Python Software Foundation vulnerabilities

Products

• Cpython 79

Newest

• python software foundation cpython socket.getaddrinfo() accepts embedded null bytes in host and port CVE-2026-116566 5.3 MediumOctober 29, 2026
• python software foundation cpython Lenient parsing of integers for response body and chunk framing CVE-2026-103995 2.0 LowOctober 27, 2026
• python software foundation cpython Distrust compromised intermediate certificates in ssl module CVE-2026-115557 Fix available 9.4 CriticalOctober 24, 2026
• python software foundation cpython tar filter allows writing outside destination via empty-named symlink CVE-2026-114583 Fix available 6.9 MediumOctober 22, 2026
• python software foundation cpython SSLContext.wrap_bio() missing validation of server_hostname parameter CVE-2026-19553 Public exploitFix available 7.6 HighSeptember 30, 2026
• python software foundation cpython Use-after-free of a server-side SSLContext when sni_callback switches contexts CVE-2026-19445 Public exploitFix available 9.2 CriticalSeptember 30, 2026
• python software foundation cpython Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory CVE-2026-12345 Public exploitFix available 5.9 MediumSeptember 29, 2026
• python software foundation cpython tarfile hardlink fallback ignores custom extraction filter rejection via None CVE-2026-87910 Fix available 5.7 MediumSeptember 11, 2026
• python software foundation cpython tarfile extraction filters allow file modification and content disclosure via hard link to symlink CVE-2026-82049 Fix available 8.4 HighSeptember 9, 2026
• python software foundation cpython zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits CVE-2026-15310 Fix available 2.1 LowAugust 25, 2026
• python software foundation cpython tarfile extraction filter bypass allows creation of directories outside the destination CVE-2026-19672 Fix available 6.3 MediumAugust 19, 2026
• python software foundation cpython `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching CVE-2026-15806 Fix available 6.0 MediumAugust 18, 2026
• python software foundation cpython stringprep.map_table_b2() deviates from RFC 3454 Table B.2 CVE-2026-17084 Fix available 6.0 MediumAugust 18, 2026
• python software foundation cpython Super-linear CPU usage for unbounded input to csv.Sniffer.sniff() CVE-2026-18503 Fix available 2.4 LowAugust 10, 2026
• python software foundation cpython Quadratic Behavior in xml.etree.ElementPath Index Predicates CVE-2026-6879 Fix available 2.0 LowJuly 28, 2026
• python, python software foundation cpython +1 more Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations CVE-2026-15308 Fix available 8.7 HighJuly 9, 2026
• python, python software foundation cpython +1 more Tarfile.extract() doesn't fully respect filter parameter CVE-2026-4360 Fix available 2.0 LowJune 30, 2026
• python software foundation cpython tarfile opened in streaming mode mishandles EOF CVE-2026-11972 Fix available 8.2 HighJune 23, 2026
• python, python software foundation cpython +1 more Configuration Injection via Carriage Return (\r) in write() method CVE-2026-0864 Fix available 4.1 MediumJune 23, 2026
• python software foundation cpython tarfile extraction filter bypass allows escaping the destination directory CVE-2026-11940 Fix available 7.8 HighJune 23, 2026
• python software foundation cpython CPython >3.11 Insecure Input Validation resulting in privilege escalation CVE-2026-12003 Fix available 5.3 MediumJune 16, 2026
• python software foundation cpython bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow CVE-2026-9669 Fix available 8.2 HighJune 8, 2026
• python software foundation cpython tarfile.data_filter path traversal bypass allows writing outside the extraction directory CVE-2026-7774 Fix available 6.9 MediumJune 4, 2026
• python software foundation cpython Potential DoS via quadratic complexity in unicodedata.normalize() CVE-2026-3276 Fix available 6.3 MediumJune 3, 2026
• python software foundation cpython FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address CVE-2026-8328 Fix available 5.9 MediumMay 13, 2026
• python, python software foundation cpython +1 more The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection CVE-2026-7210 Fix available 6.3 MediumMay 11, 2026
• python, python software foundation cpython +1 more shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs CVE-2026-3087 Fix available 6.0 MediumApril 27, 2026
• python, python software foundation cpython +1 more BaseCookie.js_output() does not neutralize embedded characters CVE-2026-6019 Fix available 2.1 LowApril 22, 2026
• python software foundation cpython Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes CVE-2026-3298 Fix available 8.8 HighApril 21, 2026
• python software foundation cpython Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target CVE-2026-5713 Fix available 5.3 MediumApril 14, 2026
• python software foundation cpython, red hat ai inference server 3.2, ai inference server 3.3 +21 more +23 more Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open() CVE-2026-4786 Fix available 7.0 HighApril 13, 2026
• python software foundation cpython, red hat ai inference server 3.2, ai inference server 3.3 +22 more +24 more Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure CVE-2026-6100 Fix available 9.1 CriticalApril 13, 2026
• python software foundation cpython Base64 decoding stops at first padded quad by default CVE-2026-3446 Fix available 6.0 MediumApril 10, 2026
• python software foundation cpython HTTP client proxy tunnel headers not validated for CR/LF CVE-2026-1502 Fix available 5.7 MediumApril 10, 2026
• python pymanager Possible to hijack modules in current working directory CVE-2026-5271 5.6 MediumApril 1, 2026
• python, python software foundation cpython, red hat ai inference server 3.2 +24 more +26 more webbrowser.open() allows leading dashes in URLs CVE-2026-4519 Fix available 7.0 HighMarch 20, 2026
• python software foundation cpython pkgutil.get_data() does not enforce documented restrictions CVE-2026-3479 Fix availableDisputed 0.0 NoneMarch 18, 2026
• python, python software foundation cpython +1 more Stack overflow parsing XML with deeply nested DTD content models CVE-2026-4224 Fix available 6.0 MediumMarch 16, 2026
• python, python software foundation cpython +1 more Incomplete control character validation in http.cookies CVE-2026-3644 Fix available 6.0 MediumMarch 16, 2026
• python, python software foundation cpython +1 more tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling CVE-2025-13462 Fix available 2.0 LowMarch 12, 2026
• python software foundation cpython SourcelessFileLoader does not use io.open_code() CVE-2026-2297 Fix available 5.7 MediumMarch 4, 2026
• python software foundation cpython email BytesGenerator header injection due to unquoted newlines CVE-2026-1299 Fix available 6.0 MediumJanuary 23, 2026
• python, python software foundation cpython +1 more base64.b64decode() always accepts "+/" characters, despite setting altchars CVE-2025-12781 Fix available 6.3 MediumJanuary 21, 2026
• python software foundation cpython Header injection in http.cookies.Morsel CVE-2026-0672 Fix available 6.0 MediumJanuary 20, 2026
• python software foundation cpython POP3 command injection in user-controlled commands CVE-2025-15367 Fix available 5.9 MediumJanuary 20, 2026
• python software foundation cpython IMAP command injection in user-controlled commands CVE-2025-15366 Fix available 5.9 MediumJanuary 20, 2026
• python software foundation cpython Header injection via newlines in data URL mediatype CVE-2025-15282 Fix available 6.0 MediumJanuary 20, 2026
• python software foundation cpython wsgiref.headers.Headers allows header newline injection CVE-2026-0865 Fix available 5.9 MediumJanuary 20, 2026
• python software foundation cpython Folding email comments of unfoldable characters doesn't preserve parenthesis CVE-2025-11468 Fix available 5.7 MediumJanuary 20, 2026
• python, python software foundation cpython +1 more Quadratic complexity in node ID cache clearing CVE-2025-12084 Fix available 6.3 MediumDecember 3, 2025
• Show olderLoading…