pypy3 vulnerabilities (Ubuntu)
21 vulnerabilities.
-
pypy3Ubuntu PyPy pyexpat ExternalEntityParserCreate Use-After-Free 6.3 Medium -
pypy3Ubuntu tarfile hardlink fallback ignores custom extraction filter rejection via None 5.7 Medium -
pypy3Ubuntu tarfile extraction filters allow file modification and content disclosure via hard link to symlink 8.4 High -
pypy3Ubuntu Quadratic Behavior in xml.etree.ElementPath Index Predicates 2.0 Low -
pypy3Ubuntu tarfile extraction filter bypass allows escaping the destination directory 7.8 High -
pypy3Ubuntu tarfile.data_filter path traversal bypass allows writing outside the extraction directory 6.9 Medium -
pypy3Ubuntu Potential DoS via quadratic complexity in unicodedata.normalize() 6.3 Medium -
pypy3Ubuntu BaseCookie.js_output() does not neutralize embedded characters 2.1 Low -
pypy3Ubuntu Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open() 7.0 High -
pypy3Ubuntu Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure 9.1 Critical -
pypy3Ubuntu Base64 decoding stops at first padded quad by default 6.0 Medium -
pypy3Ubuntu HTTP client proxy tunnel headers not validated for CR/LF 5.7 Medium -
pypy3Ubuntu webbrowser.open() allows leading dashes in URLs 7.0 High -
pypy3Ubuntu Stack overflow parsing XML with deeply nested DTD content models 6.0 Medium -
pypy3Ubuntu Python-Markdown has an Uncaught Exception 7.5 High -
pypy3Ubuntu email BytesGenerator header injection due to unquoted newlines 6.0 Medium -
pypy3Ubuntu base64.b64decode() always accepts "+/" characters, despite setting altchars 6.3 Medium -
pypy3Ubuntu Quadratic complexity in node ID cache clearing 6.3 Medium -
pypy3Ubuntu Quadratic complexity in os.path.expandvars() with user-controlled template 1.8 Low -
pypy3Ubuntu URL parser allowed square brackets in domain names 6.3 Medium -
pypy3Ubuntu Buffer overflow in sponge queue functions 9.8 Critical