{"id":"CVE-2026-5713","aliases":["ALSA-2026:19019","ALSA-2026:19176","BELL-CVE-2026-5713","BIT-libpython-2026-5713","BIT-python-2026-5713","BIT-python-min-2026-5713","DEBIAN-CVE-2026-5713","EUVD-2026-22311","GHSA-2w92-jcqh-43jc","MGASA-2026-0455","PSF-2026-19","RHSA-2026:19019","RHSA-2026:19176","RHSA-2026:7443","RHSA-2026:8822","RHSA-2026:8824","RHSA-2026:9228","RLSA-2026:19019","RLSA-2026:19176","UBUNTU-CVE-2026-5713","USN-8509-1","openSUSE-SU-2026:10648-1","openSUSE-SU-2026:11181-1"],"status":"published","title":"Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target","description":"The \"profiling.sampling\" module (Python 3.15+) and \"asyncio introspection capabilities\" (3.14+, \"python -m asyncio ps\" and \"python -m asyncio pstree\") features could be used to read and write addresses in a privileged process if that process connected to a malicious or \"infected\" Python process via the remote debugging feature. This vulnerability requires persistently and repeatedly connecting to the process to be exploited, even after the connecting process crashes with high likelihood due to ASLR.","severity":{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00132,"percentile":0.02834,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-121","CWE-125"],"published":"2026-04-14T15:11:51Z","modified":"2026-11-04T07:07:34Z","fixes":[{"ecosystem":"Alpaquita:stream","package":"python3","fixed_in":["3.14.5-r1"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"python3","fixed_in":["3.14.5-r1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"libpython","fixed_in":["3.14.5"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"python","fixed_in":["3.14.5"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"python-min","fixed_in":["3.14.5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python3.14","fixed_in":["3.14.5-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"python3.14","fixed_in":["3.14.4-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.4-2.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3.14-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.4-2.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3.14-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.4-2.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3.14-freethreading","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.4-2.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3.14-freethreading-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.4-2.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3.14-freethreading-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.4-2.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3.14-freethreading-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.4-2.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3.14-freethreading-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.4-2.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3.14-freethreading-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.4-2.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3.14-freethreading-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.4-2.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3.14-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.4-2.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3.14-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.4-2.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3.14-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.4-2.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3.14-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.4-2.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.4-2.el9_8"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3.14-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.4-2.el9_8"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3.14-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.4-2.el9_8"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3.14-freethreading","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.4-2.el9_8"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3.14-freethreading-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.4-2.el9_8"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3.14-freethreading-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.4-2.el9_8"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3.14-freethreading-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.4-2.el9_8"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3.14-freethreading-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.4-2.el9_8"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3.14-freethreading-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.4-2.el9_8"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3.14-freethreading-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.4-2.el9_8"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3.14-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.4-2.el9_8"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3.14-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.4-2.el9_8"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3.14-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.4-2.el9_8"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3.14-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.4-2.el9_8"}]}],"bundled":9},{"source":"osv","ecosystem":"Alpaquita:stream","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.4-r0"},{"fixed":"3.14.5-r1"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.4-r0"},{"fixed":"3.14.5-r1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"libpython","ranges":[{"type":"SEMVER","events":[{"introduced":"3.14.0"},{"fixed":"3.14.5"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"python","ranges":[{"type":"SEMVER","events":[{"introduced":"3.14.0"},{"fixed":"3.14.5"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"python-min","ranges":[{"type":"SEMVER","events":[{"introduced":"3.14.0"},{"fixed":"3.14.5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python3.