{"id":"CVE-2026-3298","aliases":["BIT-libpython-2026-3298","BIT-python-2026-3298","BIT-python-min-2026-3298","EUVD-2026-24136","GHSA-3p9c-22jr-wq4x","PSF-0000-CVE-2026-3298","PSF-2026-20","ROOT-OS-ALPINE-320-CVE-2026-3298","UBUNTU-CVE-2026-3298"],"status":"published","title":"Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes","description":"The method \"sock_recvfrom_into()\" of \"asyncio.ProacterEventLoop\" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.","severity":{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00392,"percentile":0.33668,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2026-04-21T14:45:01Z","modified":"2026-11-04T02:47:33Z","fixes":[{"ecosystem":"Bitnami","package":"libpython","fixed_in":["3.11.16","3.12.14","3.13.14","3.14.5"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"python","fixed_in":["3.11.16","3.12.14","3.13.14","3.14.5"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"python-min","fixed_in":["3.11.16","3.12.14","3.13.14","3.14.5"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"python3","fixed_in":["3.12.13-r00072","3.12.13-r00073","3.12.13-r00074","3.12.13-r00075","3.12.13-r00076"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"rootio-python3","fixed_in":["3.12.13-r00072","3.12.13-r00073","3.12.13-r00074","3.12.13-r00075","3.12.13-r00076"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"libpython","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.11.16"},{"introduced":"3.12.0"},{"fixed":"3.12.14"},{"introduced":"3.13.0"},{"fixed":"3.13.14"},{"introduced":"3.14.0"},{"fixed":"3.14.5"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"python","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.11.16"},{"introduced":"3.12.0"},{"fixed":"3.12.14"},{"introduced":"3.13.0"},{"fixed":"3.13.14"},{"introduced":"3.14.0"},{"fixed":"3.14.5"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"python-min","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.11.16"},{"introduced":"3.12.0"},{"fixed":"3.12.14"},{"introduced":"3.13.0"},{"fixed":"3.13.14"},{"introduced":"3.14.0"},{"fixed":"3.14.5"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.13-r00072"},{"fixed":"3.12.13-r00073"},{"fixed":"3.12.13-r00074"},{"fixed":"3.12.13-r00075"},{"fixed":"3.12.13-r00076"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"rootio-python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.13-r00072"},{"fixed":"3.12.13-r00073"},{"fixed":"3.12.13-r00074"},{"fixed":"3.12.13-r00075"},{"fixed":"3.12.13-r00076"}]}]}],"products":[{"vendor":"python software foundation","product":"cpython"}],"references":[{"url":"https://github.com/python/cpython/pull/148809","tags":["patch","web","fix"]},{"url":"https://github.com/python/cpython/issues/148808","tags":["issue-tracking","web","report"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/KWTPIQBOOOUNQP7UFSLBI437NJDFLA3F/","tags":["vendor-advisory","web","advisory","report"]},{"url":"https://github.com/python/cpython/commit/1274766d3c29007ab77245a72abbf8dce2a9db4d","tags":["patch","web","fix"]},{"url":"https://github.com/python/cpython/commit/27522b7d6e6588f03e61099dd858cd5a9314e2f2","tags":["patch","web","fix"]},{"url":"https://github.com/python/cpython/commit/95633d2aad4721e25e4dfd9f43dfb6e1edcbd741","tags":["patch","web","fix"]},{"url":"https://github.com/python/cpython/commit/6c8b85b3f1d83d5697ec19880960e1eacee56688","tags":["patch","web","fix"]},{"url":"https://github.com/python/cpython/commit/f5ca38739241fe7a40a4b116d5a8a1364dd6fea7","tags":["patch","web","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3298","tags":["web","advisory"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/KWTPIQBOOOUNQP7UFSLBI437NJDFLA3F"},{"url":"https://github.com/advisories/GHSA-3p9c-22jr-wq4x"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3298.json","tags":["advisory"]},{"url":"https://github.com/python/cpython","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-3298","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-3298","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-3298","title":"Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes","description":"The method \"sock_recvfrom_into()\" of \"asyncio.ProacterEventLoop\" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.","status":"published","published":"2026-04-21T14:45:01.919Z","modified":"2026-08-13T00:27:55.667Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T13:48:58.05327Z"}],"euvd":[{"id":"EUVD-2026-24136","description":"The method \"sock_recvfrom_into()\" of \"asyncio.ProacterEventLoop\" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.","status":"published","published":"2026-04-21T14:45:01Z","modified":"2026-08-13T00:27:55Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:01:57.213133Z"}],"ghsa":[{"id":"GHSA-3p9c-22jr-wq4x","title":"The method \"sock_recvfrom_into()\" of \"asyncio.ProacterEventLoop\" (Windows only) was missing a...","description":"The method \"sock_recvfrom_into()\" of \"asyncio.ProacterEventLoop\" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.","status":"published","published":"2026-04-21T15:32:22Z","modified":"2026-08-10T03:31:00Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:10:12.952898Z"}],"nvd":[{"id":"CVE-2026-3298","description":"The method \"sock_recvfrom_into()\" of \"asyncio.ProacterEventLoop\" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.","status":"published","published":"2026-04-21T15:16:37.047Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:12:15.493943Z"}],"osv":[{"id":"CVE-2026-3298","title":"Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes","description":"The method \"sock_recvfrom_into()\" of \"asyncio.ProacterEventLoop\" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.","status":"published","published":"2026-04-21T14:45:01.919Z","modified":"2026-11-10T13:11:19.517564925Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-10T13:29:51.103746Z"},{"id":"UBUNTU-CVE-2026-3298","description":"The method \"sock_recvfrom_into()\" of \"asyncio.ProacterEventLoop\" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.","status":"withdrawn","published":"2026-04-21T15:16:00Z","modified":"2026-06-18T17:45:17.206309132Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"BIT-libpython-2026-3298","title":"Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes","description":"The method \"sock_recvfrom_into()\" of \"asyncio.ProacterEventLoop\" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.","status":"published","published":"2026-07-06T15:23:06.466Z","modified":"2026-08-19T09:45:12.131423702Z","updated_at":"2026-11-02T15:28:32.162822Z"},{"id":"BIT-python-2026-3298","title":"Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes","description":"The method \"sock_recvfrom_into()\" of \"asyncio.ProacterEventLoop\" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.","status":"published","published":"2026-07-06T15:27:55.061Z","modified":"2026-08-19T09:45:21.80289085Z","updated_at":"2026-11-02T15:28:34.724063Z"},{"id":"BIT-python-min-2026-3298","title":"Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes","description":"The method \"sock_recvfrom_into()\" of \"asyncio.ProacterEventLoop\" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.","status":"published","published":"2026-07-06T15:27:56.776Z","modified":"2026-08-19T09:45:20.711203199Z","updated_at":"2026-11-02T15:28:35.111822Z"},{"id":"PSF-0000-CVE-2026-3298","description":"The method \"sock_recvfrom_into()\" of \"asyncio.ProacterEventLoop\" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.","status":"published","published":"2026-04-21T14:45:01.919Z","modified":"2026-07-06T16:11:35.785016978Z","updated_at":"2026-11-02T15:52:50.263679Z"},{"id":"PSF-2026-20","description":"The method \"sock_recvfrom_into()\" of \"asyncio.ProacterEventLoop\" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.","status":"published","published":"2026-04-21T14:45:01.919Z","modified":"2026-08-10T14:03:59.543128Z","updated_at":"2026-11-02T15:52:50.667197Z"},{"id":"ROOT-OS-ALPINE-320-CVE-2026-3298","title":"CVE-2026-3298 in python3 - Patched by Root","description":"Root has patched CVE-2026-3298 in the python3 package for Root:Alpine:3.20. Multiple fixed versions available.","status":"published","published":"2026-09-29T10:23:47Z","modified":"2026-09-29T11:15:04.423349886Z","updated_at":"2026-11-02T15:53:28.259095Z"}]}}