of their OS drive.

Our recommended mitigation on Windows is to migrate away from the legacy installer and use the new Python install manager to install for the current user. Installs where the directory two levels above the Python installation directory have equivalent permissions are unaffected (in general, a per-user install cannot be modified at all by other users, removing any escalation of privilege risk, and could be directly modified by a privileged user, making the potential tampering irrelevant). Alternative mitigations might include preemptively creating and restricting access to a Modules directory. Be aware that only 3.13 and 3.14 will receive updated legacy installers - earlier fixes are only provided as sources.

Platforms other than Windows allow VPATH to be overridden, but as they don't usually use a separated directory in the build for binaries, are unlikely to have a landmark reference outside of the install directory.

The landmark detection involving VPATH is a fallback for when a more specific landmark - .\pybuilddir.txt - is absent, and was included for compatibility. Future releases of Python will no longer include the fallback, and so…

When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.

When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.

When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.

When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.

When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.

When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.

• SECURITY UPDATE: configuration file injection via carriage returns in written option values
  • debian/patches/CVE-2026-0864.patch: normalise CR and CRLF, and not only LF, into '\n\t' continuation lines when writing option values in RawConfigParser.write() in Lib/ConfigParser.py, so that an attacker-controlled value can no longer inject additional sections, keys and values into the written file
  • CVE-2026-0864
• SECURITY UPDATE: CPU denial-of-service in tarfile streaming mode via a member size declared past the end of the stream
  • debian/patches/CVE-2026-11972.patch: stop _Stream.seek() at the first empty read instead of looping once per attacker-declared block against an already-exhausted stream in Lib/tarfile.py
  • CVE-2026-11972

• CVE-2026-0864: normalize all line endings (CR, CRLF, and LF) when writing multi-line configparser values to prevent configuration injection

• CVE-2026-0864: normalize all line endings (CR, CRLF, and LF) in configparser to prevent key/value injection when writing multi-line values
• CVE-2026-11940: fix symlink escape via the tarfile hardlink-extraction fallback by validating the symlink at the path it is recreated at, and route the extraction filter through TarFile.extract() so single-member extraction is covered by the check and not only extractall()

• CVE-2026-0864: normalize CR and CRLF line endings when writing multi-line values in ConfigParser - RawConfigParser.write() escaped only '\n' (to '\n\t'), so an attacker-controlled value containing a bare carriage return was written out verbatim and injected unexpected keys and values into the resulting configuration file. Applied at both write() call sites, for the DEFAULT section and for named sections; Python 2.7 has no _write_section(). Backported from upstream CPython (gh-143927, GH-143929).

• CVE-2026-0864: normalize CR and CRLF line endings when writing multi-line values in ConfigParser - RawConfigParser.write() escaped only '\n' (to '\n\t'), so an attacker-controlled value containing a bare carriage return was written out verbatim and injected unexpected keys and values into the resulting configuration file. Applied at both write() call sites, for the DEFAULT section and for named sections; Python 2.7 has no _write_section(). Backported from upstream CPython (gh-143927, GH-143929).

• SECURITY UPDATE: configuration file injection via carriage returns in multi-line ConfigParser values (CVE-2026-0864)
  • debian/patches/CVE-2026-0864.patch: normalize CR and CRLF to LF plus tab continuation at both value-serialisation sites in RawConfigParser.write() in Lib/ConfigParser.py, so a carriage return inside an attacker-controlled value can no longer inject extra keys and sections into the written file; adds the upstream regression test to Lib/test/test_cfgparser.py.
  • CVE-2026-0864

• CVE-2026-0864: normalize CR and CRLF line endings when writing multi-line configparser values, preventing config-file injection
• CVE-2026-11940: re-filter the hardlink-extraction fallback at the link member's own path so a crafted archive cannot create a symlink outside the destination directory

• CVE-2026-0864: normalize all line endings (CR, CRLF and LF) when writing multi-line values in configparser, preventing injection of unexpected keys
• CVE-2026-11940: validate the symlink at the hardlink's own path in the tarfile hardlink-extraction fallback, closing a symlink escape that bypassed the 'data' and 'tar' extraction filters, and pass filter_function through TarFile.extract() so that guard is reachable from extract() and not only from extractall()

• SECURITY UPDATE: configuration-file injection in the configparser module when writing multi-line values containing carriage returns
  • debian/patches/CVE-2026-0864.patch: normalize CRLF and bare CR to LF before applying the '\n' -> '\n\t' continuation escape in _write_section() in Lib/configparser.py, so an attacker-controlled value can no longer inject additional keys and values into the written file; adds the upstream regression test test_crlf_normalization to Lib/test/test_configparser.py.
  • CVE-2026-0864

• CVE-2026-0864: normalize CR and CRLF line endings when writing multi-line values in ConfigParser - RawConfigParser.write() escaped only '\n' (to '\n\t'), so an attacker-controlled value containing a bare carriage return was written out verbatim and injected unexpected keys and values into the resulting configuration file. Applied at both write() call sites, for the DEFAULT section and for named sections; Python 2.7 has no _write_section(). Backported from upstream CPython (gh-143927, GH-143929).