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.5-1"}]}],"versions":["3.14.0-1","3.14.0-2","3.14.0-3","3.14.0-4","3.14.0-5","3.14.0~a7-1","3.14.0~b1-1","3.14.0~b2-1","3.14.0~b3-1","3.14.0~b4-1","3.14.0~rc1-1","3.14.0~rc2-1","3.14.0~rc3-1","3.14.2-1","3.14.3-1","3.14.3-2","3.14.3-3","3.14.3-4","3.14.3-5","3.14.4-1","3.14.4-2","3.14.5~rc1-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.15-1.mga10"}]}],"bundled":17},{"source":"osv","ecosystem":"Mageia:10","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.2.1-1.mga10"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3.14-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3.14-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3.14-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3.14-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3.14-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3.14-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3.14-freethreading","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3.14-freethreading-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3.14-freethreading-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3.14-freethreading-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3.14-freethreading-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3.14-freethreading-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3.14-freethreading-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3.14-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3.14-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.el9_8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3.14-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.el9_8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3.14-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.el9_8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3.14-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.el9_8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3.14-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.el9_8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3.14-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.el9_8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"python3.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.el9_8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"python3.14-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.el9_8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"python3.14-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.el9_8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"python3.14-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.el9_8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"python3.14-freethreading","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.el9_8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"python3.14-freethreading-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.el9_8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"python3.14-freethreading-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.el9_8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"python3.14-freethreading-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.el9_8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"python3.14-freethreading-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.el9_8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"python3.14-freethreading-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.el9_8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"python3.14-freethreading-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.el9_8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"python3.14-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.el9_8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"python3.14-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.el9_8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"python3.14-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.el9_8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.13.13-1.hum1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.13-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.13.13-1.hum1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.13-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.13.13-1.hum1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.13-freethreading","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.13.13-1.hum1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.13-freethreading-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.13.13-1.hum1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.13-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.13.13-1.hum1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.13-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.13.13-1.hum1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.13-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.13.13-1.hum1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.13-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.13.13-1.hum1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.15-4.hum1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.11-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.15-4.hum1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.15-4.hum1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.11-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.15-4.hum1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.11-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.15-4.hum1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.11-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.15-4.hum1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.11-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.15-4.hum1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.13-3.hum1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.12-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.13-3.hum1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.12-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.13-3.hum1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.12-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.13-3.hum1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.12-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.13-3.hum1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.12-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.13-3.hum1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.12-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.13-3.hum1"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python-unversioned-command","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.14-freethreading","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.14-freethreading-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.14-freethreading-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.14-freethreading-idle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.14-freethreading-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.14-freethreading-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3.14-freethreading-tkinter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:10","package":"python3.