Skip to contentPython Software Foundation Cpython vulnerabilities
- python, python software foundation cpython +1 moreExcessive read buffering DoS in http.clientCVE-2025-13836Fix available6.3 Medium
- python, python software foundation cpython +1 moreQuadratic complexity in os.path.expandvars() with user-controlled templateCVE-2025-6075Fix available1.8 Low
- python software foundation cpythonZIP64 End of Central Directory (EOCD) Locator record offset not checkedCVE-2025-8291Fix available4.3 Medium
- python software foundation cpythonTarfile infinite loop during parsing with negative member offsetCVE-2025-8194Fix available7.5 High
- python software foundation cpythonHTMLParser quadratic complexity when processing malformed inputsCVE-2025-6069Fix available4.3 Medium
- python software foundation cpythonBypass extraction filter to modify file metadata outside extraction directoryCVE-2024-12718Fix available5.3 Medium
- python software foundation cpythonTarfile extracts filtered members when errorlevel=0CVE-2025-4435Fix available7.5 High
- python software foundation cpythonBypassing extraction filter to create symlinks to arbitrary targets outside extraction directoryCVE-2025-4138Public exploitFix available7.5 High
- python software foundation cpythonExtraction filter bypass for linking outside extraction directoryCVE-2025-4330Fix available7.5 High
- python software foundation cpythonArbitrary writes via tarfile realpath overflowCVE-2025-4517Public exploitFix available9.4 Critical
- python software foundation cpythonUse-after-free in "unicode_escape" decoder with error handlerCVE-2025-4516Fix available5.9 Medium
- python software foundation cpythonMishandling of comma during folding and unicode-encoding of email headersCVE-2025-1795Fix available2.3 Low
- python software foundation cpythonDefault mimetype known files writeable on WindowsCVE-2024-3220Fix available2.3 Low
- python software foundation cpythonURL parser allowed square brackets in domain namesCVE-2025-0938Fix available6.3 Medium
- python software foundation cpythonUnbounded memory buffering in SelectorSocketTransport.writelines()CVE-2024-12254Fix available8.7 High
- python software foundation cpythonImproper validation of IPv6 and IPvFuture addressesCVE-2024-11168Fix available6.3 Medium
- python, python software foundation cpython +1 moreVirtual environment (venv) activation scripts don't quote pathsCVE-2024-9287Fix available5.3 Medium
- python cpython, python +1 moreRegular-expression DoS when parsing TarFile headersCVE-2024-6232Public exploitFix available7.5 High
- python software foundation cpythonInfinite loop when iterating over zip archive entry names from zipfile.PathCVE-2024-8088Fix available8.7 High
- python cpython, python +1 moreQuadratic complexity parsing cookies with backslashesCVE-2024-7592Fix available7.5 High
- python cpythonEmail header injection due to unquoted newlinesCVE-2024-6923Fix available5.5 Medium
- python software foundation cpythonPure-Python fallback of socket.socketpair() doesn’t authenticate peer connectionCVE-2024-32195.1 Medium
- python software foundation cpythonBuffer overread when using an empty list with SSLContext.set_npn_protocols()CVE-2024-5642Fix available6.5 Medium
- python software foundation cpythonMemory race condition in ssl.SSLContext certificate store methodsCVE-2024-0397Fix available7.4 High
- python cpythonIncorrect IPv4 and IPv6 private rangesCVE-2024-4032Fix available7.5 High
- python cpythontempfile.mkdtemp() may be readable and writeable by all users on WindowsCVE-2024-4030Fix available7.1 High
- python cpythonQuoted zip-bomb protection for zipfileCVE-2024-0450Fix available6.2 Medium
- python software foundation cpythonAn issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.2,...CVE-2023-6597Fix available7.8 High
- python cpython, python +1 moreGroups not dropped before running subprocess when using empty 'extra_groups' parameterCVE-2023-6507Fix available6.1 Medium