• SECURITY UPDATE: configuration injection in configparser via a carriage return in an attacker-controlled written value
  • debian/patches/CVE-2026-0864.patch: in Lib/configparser.py, normalize CR and CRLF to LF before indenting continuation lines in RawConfigParser._write_section(), so a bare carriage return inside a written value can no longer round-trip into an unindented line that the parser reads back as a separate "key = value" pair. Backport of upstream commit 5858e42c539d (gh-143927 / GH-143929) via the 3.10 backport 12dcbd74d356; applies to 3.7.3 with line offsets only. Bundles the upstream regression test test_crlf_normalization (test_configparser.py).
  • CVE-2026-0864

• CVE-2026-0864: normalize CR and CRLF line endings to LF plus tab continuation when ConfigParser writes multi-line values, so a carriage return inside an attacker-controlled value can no longer inject extra keys and values into the written configuration file

• SECURITY UPDATE: configuration-file injection in the configparser module when writing multi-line values that contain carriage returns
  • debian/patches/CVE-2026-0864.patch: normalize CRLF and bare CR to LF before applying the newline-to-tab continuation escape in _write_section() in Lib/configparser.py, so an attacker-controlled value can no longer inject additional keys and sections into the written file; adds the upstream regression test test_crlf_normalization to Lib/test/test_configparser.py.
  • CVE-2026-0864

• CVE-2026-0864: normalize CR and CRLF line endings to LF plus tab continuation when ConfigParser writes multi-line values, so a carriage return inside an attacker-controlled value can no longer inject extra keys and values into the written configuration file

• SECURITY UPDATE: configuration file injection via carriage returns in multi-line ConfigParser values (CVE-2026-0864)
  • debian/patches/CVE-2026-0864.patch: normalize CR and CRLF to LF plus tab continuation at both value-serialisation sites in RawConfigParser.write() in Lib/ConfigParser.py, so a carriage return inside an attacker-controlled value can no longer inject extra keys and sections into the written file; adds the upstream regression test to Lib/test/test_cfgparser.py.
  • CVE-2026-0864

• SECURITY UPDATE: Configuration file injection via unescaped carriage returns in ConfigParser.write()
  • debian/patches/CVE-2026-0864.patch: normalize CR, CRLF and LF line endings to '\n\t' in both value-escaping call sites of RawConfigParser.write() in Lib/ConfigParser.py, so an attacker controlled value can no longer inject unexpected keys into the written file; add regression test to Lib/test/test_cfgparser.py
  • CVE-2026-0864

• CVE-2026-0864: normalize CR and CRLF line endings to LF before the newline-to-continuation escape in configparser._write_section(), so an attacker-controlled value containing a bare CR can no longer inject extra keys when the written file is re-read (upstream gh-143927, 3.10-branch commit 12dcbd74d3)

• CVE-2026-0864: normalize CR and CRLF line endings to LF before the newline-to-continuation escape in configparser._write_section(), so an attacker-controlled value containing a bare CR can no longer inject extra keys when the written file is re-read (upstream gh-143927, 3.10-branch commit 12dcbd74d3)

• CVE-2026-0864: normalize CR and CRLF line endings to LF+TAB when writing multi-line configparser values, preventing configuration injection via attacker-controlled values

• CVE-2026-0864: normalize CR and CRLF line endings to LF+TAB when writing multi-line configparser values, preventing configuration injection via attacker-controlled values

• CVE-2026-0864: normalize CR and CRLF line endings when configparser writes multi-line values, preventing key/value injection into the written file

• CVE-2026-0864: normalize CR and CRLF line endings to LF+TAB when writing multi-line configparser values, preventing configuration injection via attacker-controlled values

• CVE-2026-0864: normalize CR and CRLF line endings to LF plus tab continuation when ConfigParser.write() serialises a multi-line value. A bare carriage return inside an attacker-controlled value was emitted verbatim and read back by line-oriented consumers as a line break, injecting unintended keys and values into the written file.

• CVE-2026-0864: fix configuration injection in the ConfigParser module by normalizing all line endings (CR, CRLF and LF) to LF+TAB when writing multi-line values, so a carriage return in an attacker-controlled value can no longer inject unexpected keys and values into the written file

• CVE-2026-0864: fix configuration injection in the ConfigParser module by normalizing all line endings (CR, CRLF and LF) to LF+TAB when writing multi-line values, so a carriage return in an attacker-controlled value can no longer inject unexpected keys and values into the written file

These are all security issues fixed in the python310-3.10.20-8.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python311-3.11.15-8.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python312-3.12.13-8.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python315-3.15.0~b4-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-3.13.14-2.1 package on the GA media of openSUSE Tumbleweed.

This update for python313 fixes the following issues:

• CVE-2025-15366: user-controlled command can allow additional commands injected using newlines (bsc#1257044).
• CVE-2025-15367: control characters may allow the injection of additional commands (bsc#1257041).
• CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used (bsc#1269066).
• CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks (bsc#1269959).
• CVE-2026-8328: ftpcp() does not use actual peer address and trusts server-supplied PASV host address (bsc#1265268).
• CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and enables arbitrary file reads and writes (bsc#1268977).
• CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS (bsc#1269788).
• CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations (bsc#1271192).

When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.

Root has patched CVE-2026-0864 in the python3.9 package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-0864 in the python3.11 package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-0864 in the python3.13 package for Root:Debian:13. Multiple fixed versions available.