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:9","package":"python3.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.4-2.el9_8"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python3.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.14.0~a7-0ubuntu1","3.14.0~b1-1","3.14.0~b3-1","3.14.0~rc1-1","3.14.0~rc2-1","3.14.0~rc3-1","3.14.0-1","3.14.0-1ubuntu0.1","3.14.0-1ubuntu0.2","3.14.0-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"python3.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.4-1ubuntu0.1"}]}],"versions":["3.14.0-1","3.14.0-2","3.14.0-4","3.14.2-1","3.14.3-1","3.14.3-2","3.14.3-3","3.14.3-5","3.14.4-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python3.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.12-1~22.04.16"}]}],"versions":["3.10.0-2","3.10.0-3","3.10.0-4","3.10.0-5","3.10.0-5build1","3.10.1-1","3.10.1-2","3.10.2-1","3.10.2-5","3.10.2-7","3.10.3-1","3.10.4-3","3.10.4-3ubuntu0.1","3.10.6-1~22.04","3.10.6-1~22.04.1","3.10.6-1~22.04.2","3.10.6-1~22.04.2ubuntu1","3.10.6-1~22.04.2ubuntu1.1","3.10.12-1~22.04.2","3.10.12-1~22.04.3","3.10.12-1~22.04.4","3.10.12-1~22.04.5","3.10.12-1~22.04.6","3.10.12-1~22.04.7","3.10.12-1~22.04.8","3.10.12-1~22.04.9","3.10.12-1~22.04.10","3.10.12-1~22.04.11","3.10.12-1~22.04.12","3.10.12-1~22.04.13","3.10.12-1~22.04.14","3.10.12-1~22.04.15"],"bundled":18},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python3.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.3-1ubuntu0.15"}]}],"versions":["3.12.0-1","3.12.0-5","3.12.0-6","3.12.0-7","3.12.1-2","3.12.2-1","3.12.2-4build3","3.12.2-4build4","3.12.2-5ubuntu3","3.12.3-1","3.12.3-1ubuntu0.1","3.12.3-1ubuntu0.2","3.12.3-1ubuntu0.3","3.12.3-1ubuntu0.4","3.12.3-1ubuntu0.5","3.12.3-1ubuntu0.6","3.12.3-1ubuntu0.7","3.12.3-1ubuntu0.8","3.12.3-1ubuntu0.9","3.12.3-1ubuntu0.10","3.12.3-1ubuntu0.11","3.12.3-1ubuntu0.12","3.12.3-1ubuntu0.13"],"bundled":18},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"python3.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.4-1ubuntu0.1"}]}],"versions":["3.14.0-1","3.14.0-2","3.14.0-4","3.14.2-1","3.14.3-1","3.14.3-2","3.14.3-3","3.14.3-5","3.14.4-1"],"bundled":18},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python315","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15.0~a8-3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python314","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.6-1.1"}]}],"bundled":12}],"products":[{"vendor":"python software foundation","product":"cpython"}],"references":[{"url":"https://github.com/python/cpython/pull/148187","tags":["patch","web","fix","article"]},{"url":"https://github.com/python/cpython/issues/148178","tags":["issue-tracking","web","report","article"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/OG4RHARYSNIE22GGOMVMCRH76L5HKPLM/","tags":["vendor-advisory","web","advisory","article","report"]},{"url":"https://github.com/python/cpython/commit/289fd2c97a7e5aecb8b69f94f5e838ccfeee7e67","tags":["patch","web","fix"]},{"url":"https://github.com/python/cpython/commit/316f6265b7f9ca4ffed5346b747475ef1943f35d","tags":["patch","web","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2026/04/15/6","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5713","tags":["web","advisory"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/OG4RHARYSNIE22GGOMVMCRH76L5HKPLM"},{"url":"https://github.com/advisories/GHSA-2w92-jcqh-43jc"},{"url":"https://access.redhat.com/errata/RHSA-2026:19019","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-0865","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1502","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-2297","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-3644","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-4224","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-4519","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-4786","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-5713","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6100","tags":["report"]},{"url":"https://bugzilla.redhat.com/2431367","tags":["report"]},{"url":"https://bugzilla.redhat.com/2444691","tags":["report"]},{"url":"https://bugzilla.redhat.com/2448168","tags":["report"]},{"url":"https://bugzilla.redhat.com/2448181","tags":["report"]},{"url":"https://bugzilla.redhat.com/2449649","tags":["report"]},{"url":"https://bugzilla.redhat.com/2457409","tags":["report"]},{"url":"https://bugzilla.redhat.com/2457932","tags":["report"]},{"url":"https://bugzilla.redhat.com/2458049","tags":["report"]},{"url":"https://bugzilla.redhat.com/2458239","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-19019.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19176","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-19176.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-5713","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5713.json","tags":["advisory"]},{"url":"https://github.com/python/cpython","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-5713","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0455.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35072","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431367","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2444691","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2448168","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2448181","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2449649","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457409","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457932","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458049","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458239","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_19019.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-0865","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0865","tags":["advisory"]},{"url":"https://github.com/python/cpython/issues/143916","tags":["article"]},{"url":"https://github.com/python/cpython/pull/143917","tags":["article"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/BJ6QPHNSHJTS3A7CFV6IBMCAP2DWRVNT/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1502","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1502","tags":["advisory"]},{"url":"https://github.com/python/cpython/commit/05ed7ce7ae9e17c23a04085b2539fe6d6d3cef69","tags":["article"]},{"url":"https://github.com/python/cpython/issues/146211","tags":["article"]},{"url":"https://github.com/python/cpython/pull/146212","tags":["article"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/2IVPAEQWUJBCTQZEJEVTYCIKSMQPGRZ3/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-2297","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2297","tags":["advisory"]},{"url":"https://github.com/python/cpython/commit/482d6f8bdba9da3725d272e8bb4a2d25fb6a603e","tags":["article"]},{"url":"https://github.com/python/cpython/commit/a51b1b512de1d56b3714b65628a2eae2b07e535e","tags":["article"]},{"url":"https://github.com/python/cpython/commit/e58e9802b9bec5cdbf48fc9bf1da5f4fda482e86","tags":["article"]},{"url":"https://github.com/python/cpython/issues/145506","tags":["article"]},{"url":"https://github.com/python/cpython/pull/145507","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-3644","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3644","tags":["advisory"]},{"url":"https://github.com/python/cpython/commit/57e88c1cf95e1481b94ae57abe1010469d47a6b4","tags":["article"]},{"url":"https://github.com/python/cpython/issues/145599","tags":["article"]},{"url":"https://github.com/python/cpython/pull/145600","tags":["article"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/H6CADMBCDRFGWCMOXWUIHFJNV43GABJ7/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-4224","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4224","tags":["advisory"]},{"url":"https://github.com/python/cpython/commit/196edfb06a7458377d4d0f4b3cd41724c1f3bd4a","tags":["article"]},{"url":"https://github.com/python/cpython/commit/e0a8a6da90597a924b300debe045cdb4628ee1f3","tags":["article"]},{"url":"https://github.com/python/cpython/commit/eb0e8be3a7e11b87d198a2c3af1ed0eccf532768","tags":["article"]},{"url":"https://github.com/python/cpython/issues/145986","tags":["article"]},{"url":"https://github.com/python/cpython/pull/145987","tags":["article"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/5M7CGUW3XBRY7II4DK43KF7NQQ3TPZ6R/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-4519","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4519","tags":["advisory"]},{"url":"https://github.com/python/cpython/issues/143930","tags":["article"]},{"url":"https://github.com/python/cpython/pull/143931","tags":["article"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-4786","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4786","tags":["advisory"]},{"url":"https://github.com/python/cpython/issues/148169","tags":["article"]},{"url":"https://github.com/python/cpython/pull/148170","tags":["article"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/JQDUNJVB4AQNTJECSUKOBDU3XCJIPSE5/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-5713","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6100","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6100","tags":["advisory"]},{"url":"https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d","tags":["article"]},{"url":"https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2","tags":["article"]},{"url":"https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20","tags":["article"]},{"url":"https://github.com/python/cpython/issues/148395","tags":["article"]},{"url":"https://github.com/python/cpython/pull/148396","tags":["article"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_19176.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7443","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1299","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-6075","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-13837","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-13836","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-13462","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-11468","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-8291","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-12084","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-3446","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-3479","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-15282","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-15367","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7443.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2408891","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-6075","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6075","tags":["advisory"]},{"url":"https://github.com/python/cpython/issues/136065","tags":["article"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/IUP5QJ6D4KK6ULHOMPC7DPNKRYQTQNLA/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2402342","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-8291","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-8291","tags":["advisory"]},{"url":"https://github.com/python/cpython/commit/162997bb70e067668c039700141770687bc8f267","tags":["article"]},{"url":"https://github.com/python/cpython/commit/333d4a6f4967d3ace91492a39ededbcf3faa76a6","tags":["article"]},{"url":"https://github.com/python/cpython/issues/139700","tags":["article"]},{"url":"https://github.com/python/cpython/pull/139702","tags":["article"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/QECOPWMTH4VPPJAXAH2BGTA4XADOP62G/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431375","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-11468","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11468","tags":["advisory"]},{"url":"https://github.com/python/cpython/issues/143935","tags":["article"]},{"url":"https://github.com/python/cpython/pull/143936","tags":["article"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/FELSEOLBI2QR6YLG6Q7VYF7FWSGQTKLI/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2418655","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-12084","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-12084","tags":["advisory"]},{"url":"https://github.com/python/cpython/issues/142145","tags":["article"]},{"url":"https://github.com/python/cpython/pull/142146","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447082","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-13462","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13462","tags":["advisory"]},{"url":"https://github.com/python/cpython/issues/141707","tags":["article"]},{"url":"https://github.com/python/cpython/pull/143934","tags":["article"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/EOMI5I66ZMKQ2INNFT6T7IAIKUGPZYIE/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2418078","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-13836","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13836","tags":["advisory"]},{"url":"https://github.com/python/cpython/issues/119451","tags":["article"]},{"url":"https://github.com/python/cpython/pull/119454","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2418084","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-13837","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13837","tags":["advisory"]},{"url":"https://github.com/python/cpython/issues/119342","tags":["article"]},{"url":"https://github.com/python/cpython/pull/119343","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431366","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-15282","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15282","tags":["advisory"]},{"url":"https://github.com/python/cpython/issues/143925","tags":["article"]},{"url":"https://github.com/python/cpython/pull/143926","tags":["article"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/X66HL7SISGJT33J53OHXMZT4DFLMHVKF/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431373","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-15367","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15367","tags":["advisory"]},{"url":"https://github.com/python/cpython/issues/143923","tags":["article"]},{"url":"https://github.com/python/cpython/pull/143924","tags":["article"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2432437","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1299","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1299","tags":["advisory"]},{"url":"https://cve.org/CVERecord?id=CVE-2024-6923","tags":["article"]},{"url":"https://github.com/python/cpython/commit/052e55e7d44718fe46cbba0ca995cb8fcc359413","tags":["article"]},{"url":"https://github.com/python/cpython/issues/144125","tags":["article"]},{"url":"https://github.com/python/cpython/pull/144126","tags":["article"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/6ZZULGALJTITEAGEXLDJE2C6FORDXPBT/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457410","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-3446","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3446","tags":["advisory"]},{"url":"https://github.com/python/cpython/commit/1f9958f909c1b41a4ffc0b613ef8ec8fa5e7c474","tags":["article"]},{"url":"https://github.com/python/cpython/commit/4561f6418a691b3e89aef0901f53fe0dfb7f7c0e","tags":["article"]},{"url":"https://github.com/python/cpython/commit/e31c55121620189a0d1a07b689762d8ca9c1b7fa","tags":["article"]},{"url":"https://github.com/python/cpython/issues/145264","tags":["article"]},{"url":"https://github.com/python/cpython/pull/145267","tags":["article"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/F5ZT5ICGJ6CKXVUJ34YBVY7WOZ5SHG53/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2448746","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-3479","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3479","tags":["advisory"]},{"url":"https://github.com/python/cpython/issues/146121","tags":["article"]},{"url":"https://github.com/python/cpython/pull/146122","tags":["article"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/WYLLVQOOCKGK73JM7Z7ZSNOJC4N7BAWY/","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8822","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-15366","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8822.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431368","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-15366","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15366","tags":["advisory"]},{"url":"https://github.com/python/cpython/issues/143921","tags":["article"]},{"url":"https://github.com/python/cpython/pull/143922","tags":["article"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8824","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8824.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:9228","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9228.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:19019","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:19176","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-5713","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8509-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-4189","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-13462","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-69534","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-0672","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-1299","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-1502","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-2297","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-3276","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-3644","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-4224","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-4519","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-4786","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-6019","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-6100","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-7774","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-8328","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-9669","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-4189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7774","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9669","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-5713","title":"Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target","description":"The \"profiling.sampling\" module (Python 3.15+) and \"asyncio introspection capabilities\" (3.14+, \"python -m asyncio ps\" and \"python -m asyncio pstree\") features could be used to read and write addresses in a privileged process if that process connected to a malicious or \"infected\" Python process via the remote debugging feature. This vulnerability requires persistently and repeatedly connecting to the process to be exploited, even after the connecting process crashes with high likelihood due to ASLR.","status":"published","published":"2026-04-14T15:11:51.122Z","modified":"2026-07-31T13:56:32.041Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-121","CWE-125"],"updated_at":"2026-11-02T13:39:39.001586Z"}],"euvd":[{"id":"EUVD-2026-22311","description":"The \"profiling.sampling\" module (Python 3.15+) and \"asyncio introspection capabilities\" (3.14+, \"python -m asyncio ps\" and \"python -m asyncio pstree\") features could be used to read and write addresses in a privileged process if that process connected to a malicious or \"infected\" Python process via the remote debugging feature. This vulnerability requires persistently and repeatedly connecting to the process to be exploited, even after the connecting process crashes with high likelihood due to ASLR.","status":"published","published":"2026-04-14T15:11:51Z","modified":"2026-07-31T13:56:32Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:02:26.304051Z"}],"ghsa":[{"id":"GHSA-2w92-jcqh-43jc","title":"The \"profiling.sampling\" module (Python 3.15+) and \"asyncio introspection capabilities\" (3.14+, ...","description":"The \"profiling.sampling\" module (Python 3.15+) and \"asyncio introspection capabilities\" (3.14+, \"python -m asyncio ps\" and \"python -m asyncio pstree\") features could be used to read and write addresses in a privileged process if that process connected to a malicious or \"infected\" Python process via the remote debugging feature. This vulnerability requires persistently and repeatedly connecting to the process to be exploited, even after the connecting process crashes with high likelihood due to ASLR.","status":"published","published":"2026-04-14T18:30:36Z","modified":"2026-06-10T21:31:25Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T15:08:43.963781Z"}],"nvd":[{"id":"CVE-2026-5713","description":"The \"profiling.sampling\" module (Python 3.15+) and \"asyncio introspection capabilities\" (3.14+, \"python -m asyncio ps\" and \"python -m asyncio pstree\") features could be used to read and write addresses in a privileged process if that process connected to a malicious or \"infected\" Python process via the remote debugging feature. This vulnerability requires persistently and repeatedly connecting to the process to be exploited, even after the connecting process crashes with high likelihood due to ASLR.","status":"published","published":"2026-04-14T16:16:48.717Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-121","CWE-125"],"updated_at":"2026-11-02T14:12:14.37744Z"}],"osv":[{"id":"CVE-2026-5713","title":"Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target","description":"The \"profiling.sampling\" module (Python 3.15+) and \"asyncio introspection capabilities\" (3.14+, \"python -m asyncio ps\" and \"python -m asyncio pstree\") features could be used to read and write addresses in a privileged process if that process connected to a malicious or \"infected\" Python process via the remote debugging feature. This vulnerability requires persistently and repeatedly connecting to the process to be exploited, even after the connecting process crashes with high likelihood due to ASLR.","status":"published","published":"2026-04-14T15:11:51.122Z","modified":"2026-11-10T13:05:05.010194871Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-121","CWE-125"],"updated_at":"2026-11-10T10:57:25.458985Z"},{"id":"DEBIAN-CVE-2026-5713","description":"The \"profiling.sampling\" module (Python 3.15+) and \"asyncio introspection capabilities\" (3.14+, \"python -m asyncio ps\" and \"python -m asyncio pstree\") features could be used to read and write addresses in a privileged process if that process connected to a malicious or \"infected\" Python process via the remote debugging feature. This vulnerability requires persistently and repeatedly connecting to the process to be exploited, even after the connecting process crashes with high likelihood due to ASLR.","status":"published","published":"2026-04-14T16:16:48.717Z","modified":"2026-10-27T09:47:31.797678441Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:57.590991Z"},{"id":"RHSA-2026:19019","title":"Red Hat Security Advisory: python3.14 security update","status":"published","published":"2026-05-20T10:09:36Z","modified":"2026-10-17T10:10:07Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RHSA-2026:19176","title":"Red Hat Security Advisory: python3.14 security update","status":"published","published":"2026-05-20T10:10:11Z","modified":"2026-10-17T10:10:20Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RHSA-2026:7443","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-20T10:11:15Z","modified":"2026-10-16T10:25:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:8822","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-20T10:12:15Z","modified":"2026-10-17T10:21:25Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:8824","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-20T10:12:15Z","modified":"2026-10-17T10:21:25Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:9228","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-22T10:11:14Z","modified":"2026-10-17T10:21:43Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RLSA-2026:19019","title":"Important: python3.14 security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.\n\nSecurity Fix(es):\n\n* cpython: wsgiref.headers.Headers allows header newline injection in Python (CVE-2026-0865)\n\n* cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)\n\n* cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)\n\n* cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)\n\n* python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)\n\n* python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)\n\n* python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)\n\n* python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)\n\n* python: Python: Information disclosure and arbitrary code execution via remote debugging with a malicious process. (CVE-2026-5713)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-05-29T16:03:24.060458Z","modified":"2026-05-29T16:30:44.673482972Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"RLSA-2026:19176","title":"Important: python3.14 security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.\n\nSecurity Fix(es):\n\n* cpython: wsgiref.headers.Headers allows header newline injection in Python (CVE-2026-0865)\n\n* cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)\n\n* cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)\n\n* cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)\n\n* python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)\n\n* python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)\n\n* python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)\n\n* python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)\n\n* python: Python: Information disclosure and arbitrary code execution via remote debugging with a malicious process. (CVE-2026-5713)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-05-30T18:03:01.190443Z","modified":"2026-05-30T18:25:41.729094954Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"UBUNTU-CVE-2026-5713","description":"The \"profiling.sampling\" module (Python 3.15+) and \"asyncio introspection capabilities\" (3.14+, \"python -m asyncio ps\" and \"python -m asyncio pstree\") features could be used to read and write addresses in a privileged process if that process connected to a malicious or \"infected\" Python process via the remote debugging feature. This vulnerability requires persistently and repeatedly connecting to the process to be exploited, even after the connecting process crashes with high likelihood due to ASLR.","status":"published","published":"2026-04-14T16:16:00Z","modified":"2026-07-06T16:03:14.845886882Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"ALSA-2026:19019","title":"Important: python3.14 security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  \n\nSecurity Fix(es):  \n\n  * cpython: wsgiref.headers.Headers allows header newline injection in Python (CVE-2026-0865)\n  * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)\n  * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)\n  * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)\n  * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)\n  * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)\n  * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)\n  * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)\n  * python: Python: Information disclosure and arbitrary code execution via remote debugging with a malicious process. (CVE-2026-5713)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-05-19T00:00:00Z","modified":"2026-10-29T11:30:15.334182788Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"ALSA-2026:19176","title":"Important: python3.14 security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  \n\nSecurity Fix(es):  \n\n  * cpython: wsgiref.headers.Headers allows header newline injection in Python (CVE-2026-0865)\n  * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)\n  * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)\n  * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)\n  * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)\n  * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)\n  * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)\n  * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)\n  * python: Python: Information disclosure and arbitrary code execution via remote debugging with a malicious process. (CVE-2026-5713)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-05-19T00:00:00Z","modified":"2026-10-29T11:32:31.022395794Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"BELL-CVE-2026-5713","status":"published","published":"2026-04-15T06:08:50.852306Z","modified":"2026-08-19T11:28:30.663854Z","updated_at":"2026-11-02T15:28:24.657778Z"},{"id":"BIT-libpython-2026-5713","title":"Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target","description":"The \"profiling.sampling\" module (Python 3.15+) and \"asyncio introspection capabilities\" (3.14+, \"python -m asyncio ps\" and \"python -m asyncio pstree\") features could be used to read and write addresses in a privileged process if that process connected to a malicious or \"infected\" Python process via the remote debugging feature. This vulnerability requires persistently and repeatedly connecting to the process to be exploited, even after the connecting process crashes with high likelihood due to ASLR.","status":"published","published":"2026-07-08T11:31:30.375Z","modified":"2026-07-08T12:11:24.725693382Z","updated_at":"2026-11-02T15:28:32.162822Z"},{"id":"BIT-python-2026-5713","title":"Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target","description":"The \"profiling.sampling\" module (Python 3.15+) and \"asyncio introspection capabilities\" (3.14+, \"python -m asyncio ps\" and \"python -m asyncio pstree\") features could be used to read and write addresses in a privileged process if that process connected to a malicious or \"infected\" Python process via the remote debugging feature. This vulnerability requires persistently and repeatedly connecting to the process to be exploited, even after the connecting process crashes with high likelihood due to ASLR.","status":"published","published":"2026-07-08T11:36:23.007Z","modified":"2026-07-08T12:11:24.725693382Z","updated_at":"2026-11-02T15:28:34.724063Z"},{"id":"BIT-python-min-2026-5713","title":"Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target","description":"The \"profiling.sampling\" module (Python 3.15+) and \"asyncio introspection capabilities\" (3.14+, \"python -m asyncio ps\" and \"python -m asyncio pstree\") features could be used to read and write addresses in a privileged process if that process connected to a malicious or \"infected\" Python process via the remote debugging feature. This vulnerability requires persistently and repeatedly connecting to the process to be exploited, even after the connecting process crashes with high likelihood due to ASLR.","status":"published","published":"2026-07-08T11:36:23.552Z","modified":"2026-07-08T12:11:24.725693382Z","updated_at":"2026-11-02T15:28:35.111822Z"},{"id":"MGASA-2026-0455","title":"Updated python3 \u0026 python-pip package fixes security vulnerabilities","description":"Please see the references for additional information about\nvulnerabilities.\n","status":"published","published":"2026-09-26T15:57:25Z","modified":"2026-09-26T16:12:22.700215778Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:10648-1","title":"python315-3.15.0~a8-3.1 on GA media","description":"These are all security issues fixed in the python315-3.15.0~a8-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-28T00:00:00Z","modified":"2026-04-29T08:02:01.974833Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:11181-1","title":"python314-3.14.6-1.1 on GA media","description":"These are all security issues fixed in the python314-3.14.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-02T00:00:00Z","modified":"2026-07-03T11:00:06.800628523Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"PSF-2026-19","description":"The \"profiling.sampling\" module (Python 3.15+) and \"asyncio introspection capabilities\" (3.14+, \"python -m asyncio ps\" and \"python -m asyncio pstree\") features could be used to read and write addresses in a privileged process if that process connected to a malicious or \"infected\" Python process via the remote debugging feature. This vulnerability requires persistently and repeatedly connecting to the process to be exploited, even after the connecting process crashes with high likelihood due to ASLR.","status":"published","published":"2026-04-14T15:11:51.122Z","modified":"2026-07-08T12:11:24.725693382Z","updated_at":"2026-11-02T15:52:50.667197Z"},{"id":"USN-8509-1","title":"python3.10, python3.12, python3.14 vulnerabilities","description":"It was discovered that Python incorrectly normalized paths in the tarfile\nmodule. An attacker could possibly use this issue to bypass path\nrestrictions. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04\nLTS. (CVE-2025-13462)\n\nIt was discovered that Python's HTMLParser incorrectly handled certain\nmalformed HTML input. An attacker could possibly use this issue to cause\nPython to crash, resulting in a denial of service. This issue only affected\nUbuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-69534)\n\nIt was discovered that Python's email module incorrectly quoted newlines\nin headers. An attacker could possibly use this issue to inject arbitrary\nemail headers. This issue only affected Ubuntu 22.04 LTS and Ubuntu\n24.04 LTS. (CVE-2026-1299)\n\nIt was discovered that Python's http.client module did not properly\nsanitize carriage return and linefeed characters when handling HTTP\nCONNECT tunnel request headers. An attacker could possibly use this issue\nto inject arbitrary HTTP headers. (CVE-2026-1502)\n\nIt was discovered that Python's importlib module did not generate an\naudit event when loading legacy .pyc files. An attacker could possibly\nuse this issue to bypass auditing mechanisms. This issue only affected\nUbuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-2297)\n\nIt was discovered that Python's unicodedata.normalize() function had\nincorrect algorithmic complexity. An attacker could possibly use this\nissue to cause Python to consume excessive resources, leading to a denial\nof service. (CVE-2026-3276)\n\nIt was discovered that Python's http.cookies module incorrectly handled\ncontrol characters in certain cookie operations. An attacker could possibly\nuse this issue to inject arbitrary content. This issue only affected Ubuntu\n22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-3644)\n\nIt was discovered that the Python pyexpat module was vulnerable to\nunbounded recursion in the Expat XML parser. An attacker could possibly use\nthis issue to cause Python to crash, resulting in a denial of service. This\nissue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4224)\n\nIt was discovered that Python's webbrowser module accepted leading dashes\nin URLs, which could be interpreted as command-line options. An attacker\ncould possibly use this issue to execute arbitrary commands. This issue\nonly affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4519)\n\nIt was discovered that Python incorrectly handled webbrowser.open()\nhandlers. An attacker could possibly use this issue to execute arbitrary\ncommands. (CVE-2026-4786)\n\nIt was discovered that Python's remote debugging module did not properly\nvalidate offset tables when loading debug information. An attacker could\npossibly use this issue to cause Python to crash or execute arbitrary\ncode. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-5713)\n\nIt was discovered that Python's http.cookies module incorrectly escaped\nvalues in the js_output() method. An attacker could possibly use this issue\nto inject arbitrary JavaScript. (CVE-2026-6019)\n\nIt was discovered that Python's lzma, bz2, and gzip decompressor objects\nhad a use-after-free vulnerability. An attacker could possibly use this\nissue to cause Python to crash or execute arbitrary code. (CVE-2026-6100)\n\nIt was discovered that Python's tarfile module did not properly validate\nlink targets when using the data filter. An attacker could possibly use\nthis issue to bypass path restrictions. This issue only affected Ubuntu\n24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-7774)\n\nIt was discovered that the fix for CVE-2021-4189 in Python's ftplib module\nwas incomplete, allowing PASV responses to be used in ftplib.ftpcp(). An\nattacker could possibly use this issue to perform server-side request\nforgery attacks. (CVE-2026-8328)\n\nIt was discovered that Python's bz2 module allowed reuse of a\nBZ2Decompressor object after a decompression error. An attacker could\npossibly use this issue to cause Python to crash or execute arbitrary\ncode. (CVE-2026-9669)","status":"published","published":"2026-07-06T11:48:55Z","modified":"2026-07-06T20:34:33.278982385Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}